Skip to content

Update all non-major dependencies#6

Open
cnap-tech-renovate[bot] wants to merge 1 commit intomainfrom
renovate/all-minor-patch
Open

Update all non-major dependencies#6
cnap-tech-renovate[bot] wants to merge 1 commit intomainfrom
renovate/all-minor-patch

Conversation

@cnap-tech-renovate
Copy link
Copy Markdown
Contributor

@cnap-tech-renovate cnap-tech-renovate Bot commented Mar 10, 2026 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
@modelcontextprotocol/sdk (source) devDependencies minor 1.27.1 → 1.29.0
hono (source) devDependencies patch 4.12.5 → 4.12.16
isolated-vm devDependencies minor 6.0.2 → 6.1.2
oxlint (source) devDependencies minor 1.51.0 → 1.62.0
zod (source) devDependencies minor 4.3.6 → 4.4.1

Release Notes

modelcontextprotocol/typescript-sdk (@​modelcontextprotocol/sdk)

v1.29.0

Compare Source

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.28.0...v1.29.0

v1.28.0

Compare Source

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.1...v1.28.0

honojs/hono (hono)

v4.12.16

Compare Source

Security fixes

This release includes fixes for the following security issues:

Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection

Affects: hono/jsx. Fixes missing validation of JSX tag names when using jsx() or createElement(), which could allow HTML injection if untrusted input is used as the tag name. GHSA-69xw-7hcm-h432

bodyLimit() can be bypassed for chunked / unknown-length requests

Affects: Body Limit Middleware. Fixes late enforcement for request bodies without a reliable Content-Length (e.g. chunked requests), where oversized requests could reach handlers and return successful responses before being rejected. GHSA-9vqf-7f2p-gf9v

v4.12.15

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.14...v4.12.15

v4.12.14

Compare Source

Security fixes

This release includes fixes for the following security issues:

Improper handling of JSX attribute names in hono/jsx SSR

Affects: hono/jsx. Fixes missing validation of JSX attribute names during server-side rendering, which could allow malformed attribute keys to corrupt the generated HTML output and inject unintended attributes or elements. GHSA-458j-xx4x-4375

Other changes

  • fix(aws-lambda): handle invalid header names in request processing (#​4883) fa2c74f

v4.12.13

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.12...v4.12.13

v4.12.12

Compare Source

Security fixes

This release includes fixes for the following security issues:

Middleware bypass via repeated slashes in serveStatic

Affects: Serve Static middleware. Fixes a path normalization inconsistency where repeated slashes (//) could bypass route-based middleware protections and allow access to protected static files. GHSA-wmmm-f939-6g9c

Path traversal in toSSG() allows writing files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path traversal issue where crafted ssgParams values could write files outside the configured output directory. GHSA-xf4j-xp2r-rqqx

Incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

Affects: IP Restriction Middleware. Fixes improper handling of IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1) that could cause allow/deny rules to be bypassed. GHSA-xpcf-pg52-r92g

Missing validation of cookie name on write path in setCookie()

Affects: setCookie(), serialize(), and serializeSigned() from hono/cookie. Fixes missing validation of cookie names on the write path, preventing inconsistent handling between parsing and serialization. GHSA-26pp-8wgv-hjvm

Non-breaking space prefix bypass in cookie name handling in getCookie()

Affects: getCookie() from hono/cookie. Fixes a discrepancy in cookie name handling that could allow attacker-controlled cookies to override legitimate ones and bypass prefix protections. GHSA-r5rp-j6wh-rvv4

Users who use Serve Static, Static Site Generation, Cookie utilities, or IP restriction middleware are strongly encouraged to upgrade to this version.

v4.12.11

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.10...v4.12.11

v4.12.10

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.9...v4.12.10

v4.12.9

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.8...v4.12.9

v4.12.8

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.7...v4.12.8

v4.12.7

Compare Source

Security hardening

Ignore __proto__ path segments in parseBody({ dot: true }) to prevent potential prototype pollution when merged with unsafe patterns.

Full Changelog: honojs/hono@v4.12.6...v4.12.7

v4.12.6

Compare Source

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.5...v4.12.6

laverdet/isolated-vm (isolated-vm)

v6.1.2

Compare Source

v6.1.1

Compare Source

v6.1.0

Compare Source

oxc-project/oxc (oxlint)

v1.62.0

Compare Source

🚀 Features
  • 348f46c linter: Add respectEslintDisableDirectives option (#​21384) (Christian Vuerings)
🐛 Bug Fixes
  • 8c425db linter: Allow string for jest version in config schema (#​21649) (camc314)

v1.61.1

Compare Source

v1.61.0

Compare Source

🚀 Features
  • 38d8090 linter/jest: Implemented jest version settings in config file. (#​21522) (Said Atrahouch)

v1.60.0

Compare Source

📚 Documentation
  • cfd8a4f linter: Don't rely on old eslint doc for available globals (#​21334) (Nicolas Le Cam)

v1.59.0

Compare Source

🐛 Bug Fixes
  • dd2df87 npm: Export package.json for oxlint and oxfmt (#​20784) (kazuya kawaguchi)

v1.58.0

Compare Source

🚀 Features
📚 Documentation
  • be3dcc1 linter: Add note about node version + custom TS plugin (#​19381) (camc314)

v1.57.0

Compare Source

v1.56.0

Compare Source

v1.55.0

Compare Source

🐛 Bug Fixes
  • bc20217 oxlint,oxfmt: Omit useless | null for Option<T> field from schema (#​20273) (leaysgur)
📚 Documentation
  • f339f10 linter/plugins: Promote JS plugins to alpha status (#​20281) (overlookmotel)

v1.54.0

Compare Source

📚 Documentation
  • 0c7da4f linter: Fix extra closing brace in example config. (#​20253) (connorshea)

v1.53.0

Compare Source

v1.52.0

Compare Source

🚀 Features
  • 61bf388 linter: Add options.reportUnusedDisableDirectives to config file (#​19799) (Peter Wagenet)
  • 2919313 linter: Introduce denyWarnings config options (#​19926) (camc314)
  • a607119 linter: Introduce maxWarnings config option (#​19777) (camc314)
📚 Documentation
  • 6c0e0b5 linter: Add oxlint.config.ts to the config docs. (#​19941) (connorshea)
  • 160e423 linter: Add a note that the typeAware and typeCheck options require oxlint-tsgolint (#​19940) (connorshea)
colinhacks/zod (zod)

v4.4.1

Compare Source

Commits:

  • 481f7be ci: gate release publishing on full test workflow
  • 95ccab4 test(v3): restore optional undefined expectations
  • cede2c6 fix(v4): reject tuple holes before required defaults (#​5900)
  • edd0bf0 release: 4.4.1
  • 180d83d docs: remove Jazz featured sponsor

v4.4.0

Compare Source

4.4.0

This is a minor release with a wide set of correctness and soundness fixes. Some fixes intentionally make Zod stricter, so code that depended on previously accepted invalid or ambiguous inputs may need small updates.

Potentially breaking bug fixes

Tuple defaults now materialize output values correctly

Fixed in #​5661. Tuple parsing now more accurately reflects defaults, optional tails, explicit undefined, and under-filled inputs. The headline behavior is that defaults in tuple positions now properly appear in parsed output.

const schema = z.tuple([
  z.string(),
  z.string().default("fallback"),
]);

schema.parse(["a"]);
// ["a", "fallback"]

Trailing optional elements that are absent still stay absent; they are not filled with undefined.

const schema = z.tuple([
  z.string(),
  z.string().optional(),
]);

schema.parse(["a"]);
// ["a"]

But explicit undefined values supplied by the caller are preserved.

schema.parse(["a", undefined]);
// ["a", undefined]

When optional elements appear before later defaults, the parsed tuple is now dense so array operations behave predictably.

const schema = z.tuple([
  z.string(),
  z.string().optional(),
  z.string().default("fallback"),
]);

schema.parse(["a"]);
// ["a", undefined, "fallback"]

Tuple length errors are also more consistent now. Since z.function() arguments are tuple-shaped, function input errors may look different.

