Update all non-major dependencies - #4128
Merged
Merged
Conversation
Contributor
💻 Website PreviewThe latest changes are available as preview in: https://pr-4128.fets-3ku.pages.dev |
Contributor
✅ Benchmark Results |
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
August 28, 2026 19:15
ac7cbfa to
d9f913b
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
August 29, 2026 01:03
d9f913b to
51b863c
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
August 29, 2026 18:42
51b863c to
0f93c06
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
August 30, 2026 02:38
0f93c06 to
7dc003f
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
August 30, 2026 18:35
7dc003f to
e432f62
Compare
ardatan
force-pushed
the
renovate/all-minor-patch
branch
from
September 1, 2026 13:58
15f5ca0 to
eca9c4b
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
September 1, 2026 15:25
eca9c4b to
245f3e0
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
September 1, 2026 18:53
245f3e0 to
e19f7d3
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
September 1, 2026 21:50
e19f7d3 to
907845e
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
September 2, 2026 01:40
907845e to
8fa23b5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
8.10.162→8.10.16326.4.0→26.4.14.23.12→4.23.135.110.1→5.110.34.127.0→4.128.04.4.3→4.5.4Release Notes
privatenumber/tsx (tsx)
v4.23.13Compare Source
webpack/webpack (webpack)
v5.110.3Compare Source
Patch Changes
Fix
import()options, circular reexport severity and namespace writes. (by @alexander-akait in #21867)Skip ESM interop when require() targets a module outside the concatenation. (by @hai-x in #21884)
Fix concatenated
require()in arequire.ensurecallback or a computed request. (by @hai-x in #21907)Keep
optimization.minimizea boolean; its options move tominimizeOptions. (by @alexander-akait in #21886)Fix mangled exports read through require() and a leaked internal reference. (by @alexander-akait in #21905)
Fix
newon a default import of a wrapped CommonJS module. (by @alexander-akait in #21876)Throw when a deferred namespace of an async module is forced while it evaluates. (by @alexander-akait in #21871)
Do not report a missing export for a name a side-effect-free barrel defers. (by @alexander-akait in #21874)
Fix queue, URL scheme, dotenv, HTTP module and persistent cache edge cases. (by @alexander-akait in #21901)
Evaluate a deferred import's async dependencies where the import sits. (by @alexander-akait in #21902)
Omit ambiguous
export *names from the module namespace. (by @alexander-akait in #21878)v5.110.2Compare Source
Patch Changes
Fix analyzable ESM baking around cycles, mixed-served wasm and style url maps. (by @alexander-akait in #21851)
Minify more HTML and CSS shorthands, and cut two costs off printing. (by @alexander-akait in #21842)
Report a named import that is never read when it names a missing export. (by @alexander-akait in #21856)
Fix ESM circular reexports, cyclic const TDZ, and defer evaluation order. (by @alexander-akait in #21852)
Stop
output.htmlemitting an unused JS chunk for each generated page. (by @alexander-akait in #21859)Stop emitting the CSS chunk loading runtime when every CSS chunk is initial. (by @alexander-akait in #21862)
Strip a BOM a loader put on a string, and shift a source map that counted it. (by @alexander-akait in #21857)
cloudflare/workers-sdk (wrangler)
v4.128.0Compare Source
Minor Changes
#15454
dbbb795Thanks @jamesopstad! - Move binding utilities into@cloudflare/workers-utilsBinding conversion, printing, and local-development validation are now exported from
@cloudflare/workers-utilsso they can be shared by Wrangler, the Cloudflare Vite plugin, and other consumers.The corresponding exports have been removed from
@cloudflare/deploy-helpers. Consumers should import them directly from@cloudflare/workers-utilsinstead.Wrangler's
unstable_printBindingsAPI now accepts the bindings and an options object instead of five positional parameters.#15353
87a7acfThanks @pombosilva! - Add--date-startand--date-endfilters towrangler workflows instances listYou can now narrow an instance listing to a creation-time window:
wrangler workflows instances list my-workflow --date-start 2026-01-01 --date-end 2026-01-31Either flag can be used independently. Both accept an ISO 8601 date or timestamp and are normalised to UTC before being sent, so a date-only value such as
2026-01-01works as well as a full2026-01-01T13:00:00Z. The bounds are inclusive and compose with the existing--statusfilter.#15379
ea28cc3Thanks @ibbykhazanchi! - Add query string redaction to Workers observability configurationSet
observability.redact_query_stringinwrangler.jsonorobservability.redactQueryStringin the experimentalcloudflare.config.tsformat to remove query strings from request URLs in logs and traces.#14915
707cb6fThanks @longlho! - Include exact raw and gzip-compressed Worker bundle sizes in structureddeployandversion-uploadoutput.Patch Changes
#15436
200780fThanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#15406
b3f2628Thanks @james-elicx! - Reduce the installed bundle sizes of Wrangler and MiniflareWrangler now resolves bundled workspace dependencies from source during monorepo builds so unused exports can be removed. Miniflare, its shared CLI and container dependencies now use granular
@cloudflare/workers-utilsentry points instead of loading the package barrel, reducing the raw Wrangler and Miniflare artifacts by 6.16 MiB (31.4%) and 1.06 MiB (22.9%) respectively without changing runtime behavior or installed dependencies.#15398
1809c5eThanks @james-elicx! - Reduce Wrangler's published package sizeStop including the unused build metafile in the npm package, reducing its unpacked size by approximately 3.1 MiB.
#15382
b3fb2bfThanks @Om-singhaI! - Skip the skills install status lookup when telemetry is disabledTelemetry events include a
currentAgentSkillsInstalledproperty, and computing it can query the GitHub API. The lookup used to start before the telemetry permission was checked, so users who opted out viaWRANGLER_SEND_METRICS,DO_NOT_TRACK, orsend_metricsin their Wrangler config still triggered network requests on behalf of telemetry. The dispatcher now checks the permission first and only performs the lookup when telemetry is enabled.Updated dependencies [
200780f,b3f2628,87a7acf]:v4.127.1Compare Source
Patch Changes
#15383
eb01850Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#15393
e1df91aThanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
Updated dependencies [
eb01850,e1df91a,b23de74,015550a,015550a,015550a,3650d29,b23de74]:colinhacks/zod (zod)
v4.5.4Compare Source
Commits:
84e416ffix(v4): stop the cycle walk from firing a default factory (#6500)e8e206f4.5.4v4.5.3Compare Source
v4.5.2Compare Source
Commits:
a354314fix(docs): keep blog posts out of the docs collection (#6484)d378c42ci: drop canary publishing from the release workflow (#6487)212b941fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#6488)e7576f5docs(blog): let the page show through the navbar in dark mode (#6489)fedb06ffix(docs): match the blog TOC hover bar to the 2px active indicator6c932fcchore: bump devcontainer image to Node 24 (#6470)6635d9ddocs(blog): soften the "method memoization" attribution019ae29fix(docs): drop ISR on the docs route so the home page hydrates652bb43chore(docs): drop the scroll log from the route-change scroller571c8e8fix(docs): render blog tabs with the stock fumadocs tab card9a193aa4.5.2v4.5.1Compare Source
Commits:
2e862dbci: gate the GitHub release and JSR publish on the version being live on npm8e033804.5.1v4.5.0Compare Source
Zod 4.5 is now available.
At a glance:
z.compile()— the flagship feature of Zod 4.5z.creditCard()— 12–19 digits plus Luhn checksumz.properties()— the multi-property counterpart toz.property()z.deepPartial()/.exactPartial()z.validate(): boolean— a fast-path to verify input validity without a full parse (up to 16x faster on invalid data)bn), Central Kurdish (ckb), Hindi (hi), Kannada (kn), Norwegian Nynorsk (nn), Brazilian Portuguese (pt-BR), Slovak (sk), Turkmen (tk)z.compile()You can now pre-compile any Zod schema using
z.compile(schema). This dramatically speeds up parsing performance.A compiled schema can be used exactly like an uncompiled one. There are no special rules around compiled schemas. They're just faster.
On objects, arrays, and unions, this speeds up parsing by a factor of ~3–7. More complex schemas stand to benefit more than simpler ones.
Time per parse by schema type, standard parser vs compiled — lower is better (benchmark)
Below are the Moltar benchmark results comparing Zod (compiled and uncompiled) against the Moltar ParseSafe bench.
Throughput on the moltar benchmark fixture (parseSafe: returns a new object with unknown keys stripped) — higher is better (benchmark)
And the equivalent results for the Moltar AssertLoose bench. Tested against the new
z.validate(schema, input)function (detailed later in the post).Throughput on the moltar benchmark fixture (assertLoose: returns a boolean, unknown keys allowed) — higher is better (benchmark)
Zod's entire test suite runs twice—once normally and again with auto-compilation enabled globally—to ensure perfect fidelity.
How it works
Under the hood,
z.compile()walks the entire schema once and produces a hyperoptimized snippet of flat, loop-free JavaScript that can validate inputs far faster than a standard runtime validator. This snippet can be executed vianew Function()(effectively a more powerfuleval) to serve as a fast-path validator. Schemas use this to "fast check" validity, falling back to the regular runtime logic on validation failure to provide granular error information.Take this simple
Pointschema:Here is the generated snippet for it:
For the large majority of inputs, the generated function validates the data with the fastest logic JavaScript can express: straight-line
typeofchecks and property reads, with no interpreter in between. When it can't handle an input, Zod falls back to the standard parser.This is the function Zod generates for the
Playerschema above:Armed with the power of
new Function(), this happens in-process at runtime. There is no need to integrate with your build system.import "zod/compile"To compile every schema in an application, import
zod/compileonce at the top of your entry point. Every schema constructed after that import is automatically compiled the first time it's used to parse data.It also works as a Node.js CLI flag, which guarantees it runs before any module defines a schema:
Or set
preloadinbunfig.tomlornub.jsonc.{ "preload": ["zod/compile"] }All schemas benefit to varying degrees, though complex object/tuple/array schemas benefit more than simple scalar validators.
z.creditCard()A new string format: 12–19 digits, optionally separated by single spaces or hyphens, with a valid Luhn checksum. (#5931)
z.properties()The multi-property counterpart to
z.property(). (#5912)z.deepPartial()Back in functional form after being removed as a method in Zod 4. (#5928)
The result is still a
ZodObject, so.shapeand.extend()keep working..exactPartial()Like
.partial(), but wraps each field inz.exactOptional()instead ofz.optional(): keys may be omitted, but an explicitundefinedis rejected. This matches TypeScript'sPartial<>underexactOptionalPropertyTypes. (#6065)In Zod Mini it's a top-level function:
z.exactPartial(Recipe).z.validate()Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a
ZodError, which makes rejection cheap: on invalid input it is up to 16x faster than.safeParse().success. The return type is a guard on the schema's input type, andz.validateAsync()covers schemas with async refinements. (#6471)z.input()/z.output()Project a schema onto its input or output side. Useful for validating the two halves of a codec independently. (#5928)
This is a no-op on schemas not containing codecs/pipes.
z.toZod<T>()A utility to define a Zod schema that agrees exactly with a static type, often one that is handwritten or externally defined. (#5913)
z.getDiscriminatedOption()Extract a discriminated union member by discriminator value. (#5947)
Cyclical inputs
Zod recursive schemas now support cyclical data. For bundle size reasons, Zod Mini requires you to register a memoizer explicitly. (#6387, #6482)
Zod
Zod Mini
9x reduction in schema memory footprint
In Zod 4.4 a bare
z.string()retained 7.5kb of heap. In Zod 4.5 it retains 784 bytes.Retained heap per schema instance, Zod 4.4.3 vs 4.5 (benchmark)
In Zod 4.4 and earlier, all schema methods were automatically bound to the instance itself. This allowed users to pluck methods from schemas without causing issues due to
this-binding.A consequence of this is that each bound method allocates space on the heap; method implementations are not shared across all instances via
prototype, as you'd expect. Zod 4.5 implements a method memoization pattern that avoids allocating bound methods until they are actually accessed.Faster failures
Zod
.parse()/.safeParse()instantiates a JavaScriptError, which captures a stack trace. In the case of validation failures, this is often much slower than the parsing logic itself. When using.safeParse(), Zod no longer captures this stack trace, speeding up failure-path parses by a factor of ~7.5x. (#6316, #6450)Player schema (benchmark)
Symbol keys in
z.object()A shape can now declare a symbol key. TypeScript tracks it: a
constsymbol infers asunique symbol, soz.infermakes the key required and checks its value type. Undeclared symbol keys are still ignored. (#6448)Bug fixes
All of these fix soundness issues, so a schema that relied on the old behavior may now reject input it used to accept.
z.iso.datetime()requires secondsRFC 3339 mandates seconds.
z.iso.datetime()andz.iso.datetime({ offset: true })no longer accept minute-precision input like2020-01-01T06:15Z.local: truestill admits2020-01-01T06:15, since an unqualified datetime is outside RFC 3339 either way. (#6457)To accept both forms, union the two precisions:
.min(),.max(), and.length()counted UTF-16 code units, soz.string().max(5)rejected five emoji. They now count Unicode code points, which is what every non-JS consumer of a length bound does (Postgres, MySQL, Go, Python, and themaxLengththatz.toJSONSchema()emits)..max()only loosens;.min()and.length()tighten for astral input. Graphemes are unchanged — a ZWJ sequence is still several code points. (#6441)Closes #3355.
A record's key schema now governs only the keys that match it, the way TypeScript treats an index signature. Intersecting an object with a pattern-keyed record no longer rejects the object's own keys. (#6412)
Separately, an
unrecognized_keysissue no longer aborts the schema it came from, so a strict object with an extra key and a bad value now reports both issues instead of just the first. Closes #2200, #2573, #4017, #5663.__proto__is always strippedObject and record parsers now drop a
__proto__key whether it comes from the input, is declared by the schema, or is produced by a record key transform. A key that a record's key schema normalizes to__proto__is dropped too..strict()reports an own__proto__input key asunrecognized_keysinstead of silently swallowing it. Error formatters and both JSON Schema converters use own-property writes so atoStringorconstructorpath segment can't walk ontoObject.prototype(#6213, #6367, #6346). (#6386, #6354, #6355, #6221)z.ipv6()validated by handing the string tonew URL(), which let::@1\and::1\nthrough. It now checks the address alphabet directly (#6442).z.ulid()restricts the first character to0–7; anything higher overflows the 48-bit timestamp. A fixture that doesn't start with a real timestamp, such as one with a leading letter, is now rejected (#6095).z.httpUrl()enforces the RFC 1035 length limits on the host, matchingz.hostname()(#6035).z.emoji()no longer backtracks exponentially on a failed match (#6347).z.string().includes(sub, { position: N })emits a JSON Schema pattern that allows at least N leading characters, matchingString.prototype.includes(#6024).Commits
Zod 4.5 rolls up 155 commits. Thanks to everyone who contributed: @dokson, @deepshekhardas, @zirkelc, @francisjohnjohnston-web, @MerlijnW70, @codinsonn, @oimo23, @JSap0914, @zelinewang, @abhishek-chaudhary2003, @spokodev, @Mohammad-Faiz-Cloud-Engineer, @hamed-bavar, @MGPOCKY, @ChiChuRita, @dinwwwh, @thristhart, @tsmartin9, @vedanshshetti, @belicam, @frastefanini, @andersk, @musaddiq-rafi, @tachmyratsaparmyradov, @arvindfroi, @KUMachine, @spidersouris, @catdalfonso, @mneetika, @gwagjiug, @MahinAnowar, @MaksZhukov, @emmayusufu, @agcty, @devareddy05, @Vish05, @yamcodes, @mattiasahlsen, @samchungy, @ozzyfromspace, @udohjeremiah, @patrickwehbe, @gajus, @Harm-Nullix, @thwbh, @IdanGonen, @irfanfandi, @JuerGenie, @marcalexiei, @itsahmedbilal, @DucMinhNe, @meliharik.
9782f87cperf(v4): validate without building the output, and keep schemas out of dictionary mode (#6480) by @colinhacks773a4867refactor(v4): declare a trait's members on $constructor (#6478) by @colinhacks68fb3f13feat(v4): make z.compile() fall back instead of throwing (#6479) by @colinhacks37b01501feat(v4): add z.isValid and z.isValidAsync (#6471) by @colinhacks749f5452docs: add fullproduct.dev to v4 ecosystem page (#6001) by @codinsonn24cdb7fdperf(v4): close the fastpass bindings into the compiled parser (#6464) by @colinhacks8d896186fix(v4): stop emitting a multipleOf that JSON Schema rejects (#6468) by @colinhacks43f729dbfeat(v4): make a tuple's items optional with .partial() (#6465) by @colinhacks97edaf7dfix(v4): don't throw from safeParse on bigint multipleOf(0n) (#6466) by @colinhacks21a6f0cbfeat(v4): let z.nanoid() take a custom length (#4004) by @oimo239d5b20effix(v4): restrict the first ULID character to [0-7] (#6095) by @JSap09141cf9cd09docs: record that error maps run per parse, and how to translate at render by @colinhacks7ce3e77dfix(v4): run a wrapper's inner schema on its own payload (#6462) by @colinhacks7b612b53fix(v4): fold an intersection of object schemas into one object (#6461) by @colinhacks1c43b774docs(v4): record why the failure path is not worth compiling by @colinhacksbadf0b78fix(v4): build the catch context from the input that failed (#6192) by @zelinewanga87ac366fix(v4)!: distinguish number and bigint formats at the type level (#6052) by @abhishek-chaudhary20036726c1dddocs: record what z.input and z.output do with transforms and wrappers by @colinhacks7cfc0122fix(v4): keep a wrapper's stored value only on the side it belongs to by @colinhacksa825c1b0fix(v4): empty enums and literals match nothing (#6459) by @colinhacks7c070db9feat(v4): expose the function schema on .implement() results (#6267) by @deepshekhardas3a496968fix(v4): make record input keys optional when the value can fill them (#6460) by @colinhacks53cec2a0fix(v4): resolve z.input past a preprocess transform by @colinhacks2125d30cfix(v4): accept exact decimal multiples in multipleOf (#6223) by @spokodev168122fcfix(v4): carry a pipe's own checks through z.output by @colinhacks51a1368afix(v4): let the includes(position) pattern match at or after the offset (#6024) by @francisjohnjohnston-web72a05c4ffeat(v4): expose stringbool truthy/falsy/case via _zod.bag (#6357) by @hamed-bavar036b39f4fix(v4)!: require seconds once a datetime carries a Z or an offset (#6457) by @colinhacks5825605eperf(v4): skip the eager stack capture when building a ZodError (#6450) by @colinhacksd85472c4feat(v4): support declared symbol keys in z.object() (#6448) by @colinhacksd4108872fix(v4): correct the date/time format keywords in both JSON Schema directions (#6452) by @colinhacks555e5f46Add z.toZod helper (#5913) by @colinhackse0e51a55docs(v4): cut the compile comments down to what they explain (#6449) by @colinhacks6574e784fix(v4): stop catch resurrecting issues an optional already resolved (#6440) by @colinhacks937b5d01perf(v4): prefix issue paths in place in the object JIT failure path (#6445) by @colinhacksb63db248fix(v4): keep a memoized node's cached issues private to the cache (#6443) by @colinhacks6ec3d043fix(resolution): keep pnpm's own warnings out of the attw snapshot (#6446) by @colinhacks830ba314fix(v4): validate the address, and return the string that was validated (#6442) by @colinhacksf101d8caPreserve callsites in parse stack traces (#5910) by @colinhacks6c77d028feat: compact simple anyOf unions to type array in toJSONSchema (#6339) by @deepshekhardas28e1ebd8fix(v4): measure string length in Unicode code points (#6441) by @colinhacks060bc9f3refactor: share default when-clauses for size/length checks (#6394) by @zirkelc2848177ddocs: point the flattened/formatted error deprecations at a symbol that exists by @colinhacks3c2dee9eAdd properties checks for instanceof schemas (#5912) by @colinhacks87ffeb0ffix(v4): an absent key on the middle rung supplies nothing (#6434) by @colinhacks7785fc82feat(v4): add z.getDiscriminatedOption (#5947) by @dokson0135c85afeat(v4): allow passing extra args to apply() (#6337) by @deepshekhardasca246d26fix(v4): drop empty alternation branch from datetime pattern (#6439) by @colinhackse073d55bdocs: z.iso.datetime() accepts a subset of ISO 8601, not all of it by @colinhacksd6ca12aefix(v4): infer recursive getter options in discriminatedUnion (#6422) by @colinhacksdc51404bAdd shorn to Zod Utilities (#6398) by @ChiChuRita580111dadocs: mark AOT compilation as canary-only by @colinhacks6b0dae79docs: note that a catch callback is not islanded by [@colinhacks](https:/Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.