Skip to content

Security patches (release/1.6-alpha) (major) - #1277

Open
renovate[bot] wants to merge 1 commit into
release/1.6-alphafrom
renovate/release/1.6-alpha-major-security-patches
Open

Security patches (release/1.6-alpha) (major)#1277
renovate[bot] wants to merge 1 commit into
release/1.6-alphafrom
renovate/release/1.6-alpha-major-security-patches

Conversation

@renovate

@renovate renovate Bot commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
deepmerge-ts ^7.1.5 → ^8.0.0 age confidence
zod (source) ^3.25.76 → ^4.0.0 age confidence

DeepmergeTS has stack exhaustion when merging recursive object graphs

CVE-2026-40345 / GHSA-ggr8-5vv4-36mx

More information

Details

Summary

deepmerge() and deepmergeInto() can be crashed with a crafted recursive object graph. When both merged values contain self-references at the same property path, the library recurses until Node throws RangeError: Maximum call stack size exceeded.

Details

Record merging is implemented recursively. For each enumerable key, the library collects the values from every input object and immediately calls the same merge routine on that property.

There is no visited-object tracking, pair tracking, or cycle detection in that recursion. As a result, if two merged records both point back to themselves through the same key path, the merge logic keeps revisiting the same object pair forever.

This is reachable through the real public API:

  • deepmerge(...)
  • deepmergeCustom(...)(...)
  • deepmergeInto(target, ...)
  • deepmergeIntoCustom(...)(target, ...)

The issue only occurs when recursive object graphs are supplied. Plain JSON alone does not create this condition.

PoC
import { deepmerge, deepmergeInto } from "deepmerge-ts";

const left = {};
left.self = left;

const right = {};
right.self = right;

try {
  deepmerge(left, right);
} catch (error) {
  console.log(error.name, error.message);
  // Expected: the merge should reject or safely handle recursive input without exhausting the stack.
  // Vulnerable behavior: RangeError Maximum call stack size exceeded
}

const target = {};
target.self = target;

const source = {};
source.self = source;

try {
  deepmergeInto(target, source);
} catch (error) {
  console.log(error.name, error.message);
  // Expected: the merge should reject or safely handle recursive input without exhausting the stack.
  // Vulnerable behavior: RangeError Maximum call stack size exceeded
}
Impact

Applications that pass attacker-controlled recursive object graphs into these APIs can be forced into a synchronous crash path. In Node.js services, that can terminate request handling for the affected process or trigger repeated worker restarts until the malicious input is blocked.

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

DeepmergeTS has stack exhaustion when merging recursive object graphs

CVE-2026-40345 / GHSA-ggr8-5vv4-36mx

More information

Details

Summary

deepmerge() and deepmergeInto() can be crashed with a crafted recursive object graph. When both merged values contain self-references at the same property path, the library recurses until Node throws RangeError: Maximum call stack size exceeded.

Details

Record merging is implemented recursively. For each enumerable key, the library collects the values from every input object and immediately calls the same merge routine on that property.

There is no visited-object tracking, pair tracking, or cycle detection in that recursion. As a result, if two merged records both point back to themselves through the same key path, the merge logic keeps revisiting the same object pair forever.

This is reachable through the real public API:

  • deepmerge(...)
  • deepmergeCustom(...)(...)
  • deepmergeInto(target, ...)
  • deepmergeIntoCustom(...)(target, ...)

The issue only occurs when recursive object graphs are supplied. Plain JSON alone does not create this condition.

PoC
import { deepmerge, deepmergeInto } from "deepmerge-ts";

const left = {};
left.self = left;

const right = {};
right.self = right;

try {
  deepmerge(left, right);
} catch (error) {
  console.log(error.name, error.message);
  // Expected: the merge should reject or safely handle recursive input without exhausting the stack.
  // Vulnerable behavior: RangeError Maximum call stack size exceeded
}

const target = {};
target.self = target;

const source = {};
source.self = source;

try {
  deepmergeInto(target, source);
} catch (error) {
  console.log(error.name, error.message);
  // Expected: the merge should reject or safely handle recursive input without exhausting the stack.
  // Vulnerable behavior: RangeError Maximum call stack size exceeded
}
Impact

Applications that pass attacker-controlled recursive object graphs into these APIs can be forced into a synchronous crash path. In Node.js services, that can terminate request handling for the affected process or trigger repeated worker restarts until the malicious input is blocked.

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Zod can exhaust memory while validating oversized constrained collections

CVE-2023-54404 / GHSA-mrhx-c7xc-m3w5

More information

Details

Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

RebeccaStevens/deepmerge-ts (deepmerge-ts)

v8.0.0

Compare Source

Bug Fixes
  • stop deepmergeInto from leak-mutating nested input containers (2cd7824)
Code Refactoring
  • rename mergeInfo system and align shorthand, add JSDoc examples (590ed9b)
Features
  • add circular reference support, maxDepth option, and hierarchy tracking (#​707) (3984927)
  • add deepmergeFastUnsafe and deepmergeIntoFastUnsafe entrypoints (#​708) (df9b11c)
  • support deep map value merging (ac4bf7a), closes #​705
Performance Improvements
  • add a dedicated fast path for merging 2 records (4dbcea7)
  • avoid array reallocation when no undefined values exist (99f2241), closes #​696
  • optimize array and set merging (8d435f9), closes #​698
  • optimize map merging and remove dead code (14e1604), closes #​702
  • optimize record key and type detection (fa85462), closes #​694
  • reduce benchmark sample count so the bench fits in 512MB heap (66635e3)
  • reduce type-level work and shortcut same-type merges (473a971)
  • speed up the mergeUnknowns hot path (95b2964), closes #​699
BREAKING CHANGES
  • deepmergeInto no longer leak-mutates input containers.
    Code that depended on inputs being merged into the target through alias
    must now pass copies explicitly. The documented 'update the target'
    behavior is preserved on the target itself.
    • DeepMergeMetaMetaData has been renamed to DeepMergeMergeInfo. Imports
      must be updated.
  • The MetaDataUpdater callback's metaMeta parameter is now mergeInfo.
    Implementations must update the parameter name accordingly.
  • The MM generic shorthand has been renamed to MI (e.g. in
    MetaDataUpdater<M, MI>).
  • The DeepMergeIntoFunctionUtils type has been renamed to DeepMergeIntoUtils.
  • Updates the internal calculation logic for mergeMaps and
    mergeMapsInto. Colliding keys will now be merged.

7.1.6 (2026-08-11)

Bug Fixes
  • preserve known keys when merging objects with index signatures (#​692) (e86cd8c)

7.1.5 (2025-02-23)

Bug Fixes
  • improve type merging of nested optional properties (#​530) (349fd14)

7.1.4 (2025-01-23)

Bug Fixes

7.1.3 (2024-10-08)

7.1.2 (2024-10-08)

Performance Improvements

7.1.1 (2024-10-04)

Performance Improvements
  • add explicit return type to speed up types (8e1ff6d)