Required object properties with z.undefined()

Fixed in #​5661, with follow-up coverage in 57d80a82. A property whose schema is z.undefined() is now treated as required. The key must be present, but its value may be undefined.

const schema = z.object({
  value: z.undefined(),
});

schema.safeParse({}).success;
// false

schema.safeParse({ value: undefined }).success;
// true

Use .optional() when the key itself may be absent.

const schema = z.object({
  value: z.undefined().optional(),
});

schema.safeParse({}).success;
// true

This also affects related .catch(), .partial(), .default(), and .prefault() combinations that previously relied on missing z.undefined() keys being treated as optional.

Safer .merge() behavior with refinements

Fixed in #​5856. The .merge() method now throws when the receiver has refinements, rather than silently producing ambiguous refinement behavior. Refinements from the second schema are preserved.

const a = z.object({ a: z.string() }).refine((val) => val.a.length > 0);
const b = z.object({ b: z.string() });

a.merge(b);
// throws

Prefer .extend() or .safeExtend() for object composition. The .merge() method is still supported for compatibility, but it is discouraged for new code because its semantics around overlapping keys and refinements are easier to misread.

JSON Schema $defs entries no longer include redundant id

Fixed in #​5759. JSON Schema conversion through z.toJSONSchema() now strips redundant id fields from $defs entries. This is required for correctness in older JSON Schema dialects from before $id was introduced: in those dialects, id changes the resolution scope, so leaving it inside an extracted definition can make references resolve incorrectly. The removed value was redundant because the schema had already been extracted into $defs, so the definition key itself is the identifier. This may affect consumers that were reading those internal id fields directly.

Other JSON Schema fixes in this release:

  • Draft-04/OpenAPI 3.0 min/max intersections: #​5700
  • Recursive lazy schemas with .describe(): #​5797
  • Falsy prefault values emitted as defaults: #​5893
  • CUID pattern output tightened: #​5880
String validators are stricter

Base64 validation now rejects whitespace instead of allowing atob()-style whitespace stripping. Fixed in #​5888.

z.base64().safeParse("Zm9v").success;
// true

z.base64().safeParse("Zm 9v").success;
// false

Other string validator changes:

  • CUID validation through z.cuid() has been tightened, and CUID v1 is now deprecated. Fixed in #​5880.
  • HTTP URL validation through z.httpUrl() now rejects malformed HTTP(S) URLs with a missing slash after the protocol. The underlying URL constructor normalizes inputs like https:/example.com, but Zod now rejects them instead of accepting the repaired URL. Fixed in #​5672, related to #​5284.
z.httpUrl().safeParse("https://example.com").success;
// true

z.httpUrl().safeParse("https:/example.com").success;
// false

z.httpUrl().safeParse("http:/www.apple.com").success;
// false
Union paths are fixed in formatted errors

Two union-related error fixes landed:

  • Nested union paths are now preserved correctly in the output of z.treeifyError() and z.formatError(). Fixed in #​5708 and 60ff3987.
  • Invalid discriminated union errors now include discriminator options and improved messages. Fixed in #​5723. This may affect users snapshotting ZodError output.

Other fixes

Record key transforms now run

Fixed in #​5891. Record schemas now run transforms on record keys.

const schema = z.record(
  z.string().transform((key) => key.toUpperCase()),
  z.number()
);

schema.parse({ foo: 1 });
// { FOO: 1 }

Related record fixes:

  • Key refinement failures now surface as structured invalid_key issues. Fixed in #​5719.
  • Non-enumerable properties are skipped more consistently. Fixed in #​5719.
  • The v3-style single-argument z.record(valueType) form works again. Fixed in 0e960108.
Metadata and input handling in fromJSONSchema()

Schema generation from JSON Schema now applies metadata more consistently across enum, const, not, anyOf, and multi-type schemas. Fixed in #​5758. It also rejects or normalizes more non-JSON-like inputs, including cyclic objects and BigInt. Fixed in 87cf0f93.

Codecs

Codec changes:

  • Encoding through z.discriminatedUnion().encode() now works when the discriminator uses a codec. Fixed in #​5769.
  • Codec inversion was added in #​5770.
const stringToNumber = z.codec(
  z.string(),
  z.number(),
  {
    decode: Number,
    encode: String,
  }
);

const numberToString = stringToNumber.invert();
Transform context

Transform callbacks now support ctx.addIssue(). Fixed in #​5699.

Conditional .superRefine() with when

The when option was added for .superRefine(). Added in #​5741, with related abort behavior fixed in #​5681.

Defaults for Map and Set

Defaults for Map and Set are now cloned instead of shared across parses. Fixed in #​5855.

const schema = z.map(z.string(), z.number()).default(new Map());

const a = schema.parse(undefined);
const b = schema.parse(undefined);

a === b;
// false
Empty unions

Empty z.union([]), z.xor([]), and discriminated unions no longer crash at construction time. They construct and fail at parse time. Fixed in #​5869.

Floating-point multiples

Number multipleOf() / step() validation is more accurate for decimal and exponent edge cases. Fixed in #​5687 and #​5793.

Global config and jitless

Configuration fixes:

  • Global configuration is now shared through globalThis, improving behavior across mixed CJS/ESM module instances. Fixed in #​5889.
  • Jitless mode now avoids eval probing when set before first access. Fixed in #​5864.
Prototype pollution hardening

Object catchall paths now skip __proto__ keys. Fixed in #​5898.

Performance improvements

Reduced memory usage from lazy-bound methods

Fixed in #​5897. Classic builder methods are now lazy-bound through a shared internal prototype instead of eagerly attached per schema instance. This significantly reduces per-schema method allocation overhead, especially in codebases that construct many schemas. Detached methods continue to work:

const schema = z.string();
const optional = schema.optional;

optional.call(schema);
// still works
Improved tree-shaking

Implemented in 195e8696 and #​5689. Top-level factory calls are annotated as pure, and generated stub package manifests now include sideEffects: false. This gives bundlers more room to remove unused Zod code.

This is intended as the conclusive fix for a long-standing class of tree-shaking and bundle-size issues, especially in Next.js and Turbopack projects. The most visible symptom was that unused validators and locales could survive bundling even when importing from zod/mini or from a narrow subpath.

Related reports include:

{
  "sideEffects": false
}

Locales

Added or updated locale support:

Locale message text changed in some cases, which may affect snapshots.

Closed issues

The following issues were closed by PRs included in this release:

Commits

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@cnap-tech-renovate cnap-tech-renovate Bot force-pushed the renovate/all-minor-patch branch from f95d0a8 to a6b2f2b Compare March 10, 2026 05:19
@cnap-tech-renovate cnap-tech-renovate Bot changed the title chore(deps): update dependency oxlint to v1.52.0 chore(deps): update all non-major dependencies Mar 10, 2026
@cnap-tech-renovate cnap-tech-renovate Bot force-pushed the renovate/all-minor-patch branch 9 times, most recently from 2c2616a to 4a0c5ee Compare March 17, 2026 09:05
@cnap-tech-renovate cnap-tech-renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from 080ff20 to 94a917d Compare March 30, 2026 09:26
@cnap-tech-renovate cnap-tech-renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from ddda28d to 5e1d845 Compare April 2, 2026 13:34
@cnap-tech-renovate cnap-tech-renovate Bot changed the title chore(deps): update all non-major dependencies Update all non-major dependencies Apr 2, 2026
@cnap-tech-renovate cnap-tech-renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from a0cabdf to fa29773 Compare April 8, 2026 21:01
@cnap-tech-renovate cnap-tech-renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from 26d5ccc to 052688d Compare April 19, 2026 20:54
@cnap-tech-renovate cnap-tech-renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from 9f23009 to 41b46d4 Compare April 27, 2026 17:34
@cnap-tech-renovate cnap-tech-renovate Bot force-pushed the renovate/all-minor-patch branch from 41b46d4 to dde4679 Compare April 30, 2026 03:48
@cnap-tech-renovate cnap-tech-renovate Bot force-pushed the renovate/all-minor-patch branch from dde4679 to be3776a Compare April 30, 2026 10:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants