Update dependency zod to ^4.6.6 #105

Merged

miro merged 1 commit from renovate/non-major-dependencies into main 2026-10-14 18:43:14 +00:00

Conversation 0 Commits 1 Files changed 2 +11 -6

renovatebot commented 2026-10-14 09:04:22 +00:00

Collaborator

Copy link

This PR contains the following updates:

Package	Change	Age	Confidence
zod (source)	^4.6.5 → ^4.6.6

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

colinhacks/zod (zod)

v4.6.6

Compare Source

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #​6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243f, the pre-rewrite copy of 9c21983 with identical contents.

Commits:

• 0cd3af5 docs: load the en locale directly in Zod Mini
• 9d5e60f docs: import locales from zod/locales, not z.locales
• 34a626f docs: tighten the z.locales tree-shaking note
• 74304ce release: stage npm versions instead of publishing them (#​6622)
• b2ef983 docs: add Code for Japan to bronze sponsors
• 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
• bacad51 docs: square the Code for Japan logo to match the other bronze tiles
• c42596b release: hold the run on the release-approval environment until the staged versions are approved (#​6638)
• a2ba4a6 fix(types): declare record output and input as members, not base type arguments (#​6645)
• a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#​6652)
• 529f78d 4.6.6
• 9c21983 ci: stage at verbose so a failed OIDC token exchange says why

---

Configuration

📅 Schedule: (in timezone Europe/Helsinki)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [zod](https://zod.dev) ([source](https://github.com/colinhacks/zod)) | [`^4.6.5` → `^4.6.6`](https://renovatebot.com/diffs/npm/zod/4.6.5/4.6.6) |  |  | ⚠️ Renovate does not enforce Minimum Release Age for `bump`, `lockfileUpdate`, or `rollback` updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s). --- ### Release Notes <details> <summary>colinhacks/zod (zod)</summary> ### [`v4.6.6`](https://github.com/colinhacks/zod/releases/tag/v4.6.6) [Compare Source](https://github.com/colinhacks/zod/compare/v4.6.5...v4.6.6) > Six malicious commits pushed to `main` on September 21 with a compromised git credential were reverted the same day in [#&#8203;6620](https://github.com/colinhacks/zod/issues/6620) and have since been removed from the history of `main`. None were ever published to npm. The npm provenance for 4.6.6 names [`284243f`](https://github.com/colinhacks/zod/commit/284243fb), the pre-rewrite copy of [`9c21983`](https://github.com/colinhacks/zod/commit/9c219833) with identical contents. #### Commits: - [`0cd3af5`](https://github.com/colinhacks/zod/commit/0cd3af5e9f50ad11bbcd4407a46a21b8848ba574) docs: load the en locale directly in Zod Mini - [`9d5e60f`](https://github.com/colinhacks/zod/commit/9d5e60f162997b764b40d45aa02481888db50dea) docs: import locales from zod/locales, not z.locales - [`34a626f`](https://github.com/colinhacks/zod/commit/34a626f307871ecbb0123947559328dc52ed5e3e) docs: tighten the z.locales tree-shaking note - [`74304ce`](https://github.com/colinhacks/zod/commit/74304ce5b5796b5edb9a88ceb8e170b6ea3e82df) release: stage npm versions instead of publishing them ([#&#8203;6622](https://github.com/colinhacks/zod/issues/6622)) - [`b2ef983`](https://github.com/colinhacks/zod/commit/b2ef983e0711ff6517d6020b021071e2e5653efa) docs: add Code for Japan to bronze sponsors - [`8fb2faf`](https://github.com/colinhacks/zod/commit/8fb2faf0584828a6a027d8279db36f6f52784462) docs: crop the Code for Japan logo and list it first in bronze - [`bacad51`](https://github.com/colinhacks/zod/commit/bacad518c41610d654658172d325874bf0ee6290) docs: square the Code for Japan logo to match the other bronze tiles - [`c42596b`](https://github.com/colinhacks/zod/commit/c42596bd1c87e941d7241d10e012c5c196adcc10) release: hold the run on the release-approval environment until the staged versions are approved ([#&#8203;6638](https://github.com/colinhacks/zod/issues/6638)) - [`a2ba4a6`](https://github.com/colinhacks/zod/commit/a2ba4a67986a3e6b2b131be30084a2f460d9ea67) fix(types): declare record output and input as members, not base type arguments ([#&#8203;6645](https://github.com/colinhacks/zod/issues/6645)) - [`a0ebf97`](https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd) fix(v4): check array, set and map size bounds before parsing elements ([#&#8203;6652](https://github.com/colinhacks/zod/issues/6652)) - [`529f78d`](https://github.com/colinhacks/zod/commit/529f78dd9431b07f49647fee3aa0819b3f8b66b7) 4.6.6 - [`9c21983`](https://github.com/colinhacks/zod/commit/9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1) ci: stage at verbose so a failed OIDC token exchange says why </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Helsinki) - Branch creation - "before 6am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNDUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE0NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

renovatebot added 1 commit 2026-10-14 09:04:22 +00:00

Update non-major dependencies 0606b1d9e8

renovatebot force-pushed renovate/non-major-dependencies from 0606b1d9e8 to f047dc0203 2026-10-14 17:01:29 +00:00 Compare

renovatebot changed title from Update non-major dependencies to Update dependency zod to ^4.6.6 2026-10-14 17:01:35 +00:00

renovatebot force-pushed renovate/non-major-dependencies from f047dc0203 to da146907ec 2026-10-14 17:52:16 +00:00 Compare

miro merged commit 9f444a1bb3 into main 2026-10-14 18:43:14 +00:00

miro deleted branch renovate/non-major-dependencies 2026-10-14 18:43:14 +00:00

miro referenced this pull request from a commit 2026-10-14 18:43:15 +00:00

Update dependency zod to ^4.6.6 (#105)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

miro/files!105

No description provided.