v7.1.6

Compare Source

Bug Fixes
  • stop deepmergeInto from leak-mutating nested input containers (2cd7824)
Code Refactoring
  • rename mergeInfo system and align shorthand, add JSDoc examples (590ed9b)
Features
  • add circular reference support, maxDepth option, and hierarchy tracking (#​707) (3984927)
  • add deepmergeFastUnsafe and deepmergeIntoFastUnsafe entrypoints (#​708) (df9b11c)
  • support deep map value merging (ac4bf7a), closes #​705
Performance Improvements
  • add a dedicated fast path for merging 2 records (4dbcea7)
  • avoid array reallocation when no undefined values exist (99f2241), closes #​696
  • optimize array and set merging (8d435f9), closes #​698
  • optimize map merging and remove dead code (14e1604), closes #​702
  • optimize record key and type detection (fa85462), closes #​694
  • reduce benchmark sample count so the bench fits in 512MB heap (66635e3)
  • reduce type-level work and shortcut same-type merges (473a971)
  • speed up the mergeUnknowns hot path (95b2964), closes #​699
BREAKING CHANGES
  • deepmergeInto no longer leak-mutates input containers.
    Code that depended on inputs being merged into the target through alias
    must now pass copies explicitly. The documented 'update the target'
    behavior is preserved on the target itself.
    • DeepMergeMetaMetaData has been renamed to DeepMergeMergeInfo. Imports
      must be updated.
  • The MetaDataUpdater callback's metaMeta parameter is now mergeInfo.
    Implementations must update the parameter name accordingly.
  • The MM generic shorthand has been renamed to MI (e.g. in
    MetaDataUpdater<M, MI>).
  • The DeepMergeIntoFunctionUtils type has been renamed to DeepMergeIntoUtils.
  • Updates the internal calculation logic for mergeMaps and
    mergeMapsInto. Colliding keys will now be merged.

7.1.6 (2026-08-11)

Bug Fixes
  • preserve known keys when merging objects with index signatures (#​692) (e86cd8c)

7.1.5 (2025-02-23)

Bug Fixes
  • improve type merging of nested optional properties (#​530) (349fd14)

7.1.4 (2025-01-23)

Bug Fixes

7.1.3 (2024-10-08)

7.1.2 (2024-10-08)

Performance Improvements

7.1.1 (2024-10-04)

Performance Improvements
  • add explicit return type to speed up types (8e1ff6d)
colinhacks/zod (zod)

v4.6.6

Compare Source

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #​6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243f, the pre-rewrite copy of 9c21983 with identical contents.

Commits:
  • 0cd3af5 docs: load the en locale directly in Zod Mini
  • 9d5e60f docs: import locales from zod/locales, not z.locales
  • 34a626f docs: tighten the z.locales tree-shaking note
  • 74304ce release: stage npm versions instead of publishing them (#​6622)
  • b2ef983 docs: add Code for Japan to bronze sponsors
  • 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
  • bacad51 docs: square the Code for Japan logo to match the other bronze tiles
  • c42596b release: hold the run on the release-approval environment until the staged versions are approved (#​6638)
  • a2ba4a6 fix(types): declare record output and input as members, not base type arguments (#​6645)
  • a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#​6652)
  • 529f78d 4.6.6
  • 9c21983 ci: stage at verbose so a failed OIDC token exchange says why

v4.6.5

Compare Source

Commits:

  • d2b135c docs: add the 4.6.x patch highlights to the 4.6 post
  • f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
  • de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#​6598)
  • 56222cd feat(instanceof): key the .properties() shape off the instance type (#​6600)
  • ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#​6595)"
  • cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#​6595)""
  • 0f3f5ee 4.6.5
  • 59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

Compare Source

A patch on top of 4.6.3.

  • d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#​6595)
  • ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#​6588)
  • 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
  • f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#​6153)

v4.6.3

Compare Source

A patch on top of 4.6.2.

  • 413cce9a fix(v4): make z.properties() a check again (#​6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
  • 75d63ee1 docs: show only the .properties() method form in the 4.6 post
  • 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

Compare Source

A patch on top of 4.6.1.

v4.6.1

Compare Source

A patch on top of 4.6.0.

v4.6.0

Compare Source

Zod 4.6 is now available.

npm install zod@latest

At a glance:

  • .validate() — checks input validity without building a result (up to 35x faster than .safeParse().success on a compiled schema)
  • z.instanceof().properties() — validates properties of an instance
  • fromJSONSchema() — enforces six validation keywords it used to ignore
  • z.iban() — electronic-format IBAN plus mod-97 checksum
  • z.withParser() — installs a parser generated elsewhere, for environments without new Function
  • Faster CommonJS — drops the getter on every export (~3x faster z.validate() under require)
  • Memory retention in recursive schemas — releases the parsed input, fixing a 4.5 out-of-memory regression
  • @zod/mini — Zod Mini as a standalone package, versioned in lockstep with zod since 4.5

.validate()

Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a ZodError, which makes rejection cheap. The return type is a guard on the schema's input type.

z.validate(z.string(), "hi"); // true
z.validate(z.string(), 42);   // false

It is a method on Zod Classic schemas too. (#​6547)

const Player = z.object({
  username: z.string(),
  xp: z.number(),
});

if (Player.validate(data)) {
  data.username; // narrowed
}

In conjunction with z.compile(), this can be up to 35x faster than .safeParse().success on invalid input.

Time per call on invalid input, schemas compiled with z.compile(), safeParse().success as a gray bar with .validate() as a blue bar inside it: a union of 3 objects 28 ns (34.9x faster), an array of 10 strings 23 ns (24.6x), a 3-element tuple 28 ns (16.1x), a 5-key object 21 ns (16.3x), a discriminated union of 3 21 ns (15.7x), z.number() 19 ns (13.8x), z.string() 19 ns (13.2x), z.boolean() 19 ns (13.7x); up to 34.9x faster

Time per call on invalid input, compiled with z.compile() — lower is better (benchmark)

Uncompiled schemas

Without compilation it is up to 5.9x faster. The saving is the result object: .safeParse() allocates one with an accessor pair on every call, and .validate() allocates nothing.

Time per call on invalid input, plain schemas, safeParse().success as a gray bar with .validate() as a blue bar inside it: a union of 3 objects 659 ns (1.5x faster), an array of 10 strings 211 ns (2.3x), a 3-element tuple 166 ns (2.5x), a discriminated union of 3 93 ns (3.3x), a 5-key object 75 ns (3.9x), z.number() 47 ns (5.3x), z.string() 42 ns (5.8x), z.boolean() 42 ns (5.9x); up to 5.9x faster

Time per call on invalid input, plain schemas — lower is better (benchmark)

Both charts measure the failure path. The key feature of .validate() is that it can short-circuit on the first issue it encounters, instead of aggregating a full ZodIssue[] array.

[!NOTE]
Async refinements are covered by .validateAsync().

z.properties()

A new API for validating specific properties of an object. Unlike z.object() it validates in-place, so it plays nice with class instances. (#​6536)

const responseLike = z.properties({ status: z.number().min(200).max(299) });

responseLike.parse(new Response("ok", { status: 200 }));  // ✅ a real Response
responseLike.parse({ status: 204 });                      // ✅ a plain object

A corresponding .properties() method has been added to ZodInstanceOf.

Zod

const okResponse = z.instanceof(Response).properties({
  ok: z.literal(true),
  status: z.number().min(200).max(299),
});

Zod Mini

const okResponse = z.instanceof(Response).check(...z.properties({
  ok: z.literal(true),
  status: z.number().check(z.minimum(200), z.maximum(299)),
}));

The input comes back untouched, so the prototype survives and the methods still work. That is the part z.object() cannot do: it would hand back a plain object and the Response would be gone.

const res = await fetch("/api/user");

okResponse.parse(res) === res; // ✅ true

fromJSONSchema()

Six additional JSON Schema keywords are now supported in z.fromJSONSchema(). (#​6535)

const schema = z.fromJSONSchema({
  type: "object",
  minProperties: 2,      // also maxProperties
});

schema.parse({ a: 1 });        // ❌ too few properties
schema.parse({ a: 1, b: 2 });  // ✅

Both property bounds count the input's own keys. Array uniqueness is structural, so [{ a: 1 }, { a: 1 }] is a duplicate.

z.fromJSONSchema({ type: "array", uniqueItems: true }).parse([{ a: 1 }, { a: 1 }]); // ❌

z.fromJSONSchema({
  type: "array",
  contains: { type: "number" },   // also minContains and maxContains
  minContains: 2,
}).parse(["a", 2]);               // ❌ only one number

z.iban()

A new string format: an IBAN in electronic format, with a valid ISO 7064 MOD 97-10 checksum. (#​6571)

z.iban().parse("DE89370400440532013000"); // ✅
z.iban().parse("DE89370400440532013001"); // ❌ bad checksum

z.withParser()

z.compile() builds its parser with new Function, which a strict Content Security Policy blocks. z.withParser() is that installer on its own: it takes a parser generated somewhere else, at build time or by a native compiler, and installs it under the same contract. (#​6575)

const Player = z.object({ username: z.string(), xp: z.number() });

// isPlayer is a type guard your build step generated
const Fast = z.withParser(Player, (input) =>
  isPlayer(input) ? { username: input.username, xp: input.xp } : z.INVALID
);

The supplied parser owns the whole result, so it has to return what the schema would have returned. This one rebuilds the object rather than handing back its input, because z.object() strips unknown keys. Returning z.INVALID hands the input to the runtime, which stays the only source of ZodErrors.

Faster CommonJS

TypeScript compiles a re-export to a getter, and 252 of the 255 exports on Zod 4.5's CommonJS entrypoint were getters. V8 could not see a constant callee behind one, so it could not inline the call. The 4.6 build emits plain properties and freezes the exports object. On a compiled schema, z.validate() under require is about 3x faster than it was in Zod 4.5. (#​6564)

const { z } = require("zod");
const CompiledPlayer = z.compile(Player);

z.validate(CompiledPlayer, data); // ~3x faster than Zod 4.5

Only calls through the namespace were affected. A method call like Player.safeParse(data) never reads the exports object, and the ESM build is unchanged.

Memory retention in recursive schemas

A recursive schema held the input and output of its last parse until the next parse replaced it, so one long-lived schema pinned every object it had touched. Zod 4.4 released that input and Zod 4.5 did not, which surfaced as an out-of-memory failure on a repository-wide lint run. The parse state is weak throughout now: one parse of a 29k-node tree retains 2.2 MB where it used to retain 10.1 MB, and recursive parses give up about 6% for it. (#​6572)

const Category = z.object({
  name: z.string(),
  get children() {
    return z.array(Category);
  },
});

Bug fixes

⚠️ Error maps run on the first read of error

Because safeParse() now builds its error lazily, error maps — global, locale, and per-schema error — run when result.error is first read, not at parse time. Code that swaps z.config() between the parse and the read gets the newer configuration. (#​6519)

const result = schema.safeParse(12);
z.config(z.locales.fr());
result.error.issues[0].message; // French in 4.6, English in 4.5

An error map with a side effect never runs if nothing reads the error. Throwing parses are unaffected — .parse() builds and throws its error immediately, never takes the lazy path, and its stack still points at your call site.

⚠️ z.emoji() rejects component-only strings

Unicode's Emoji_Component property covers the pieces that attach to an emoji, so z.emoji() accepted "123", "#", "*", and a lone zero-width joiner, variation selector, or skin tone modifier. The pattern now requires at least one pictograph, regional indicator, or keycap. (#​6532)

z.emoji().parse("😀");   // ✅
z.emoji().parse("1️⃣");   // ✅ the keycap is the anchor
z.emoji().parse("123");  // ❌ was accepted in 4.5

Flags, subdivision flags, skin-tone-modified emoji, and ZWJ sequences are unchanged. Closes #​6515.

⚠️ Numeric enum options no longer include the reverse mappings

A numeric TypeScript enum also carries its reverse mapping (0 to "UK") at runtime. The parser already ignored those keys, but .options was read straight off the enum object, so a three-member enum listed six values and three of them failed to parse. (#​6542)

enum Country { UK, Germany, France }

z.enum(Country).options; // 4.5: ["UK", "Germany", "France", 0, 1, 2] — 4.6: [0, 1, 2]
⚠️ base64 patterns

The runtime patterns for z.base64() and z.base64url() are the character sets, with length and padding enforced in code, so a multi-megabyte string can no longer overflow the regex stack through a composed schema. The JSON Schema output still emits the exact block forms, so z.toJSONSchema() is unchanged. (#​6534, #​6527)

Composing z.base64() into a template literal now checks the alphabet but not the length, which is how z.creditCard() already behaves there. The exported z.regexes.base64url is now the length-aware form, so it overflows on a multi-megabyte input the same way z.regexes.base64 does.

⚠️ The email pattern dropped its lookaheads

z.email() opened with two lookaheads, and the second scanned the whole string before the match began. Both are gone, and the rule they enforced — no empty segment in the local part — is expressed structurally instead, so z.email() accepts and rejects exactly what it did before. Valid addresses validate roughly twice as fast. (#​6573)

The pattern string is user-visible, and every copy of it changes: z.regexes.email, which has no capture groups now — neither of the two it used to expose held a usable value; issue.pattern on a failed z.email(); and the pattern that z.toJSONSchema() emits, which no longer carries a lookahead, so validators outside ECMAScript can compile it.

Composing an email into a template literal also stops applying its no-consecutive-dots rule to the rest of the string.

z.templateLiteral([z.email(), "|", z.string()]).parse("a@b.cc|a..b");
// 4.5: ❌ — the lookahead reached past the email segment — 4.6: ✅
⚠️ Chained checks no longer overwrite each other in JSON Schema

Each check used to write its own bounds into the schema as it attached, in chain order, so a format check applied after .min() and .max() replaced the tighter values with its own range. The converter folds the checks as a conjunction now. The order they are chained in no longer changes the output. (#​6554, #​6553)

z.toJSONSchema(z.number().min(0).max(23).int());
// 4.5: { minimum: -9007199254740991, maximum: 9007199254740991 }
// 4.6: { minimum: 0, maximum: 23 }

Runtime parsing enforced the bounds in every version. Only the emitted schema was wrong. The same fold fixes two more cases: a repeated multipleOf kept the first divisor and dropped the rest, so z.number().multipleOf(2).multipleOf(3) emitted a schema that accepts 4, and z.string().min(8).length(5) emitted minLength: 5, widening a bound the runtime still rejected. Closes #​6550.

⚠️ Metadata members materialize on first read

Eight members on a Zod Classic schema — .format, .minLength, .maxLength, .minValue, .maxValue, .isInt, .minDate and .maxDate — are computed from the checks now instead of being written onto every instance at construction. Each one is a prototype getter that becomes an own property on first read. (#​6554)

const s = z.string().min(3).max(9);

Object.keys(s); // 4.5: ["def", "type", "format", "minLength", "maxLength"] — 4.6: ["def", "type"]
s.minLength;    // 3 in both
Object.keys(s); // 4.6: ["def", "type", "minLength"]

A key is absent until something reads it, and Object.assign({}, schema) copies only the members that have been read. Deleting one restores the getter, and the next read recomputes it.

The values can move too, because the getters read the same fold the JSON Schema converter does. An order-dependent chain reports the tighter bound now instead of whichever check wrote last.

z.string().min(8).length(5).minLength; // 4.5: 5 — 4.6: 8

Commits

Zod 4.6 rolls up 72 commits.

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Warsaw)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added dependencies Pull requests that update a dependency file renovate security labels Oct 23, 2026
@renovate
renovate Bot force-pushed the renovate/release/1.6-alpha-major-security-patches branch from 15d99da to be3be73 Compare October 23, 2026 19:34
@renovate
renovate Bot force-pushed the renovate/release/1.6-alpha-major-security-patches branch from be3be73 to d1b7492 Compare October 23, 2026 23:15
@renovate renovate Bot changed the title Security patches (release/1.6-alpha) Security patches (release/1.6-alpha) (major) Oct 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file renovate security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants