Repository navigation
chore(deps): update Zod to patched v4.6.7 [security] - #2251
Merged
Merged
Conversation
|
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
Contributor
|
Size Change: 0 B Total Size: 238 kB ℹ️ View Unchanged
|
More templates
@tanstack/angular-db
@tanstack/browser-db-sqlite-persistence
@tanstack/capacitor-db-sqlite-persistence
@tanstack/cloudflare-durable-objects-db-sqlite-persistence
@tanstack/convex-db-collection
@tanstack/db
@tanstack/db-ivm
@tanstack/db-sqlite-persistence-core
@tanstack/electric-db-collection
@tanstack/electron-db-sqlite-persistence
@tanstack/expo-db-sqlite-persistence
@tanstack/node-db-sqlite-persistence
@tanstack/offline-transactions
@tanstack/powersync-db-collection
@tanstack/preact-db
@tanstack/query-db-collection
@tanstack/react-db
@tanstack/react-native-db-sqlite-persistence
@tanstack/react-router-with-db
@tanstack/rxdb-db-collection
@tanstack/solid-db
@tanstack/svelte-db
@tanstack/tauri-db-sqlite-persistence
@tanstack/trailbase-db-collection
@tanstack/vue-db
commit: |
renovate
Bot
force-pushed
the
renovate/npm-zod-vulnerability
branch
from
October 25, 2026 05:34
e8ba012 to
16caa7b
Compare
KyleAMathews
changed the title
Contributor
Incremental update benchmarkComparing Overall median write time vs base: 1.00× · cold hydrate time: 0.91× (geometric mean of per-case ratios; lower is faster). Writes: 0 regression(s), 1 improvement(s) (threshold: ±20% and >0.05ms). Cold hydrate: 1 regression(s), 3 improvement(s) (threshold: ±50% and >5ms). Per-case flags are noisy on shared runners. Read the geometric means first. Writes
Cold hydrate
Each row aggregates the 14.4 scale/index/write-mode configurations of that query; per-configuration tables below. 100 rows/collection | source indexes: none | synced writes — geomean 0.99×, cold 0.97×
100 rows/collection | source indexes: none | optimistic writes — geomean 1.00×, cold 0.88×
100 rows/collection | source indexes: manual | synced writes — geomean 1.06×, cold 0.87×
100 rows/collection | source indexes: manual | optimistic writes — geomean 1.04×, cold 1.14×
1,000 rows/collection | source indexes: none | synced writes — geomean 1.03×, cold 1.00×, 1 change(s)
1,000 rows/collection | source indexes: none | optimistic writes — geomean 0.97×, cold 0.88×
1,000 rows/collection | source indexes: manual | synced writes — geomean 0.96×, cold 0.98×
1,000 rows/collection | source indexes: manual | optimistic writes — geomean 0.96×, cold 0.98×
10,000 rows/collection | source indexes: none | synced writes — geomean 1.01×, cold 0.78×, 1 change(s)
10,000 rows/collection | source indexes: none | optimistic writes — geomean 1.03×, cold 1.20×, 1 change(s)
10,000 rows/collection | source indexes: manual | synced writes — geomean 0.99×, cold 0.71×, 1 change(s)
10,000 rows/collection | source indexes: manual | optimistic writes — geomean 1.00×, cold 0.72×, 1 change(s)
Runner: node v24.8.0, linux 7.0.0-1017-azure, AMD EPYC 7763 64-Core Processor. Timings on shared CI runners are noisy; treat small deltas as indicative only. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Zod releases through 4.6.5 are affected by GHSA-mrhx-c7xc-m3w5. Upgrade the workspace Zod dependencies to patched v4.6.7 and regenerate the lockfile after merging current main.
Update the existing schema tests for Zod 4's explicit record key/value schemas and exact validation messages. The tests retain rejection, error-path, and unchanged-data checks; production code is unchanged.
Validation:
pnpm lint:changedpassed.After the Angular and UUID merges, refresh current main and align Vite ranges on ^7.3.7 so CI checks the combined dependency set. Frozen installation and dependency consistency passed again.
CI on the updated head is the final merge gate.
Refresh the lockfile after the Vite security update merged. Regeneration starts from current main and retains patched Zod/Vite versions; frozen installation, configured dependency consistency, and lint passed.