Skip to content

fix(deps): update dependencies - #599

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/dependencies
Open

fix(deps): update dependencies#599
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/dependencies

Conversation

@renovate

@renovate renovate Bot commented Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@aws-sdk/client-s3 (source) ^3.1117.0 → ^3.1135.0 age confidence
axios (source) ^1.19.0 → ^1.20.0 age confidence
zod (source) ^4.4.3 → ^4.6.5 age confidence

Release Notes

aws/aws-sdk-js-v3 (@​aws-sdk/client-s3)

v3.1135.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1134.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1133.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1132.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1131.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1130.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1129.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1128.0

Compare Source

Features
  • client-s3: Adds support for Amazon S3 Object Lock variable retention. Existing S3 APIs that support S3 Object Lock parameters now support two new parameters EventHold and EventHoldDuration at the object level, and DefaultEventHoldDuration at the bucket level. (8b58987)

v3.1127.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1126.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1125.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1124.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1123.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1122.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1121.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1120.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1119.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

v3.1118.0

Compare Source

Note: Version bump only for package @​aws-sdk/client-s3

axios/axios (axios)

v1.20.0

Compare Source

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

  • HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#​11082)

🔒 Security Fixes

  • Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#​11141)

🐛 Bug Fixes

  • Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#​11087, #​11118)
  • Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#​11109)
  • XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#​11094, #​11121)
  • Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#​11091)
  • Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#​11096)

🔧 Maintenance & Chores

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog (axios/axios@v1.19.0...v1.20.0)

colinhacks/zod (zod)

v4.6.5

Compare Source

Commits:

  • d2b135c docs: add the 4.6.x patch highlights to the 4.6 post
  • f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
  • de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#​6598)
  • 56222cd feat(instanceof): key the .properties() shape off the instance type (#​6600)
  • ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#​6595)"
  • cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#​6595)""
  • 0f3f5ee 4.6.5
  • 59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

Compare Source

A patch on top of 4.6.3.

  • d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#​6595)
  • ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#​6588)
  • 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
  • f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#​6153)

v4.6.3

Compare Source

A patch on top of 4.6.2.

  • 413cce9a fix(v4): make z.properties() a check again (#​6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
  • 75d63ee1 docs: show only the .properties() method form in the 4.6 post
  • 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

Compare Source

Commits:

v4.6.1

Compare Source

A patch on top of 4.6.0.

v4.6.0

Compare Source

Commits:

  • 908c9e1 fix(docs): retry the GitHub stars fetch and log the real status
  • 93186ca docs(wiki): drop the zod-compiler benchmark (#​6505)
  • 8ce9e8d feat(mini): publish Zod Mini as the standalone @​zod/mini package (#​6491)
  • 2956c4c chore(mini): sync @​zod/mini to 4.5.4
  • abd41ad docs(wiki): move plans and comparisons into a gitignored internal/ (#​6506)
  • 8106573 chore(docs): build with Turbopack
  • c7ec94d ci: check zod and @​zod/mini lockstep on npm after every publish (#​6507)
  • c46eeff chore: narrow blanket biome-ignore comments (#​6504)
  • a0898b4 ci: wait hours for npm to serve a publish, not ten minutes (#​6502)
  • 1c0bce0 docs: bring the 4.5 charts and worked examples into the docs pages
  • 70eb2c0 docs: drop the traits section and the compilation feature bullet
  • 43b9bfc docs: drop the bound-methods section from the Zod package page
  • cd4f9a6 perf(v4): report Standard Schema issues without constructing a ZodError (#​6509)
  • f3cb364 docs: surface the blog on the home page and in the sidebar
  • f3e7c72 fix(docs): render the docs 404 page inside the (doc) layout once
  • f412178 ci: publish @​zod/mini to JSR in lockstep with npm (#​6510)
  • 5ff9566 Stop re-exporting the compile internals from zod/v4/core (#​6511)
  • 40b4d0b fix(ci): read zod's latest version with npm view when picking the backfill dist-tag
  • a6b4939 Mark the compile internals @​internal instead of hiding them (#​6518)
  • 3195ed0 docs: label the memory chart like the compile chart
  • 8cd1250 docs: center the memory chart callout labels
  • ff56a55 docs: center the memory chart callout labels and pad them off the number
  • fb2fedf docs: tighten the memory chart callout, pad the canvas, say "less memory"
  • 93f3ab3 docs: replace the blog navbar's GitHub icon with a star-count pill
  • 7ae49d6 docs: drop the circle around the star pill's GitHub mark and center it on the pill's arc
  • b801439 bench: add typebox (compiled and dynamic) to the moltar cross-library harness
  • 1ec6b7c docs: add an RSS feed to the blog at /blog/rss.xml
  • 08ba069 perf(v4): read Luhn digits with charCodeAt instead of string indexing (#​6529)
  • 319f47f Emit a length-aware base64url pattern in toJSONSchema (#​6527)
  • a2a019a Accept enum-typed targets in z.toZod (#​6528)
  • 74f9a6d docs: drop the toZod enum block from basics and pin the page's curation rule in a comment
  • f83ab51 fix(v4): reject component-only strings from z.emoji() (#​6532)
  • 84dd3b0 perf: build literal and enum pattern regexes lazily (#​6531)
  • 0227e53 docs: bump the star pill's GitHub mark to 20px
  • 68a609a Widen literal inputs in property check types (#​6520)
  • 2ec972e refactor: collapse toZod's enum leaf normalizer to a dummy union (#​6533)
  • bc1157e docs: use a Response example for z.properties()
  • 07c43e2 Keep the runtime base64 regexes linear so composed parse paths cannot overflow (#​6534)
  • bec73be perf(v4): build the safeParse error on first read (#​6519)
  • bf99021 perf: move util.cached's accessor to a prototype (#​6537)
  • 69f2a7f Collapse toZod's normalizer and move its docs to the API reference (#​6539)
  • abfb389 feat(v4): make z.properties() a schema, and give z.instanceof() a .properties() method (#​6536)
  • 51caf01 refactor: collapse cachedInternal back into cached (#​6540)
  • 81ded99 perf: answer z.validate from the compiled fast path on invalid input (#​6538)
  • eca9687 fix(v4): enforce the six JSON Schema keywords fromJSONSchema silently dropped (#​6535)
  • 68aca3d docs: cover the 4.5 API surface that never made it into the reference
  • 18e71c7 Rename the JSON Schema process helper so bundler polyfills cannot collide (#​6541)
  • 90269c6 Keep a numeric TS enum's reverse-mapping keys out of .options (#​6542)
  • 4d73088 Release the parsed input once a failing safeParse builds its error (#​6543)
  • cafbee4 fix(v4): parse recursive schemas built by a factory (#​6530)
  • 62e6624 feat(v4): add .validate() and .validateAsync() to Zod Classic (#​6547)
  • 07917f4 test(v4): pin the lazy safeParse error's stack behavior (#​6548)
  • 764ac59 perf(v4): settle z.validate on the first failure in parse order (#​6544)
  • e760471 docs: attribute the compiled failure cost to the fallback, not the double pass
  • 5489a53 test(v4): pin the check-chain case that keeps compiled validate's definite guard (#​6551)
  • 7a00236 fix(v4): don't let format checks overwrite tighter min/max bounds (#​6553)
  • e4d67f3 Migrate development and CI to Nub (#​6562)
  • 6f04836 fix(v4): derive JSON Schema constraints by folding checks in the converter (#​6554)
  • 804e0f5 perf: seal the CommonJS exports so require("zod") stops reading through a getter (#​6564)
  • 741981f perf(compile): for-in record walk, cheaper issue finalization, and a generative compile differential (#​6567)
  • eb1c108 ci: release only on workflow_dispatch behind the npm environment (#​6569)
  • 277613a docs: move the release procedure to the maintainer-local notes
  • dcbcf05 fix(compile): unwind the doc indent when a child generator throws (#​6570)
  • e54716c docs(ecosystem): add @​apical-ts/craft (#​5946)
  • c5b9bcb bench: measure what a runtime island's leaked indent cost the generated source
  • 22bed61 feat(v4): add z.iban() string format with mod-97 checksum (#​6571)
  • 36f1796 fix(v4): stop the memoizer from pinning a finished parse (#​6572)
  • f7fd554 perf(v4): drop the lookaheads from the email regex (#​6573)
  • f9465d4 docs: reconcile the sponsor listings with active sponsorships (#​6576)
  • 213ee75 feat(compile): add z.withParser for externally generated parsers (#​6575)
  • 6de10dc docs: reconcile the sponsor listings against every active sponsorship (#​6579)
  • 661673a docs: make the 9thCO logo visible on the light theme
  • 1c51cbe 4.6.0
  • 3b15499 feat(lang): add Tajik (tg) locale
  • c532d76 test(locales): cover Tajik error branches
  • 574d480 fix(locales): clarify Tajik discriminator value message
  • dd9c36f fix(v4): defer recursive object index inference (#​6580)
  • b12aa52 fix: preserve unique tags with defaulted discriminators (#​6582)

v4.5.4

Compare Source

Commits:

v4.5.3

Compare Source

v4.5.2

Compare Source

Commits:

  • a354314 fix(docs): keep blog posts out of the docs collection (#​6484)
  • d378c42 ci: drop canary publishing from the release workflow (#​6487)
  • 212b941 fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#​6488)
  • e7576f5 docs(blog): let the page show through the navbar in dark mode (#​6489)
  • fedb06f fix(docs): match the blog TOC hover bar to the 2px active indicator
  • 6c932fc chore: bump devcontainer image to Node 24 (#​6470)
  • 6635d9d docs(blog): soften the "method memoization" attribution
  • 019ae29 fix(docs): drop ISR on the docs route so the home page hydrates
  • 652bb43 chore(docs): drop the scroll log from the route-change scroller
  • 571c8e8 fix(docs): render blog tabs with the stock fumadocs tab card
  • 9a193aa 4.5.2

v4.5.1

Compare Source

Commits:

  • 2e862db ci: gate the GitHub release and JSR publish on the version being live on npm
  • 8e03380 4.5.1

v4.5.0

Compare Source

Zod 4.5 is now available.

npm install zod@latest

At a glance:

z.compile()

You can now pre-compile any Zod schema using z.compile(schema). This dramatically speeds up parsing performance.

import * as z from "zod";

const Player = z.object({
  username: z.string(),
  bio: z.string(),
  xp: z.number()
});

const CompiledPlayer = z.compile(Player);

A compiled schema can be used exactly like an uncompiled one. There are no special rules around compiled schemas. They're just faster.

Player.parse({ ... });
CompiledPlayer.parse({ ... }); // ~2x faster

On objects, arrays, and unions, this speeds up parsing by a factor of ~3–7. More complex schemas stand to benefit more than simpler ones.

Time per parse on a shared nanosecond axis, standard parser as a gray bar with the compiled time as a blue bar inside it: an array of 10 objects 377 ns to 68 ns (5.5x), a 20-key object 301 ns to 38 ns (7.8x), an array of 10 strings 241 ns to 33 ns (7.3x), a union of 3 objects 190 ns to 36 ns (5.3x), a 3-element tuple 119 ns to 33 ns (3.6x), a 5-key strict object 117 ns to 32 ns (3.7x), a discriminated union 92 ns to 27 ns (3.4x), a 5-key object 76 ns to 28 ns (2.8x); up to 7.8x faster when compiled

Time per parse by schema type, standard parser vs compiled — lower is better (benchmark)

Below are the Moltar benchmark results comparing Zod (compiled and uncompiled) against the Moltar ParseSafe bench.

Bar chart of operations per second on the moltar benchmark fixture, parseSafe category: Zod 4 compiled 47.5M, typia 45.3M, Zod 4 11.6M, valibot 1.8M, effect 1.7M, Zod 3 1.2M, arktype 152k, yup 121k

Throughput on the moltar benchmark fixture (parseSafe: returns a new object with unknown keys stripped) — higher is better (benchmark)

And the equivalent results for the Moltar AssertLoose bench. Tested against the new z.validate(schema, input) function (detailed later in the post).

Bar chart of operations per second on the moltar benchmark fixture, assertLoose category: typia 74.9M, arktype 66.2M, Zod 4 compiled 60.6M, Zod 4 6.5M, valibot 1.9M, effect 1.7M, Zod 3 1.2M, yup 124k

Throughput on the moltar benchmark fixture (assertLoose: returns a boolean, unknown keys allowed) — higher is better (benchmark)

Zod's entire test suite runs twice—once normally and again with auto-compilation enabled globally—to ensure perfect fidelity.

How it works

Under the hood, z.compile() walks the entire schema once and produces a hyperoptimized snippet of flat, loop-free JavaScript that can validate inputs far faster than a standard runtime validator. This snippet can be executed via new Function() (effectively a more powerful eval) to serve as a fast-path validator. Schemas use this to "fast check" validity, falling back to the regular runtime logic on validation failure to provide granular error information.

Take this simple Point schema:

const Point = z.object({
  x: z.number(),
  y: z.number()
});

Here is the generated snippet for it:

const isPoint = new Function("input", `
  if (typeof input !== "object" || input === null) return false;
  if (typeof input.x !== "number") return false;
  if (typeof input.y !== "number") return false;
  return true;
`);

isPoint({ x: 1, y: 2 }); // true
isPoint({ x: "1" });     // false

For the large majority of inputs, the generated function validates the data with the fastest logic JavaScript can express: straight-line typeof checks and property reads, with no interpreter in between. When it can't handle an input, Zod falls back to the standard parser.

This is the function Zod generates for the Player schema above:

if (typeof input !== "object" || input === null || Array.isArray(input)) return INVALID;
const v0 = input["username"];
if (typeof v0 !== "string") return INVALID;
const v1 = input["bio"];
if (typeof v1 !== "string") return INVALID;
const v2 = input["xp"];
if (typeof v2 !== "number" || !Number.isFinite(v2)) return INVALID;
const v3 = { "username": v0, "bio": v1, "xp": v2 };
return v3;

Armed with the power of new Function(), this happens in-process at runtime. There is no need to integrate with your build system.

The compiled schema is purely additive on top of the existing schema. It tacks on the pre-compiled fast path for checking valid inputs. When invalid data is detected, it returns the INVALID symbol to signal that parsing should fall back to the uncompiled parser. This structurally prevents subtle deviations in error reporting between compiled and uncompiled variants.

import "zod/compile"

To compile every schema in an application, import zod/compile once at the top of your entry point. Every schema constructed after that import is automatically compiled the first time it's used to parse data.

import "zod/compile"; // must come before modules that define schemas
import * as z from "zod";

const schema = z.object({ name: z.string() });
schema.parse({ name: "ok" }); // compiled on first parse

It also works as a Node.js CLI flag, which guarantees it runs before any module defines a schema:

node --import zod/compile app.js

Or set preload in bunfig.toml or nub.jsonc.

{
  "preload": ["zod/compile"]
}

All schemas benefit to varying degrees, though complex object/tuple/array schemas benefit more than simple scalar validators.

Read the docs, or the full technical writeup: Introducing z.compile()

z.creditCard()

A new string format: 12–19 digits, optionally separated by single spaces or hyphens, with a valid Luhn checksum. (#​5931)

z.creditCard().parse("4111 1111 1111 1111"); // ✅
z.creditCard().parse("4111 1111 1111 1112"); // ❌ bad checksum

z.properties()

The multi-property counterpart to z.property(). (#​5912)

const httpsUrl = z.instanceof(URL).check(
  ...z.properties({
    protocol: z.literal("https:" as string),
    hostname: z.string().regex(z.regexes.domain),
  })
);

httpsUrl.parse(new URL("https://example.com")); // ✅
httpsUrl.parse(new URL("http://localhost")); // ❌ protocol

z.deepPartial()

Back in functional form after being removed as a method in Zod 4. (#​5928)

const Post = z.object({
  title: z.string(),
  author: z.object({ name: z.string(), email: z.string() }),
});

const PartialPost = z.deepPartial(Post);
type PartialPost = z.output<typeof PartialPost>;
// => { title?: string; author?: { name?: string; email?: string } }

PartialPost.parse({ author: {} }); // ✅

The result is still a ZodObject, so .shape and .extend() keep working.

.exactPartial()

Like .partial(), but wraps each field in z.exactOptional() instead of z.optional(): keys may be omitted, but an explicit undefined is rejected. This matches TypeScript's Partial<> under exactOptionalPropertyTypes. (#​6065)

const Recipe = z.object({ title: z.string(), servings: z.number() });

const PartialRecipe = Recipe.exactPartial();
PartialRecipe.parse({});                    // ✅
PartialRecipe.parse({ title: undefined });  // ❌

In Zod Mini it's a top-level function: z.exactPartial(Recipe).

z.validate()

Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a ZodError, which makes rejection cheap: on invalid input it is up to 16x faster than .safeParse().success. The return type is a guard on the schema's input type, and z.validateAsync() covers schemas with async refinements. (#​6471)

z.validate(z.string(), "hi"); // true
z.validate(z.string(), 42);   // false

z.input() / z.output()

Project a schema onto its input or output side. Useful for validating the two halves of a codec independently. (#​5928)

const isoDate = z.codec(z.iso.datetime(), z.date(), {
  decode: (s) => new Date(s),
  encode: (d) => d.toISOString(),
});

const Event = z.object({ name: z.string(), at: isoDate });

z.input(Event).parse({ name: "launch", at: "2024-01-01T00:00:00Z" }); // ✅
z.output(Event).parse({ name: "launch", at: new Date() });            // ✅

This is a no-op on schemas not containing codecs/pipes.

z.toZod<T>()

A utility to define a Zod schema that agrees exactly with a static type, often one that is handwritten or externally defined. (#​5913)

type Player = { username: string; xp: number };

const Player = z.toZod<Player>()(
  z.object({
    username: z.string(),
    xp: z.number(),
  })
);

Player.shape.username; // ZodString — the schema is returned unchanged

z.getDiscriminatedOption()

Extract a discriminated union member by discriminator value. (#​5947)

const Fruit = z.object({ type: z.literal("fruit"), seeds: z.boolean() });
const Veg = z.object({ type: z.literal("vegetable"), leafy: z.boolean() });
const Produce = z.discriminatedUnion("type", [Fruit, Veg]);

z.getDiscriminatedOption(Produce, "fruit"); // typeof Fruit
z.getDiscriminatedOption(Produce, "meat");  // ❌ TypeScript error

Cyclical inputs

Zod recursive schemas now support cyclical data. For bundle size reasons, Zod Mini requires you to register a memoizer explicitly. (#​6387, #​6482)

Zod

const Category = z.object({
  name: z.string(),
  get subcategories() {
    return z.array(Category);
  },
});

const input: any = { name: "root", subcategories: [] };
input.subcategories.push(input);

const result = Category.parse(input);
result.subcategories[0] === result; // true

Zod Mini

// register a memoizer before defining any schemas
z.config({ memoizer: z.memoizer() });

const result = Category.parse(input);
result.subcategories[0] === result; // true

9x reduction in schema memory footprint

In Zod 4.4 a bare z.string() retained 7.5kb of heap. In Zod 4.5 it retains 784 bytes.

Bar chart of heap retained by one schema instance, zod 4.4.3 versus 4.5: a 10-key object 82.0kb to 11.0kb, a union 17.5kb to 2.13kb, z.string().min(1) 16.7kb to 3.37kb, a record 16.4kb to 2.64kb, z.string().optional() 12.6kb to 1.50kb, an array of strings 11.2kb to 1.93kb, z.string() 7.53kb to 784b, z.number() 4.44kb to 706b. Up to 9.8x smaller than 4.4.3.

Retained heap per schema instance, Zod 4.4.3 vs 4.5 (benchmark)

In Zod 4.4 and earlier, all schema methods were automatically bound to the instance itself. This allowed users to pluck methods from schemas without causing issues due to this-binding.

const { parse } = z.string();

parse("some data");

A consequence of this is that each bound method allocates space on the heap; method implementations are not shared across all instances via prototype, as you'd expect. Zod 4.5 implements a method memoization pattern that avoids allocating bound methods until they are actually accessed.

Read the deep dive: Reducing Zod's memory footprint by an order of magnitude

Faster failures

Zod .parse()/.safeParse() instantiates a JavaScript Error, which captures a stack trace. In the case of validation failures, this is often much slower than the parsing logic itself. When using .safeParse(), Zod no longer captures this stack trace, speeding up failure-path parses by a factor of ~7.5x. (#​6316, #​6450)

const result = Player.safeParse({ username: 42, bio: "hello", xp: 12 });
result.success; // false — ~7.5x faster than Zod 4.4
Bar chart of time per failing safeParse: zod 4.4 at 6.3 microseconds, zod 4.5 at 840 nanoseconds — 7.6x faster

Player schema (benchmark)

Symbol keys in z.object()

A shape can now declare a symbol key. TypeScript tracks it: a const symbol infers as unique symbol, so z.infer makes the key required and checks its value type. Undeclared symbol keys are still ignored. (#​6448)

const TAG = Symbol("tag");
const schema = z.object({ name: z.string(), [TAG]: z.number() });

schema.parse({ name: "alice", [TAG]: 42 }); // ✅ { name: "alice", [TAG]: 42 }
schema.safeParse({ name: "alice" });        // ❌ the symbol key is required

Bug fixes

All of these fix soundness issues, so a schema that relied on the old behavior may now reject input it used to accept.

⚠️ z.iso.datetime() requires seconds

RFC 3339 mandates seconds. z.iso.datetime() and z.iso.datetime({ offset: true }) no longer accept minute-precision input like 2020-01-01T06:15Z. local: true still admits 2020-01-01T06:15, since an unqualified datetime is outside RFC 3339 either way. (#​6457)

z.iso.datetime().parse("2020-01-01T06:15:00Z"); // ✅
z.iso.datetime().parse("2020-01-01T06:15Z");    // ❌ was accepted in 4.4

To accept both forms, union the two precisions:

z.union([z.iso.datetime(), z.iso.datetime({ precision: -1 })]

> ❗ **Important**
> 
> ✂ PR body was truncated to here.


</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - On day 1 of the month (`* * 1 * *`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/api3dao/signed-api).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

@renovate
renovate Bot requested a review from bdrhn9 October 1, 2026 03:55
@renovate
renovate Bot force-pushed the renovate/dependencies branch from 72f7fe3 to fddfd24 Compare October 1, 2026 22:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bdrhn9 bdrhn9 Awaiting requested review from bdrhn9

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants