chore(deps): update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@iconify-json/lucide	^1.2.126 → ^1.2.129			dependencies	patch
@iconify-json/simple-icons	^1.2.93 → ^1.2.94			dependencies	patch
@iconify-json/vscode-icons	^1.2.75 → ^1.2.76			dependencies	patch
@nuxt/content (source)	^3.15.2 → ^3.16.0			dependencies	minor
@upstash/redis (source)	^1.38.2 → ^1.38.4			dependencies	patch
evlog (source)	^2.27.0 → ^2.28.1			dependencies	minor
motion-v	^2.4.0 → ^2.4.1			dependencies	patch
node	24.19.0 → 24.20.0			uses-with	minor
pnpm (source)	11.23.0 → 11.25.0			packageManager	minor
vue (source)	^3.5.41 → ^3.5.42			dependencies	patch
vue-router (source)	^5.2.0 → ^5.3.1			dependencies	minor
zod (source)	^4.4.3 → ^4.5.4			dependencies	minor

---

Release Notes

nuxt/content (@​nuxt/content)

v3.16.0

Compare Source

Bug Fixes

• avoid install prompt in non-interactive environments (#​3833) (2d0e84b)
• ContentRenderer: keep async component identity stable across re-resolves (#​3835) (dcf86e6)
• improve generated git cache key (#​3839) (d1e353e)
• module: keep content templates when building with _prepare (#​3837) (e390c3b)
• nuxthub: handle object form of hub.db (#​3822) (8841abc)
• query: tolerate trailing slashes in path-based lookups (#​3838) (220d392)
• runtime: use dynamic import for #content/adapter to prevent prerender failure (#​3830) (400390a)
• use UTC getters in formatDate/formatDateTime to prevent timezone drift (#​3782) (9f1f89a)

upstash/redis-js (@​upstash/redis)

v1.38.4

Compare Source

Patch Changes

• 7ac8182: Fix read-your-writes sending a stale upstash-sync-token

  A read issued straight after a write travelled with the token from before that
  write, so the server was under no obligation to serve the write and
  readYourWrites silently did not hold.

  HttpClient.request() snapshotted the outgoing headers with
  mergeHeaders(this.headers, ...) and only afterwards wrote the freshest token into
  this.headers, so the token learned from response N first shipped with request
  N+2. The assignment now happens before the merge.

  This regressed in 1.34.5. In 1.34.0–1.34.4 the request options held
  headers: this.headers by reference, so the late write was still picked up before
  fetch; 1.34.5 introduced per-request header merging, which turned that reference
  into a copy without moving the assignment.

v1.38.3

Compare Source

Patch Changes

• f020866: Send an Upstash-Telemetry-Retry header with the retry count on retried requests so retry rates are visible in server-side telemetry
• 777dc30: Trim telemetry header values before deduplicating so whitespace around existing values does not defeat the dedup check

evloghq/evlog (evlog)

v2.28.1

Compare Source

What's Changed

Continuous Integration 🔄

• ci: delete neon preview branches on pr close and skip changeset-release deploys by @​HugoRCD in #​650

Documentation 📚

• docs: add sponsors section to readme by @​HugoRCD in #​648

Dependency Updates 📦

• chore: move repository urls to evloghq/evlog by @​HugoRCD in #​649
• chore(repo): version packages by @​HugoRCD in #​651

Full Changelog: https://github.com/evloghq/evlog/compare/@evlog/cli@0.6.1...evlog@2.28.1

v2.28.0

Compare Source

What's Changed

Bug Fixes 🐞

• fix(hono): capture errors handled by app.onError by @​HugoRCD in HugoRCD#644
• fix(core): keep the data payload on createError errors by @​HugoRCD in HugoRCD#643

Full Changelog: https://github.com/HugoRCD/evlog/compare/evlog@2.27.1...evlog@2.28.0

v2.27.1

Compare Source

What's Changed

Bug Fixes 🐞

• fix(axiom): send the event timestamp to Axiom and surface ingest failures by @​evlogai[bot] in HugoRCD#633

Full Changelog: https://github.com/HugoRCD/evlog/compare/evlog@2.27.0...evlog@2.27.1

motiondivision/motion-vue (motion-v)

v2.4.1

Compare Source

   🐞 Bug Fixes

• layout: Guard promote/relegate by lead status and refresh presence in updatePrevLead  -  by @​rick-hup and Claude Code (0929a)
• state: Resolve strict-mode type errors in MotionState  -  by @​rick-hup and Claude Code (d238f)

    View changes on GitHub

actions/node-versions (node)

v24.20.0: 24.20.0

Compare Source

Node.js 24.20.0

pnpm/pnpm (pnpm)

v11.25.0: pnpm 11.25

Compare Source

Minor Changes

• Added an opt-in proof of concept that lets installs reuse a dependency's build output across machines, by publishing and restoring signed, organization-scoped artifacts through pnpr instead of running the lifecycle scripts locally.

  Configure it with the new remoteSideEffectsCache setting. A workspace names the eligible organization and packages; everything describing the act of signing — publish, keyId, builderId, trustedKeys, privateKey and the provenance fields — is refused in pnpm-workspace.yaml and read from the global config file or the environment instead.

• Added macOS and Windows x64 and arm64 support to remote shared build artifacts pnpm/pnpm#13771.

• Added the audit.ignorePrune setting. When set to true, pnpm audit --fix removes ignored GHSA entries that no longer appear in the audit report.

• Generalized the experimental shared-artifact protocol so candidates and signed payloads identify a discriminated subject. Dependency side effects use package and source-integrity subjects, while workspace tasks use project and task subjects.

  This changes shared-artifact request bodies and signed payloads. A pnpr server and its clients have to be on matching versions.

• pnpm init now pins the latest pnpm version, instead of the version of pnpm that ran the command. A project scaffolded by an outdated pnpm therefore no longer inherits that staleness through its own devEngines.packageManager / packageManager pin #​7490.

  The version is read from the latest tag on the package-manager registries. When that lookup cannot answer — no network, an unreachable or slow registry, offline, or a latest that the minimumReleaseAge / trustPolicy settings reject — pnpm init pins the running version as before, and never fails or hangs on the lookup. A latest that is older than the running pnpm is never pinned either.

• A scope set in a project's pnpm-workspace.yaml is now ignored, with a warning naming where to set it instead. pnpm login records the scope as a @scope:registry route in the machine-global auth.ini, which outranks ~/.npmrc in every project — so a repository-committed file could redirect a scope such as @acme for all of a user's other projects after one routine login. Use --scope, the PNPM_CONFIG_SCOPE environment variable, or the global config file instead #​13557.

• Verified remote build artifacts are persisted in the shared store with their signed origin metadata. Later installs reverify the artifact against current trust, policy, platform, and source before reuse, while invalid remote variants are quarantined per channel (pnpm/pnpm#13771).

• Persist completed recursive tasks so --resume-from skips exactly the work that passed during a matching interrupted or failed pnpm -r run / pnpm -r exec invocation. When no compatible state exists, pnpm retains its graph-based resume behavior.

• Allowed pnpm update --patches to refresh registry revisions through a configured pnpr server while retaining locked package versions.

• Added explicit registry revision selection with <version>+rN and pnpm update --patches for refreshing revision artifacts without changing package versions. Registry-backed lockfile policy checks recognize historical revisions, and pnpr now preserves safe revision histories from upstream registries.

• Workspace install, rebuild, pack, publish, stage, and lifecycle work now starts as soon as its dependencies finish instead of waiting for an unrelated topological group.

• pnpm stage approve now approves several staged packages at once. Run it without a stage id to pick from the staged versions interactively, or pass a list of stage ids. The whole batch is approved with a single one-time password, and pnpm asks for a new one only once the registry stops accepting it. Inside a workspace, the selected packages are approved in dependency order, and a package whose workspace dependency could not be approved is skipped instead of being published against a dependency that never reached the registry.

• Added per-task concurrency limits to workspace task orchestration. Set tasks.<name>.concurrency in pnpm-workspace.yaml to limit how many instances of that task may run across workspace projects at once:

  tasks:
    build:
      concurrency: 2

• Added support for registry replacement tarballs using standard integrity values, explicit revision fields, registry routing from the registries setting, non-redirecting integrity-addressed URLs, canonical safe-integer revision numbers, and pnpr proxying for immutable upstream revision artifacts.

• sideEffectsCache now declares the whole of how a package's build output is reused — whether one is restored, whether one is saved, and the remote tier that shares it between machines:

  sideEffectsCache:
    read: true
    write: true
    remote:
      org: acme
      packages: ['native-addon']

  sideEffectsCache: true, sideEffectsCacheReadonly, remoteSideEffectsCache, and its organization field all keep working. Where a field is set under both spellings the one above wins; where it is set under only one, it is kept.

  Two behaviors change, both bringing this CLI in line with what the Rust one already did: sideEffectsCacheReadonly: true now blocks writing to the cache, and setting it alongside sideEffectsCache: false gives a read-only view rather than switching the cache off entirely. A cache can also be declared write-only now, to populate one the run does not read.

• Workspace task orchestration (pnpm/rfcs#23). pnpm -r run and pnpm -r exec now schedule per task instead of in topological chunks: a task starts as soon as the tasks it depends on have finished, so a project no longer waits for unrelated projects that happen to share its chunk.

  A new tasks section in pnpm-workspace.yaml declares what a task depends on, using the ^ convention:

  tasks:
    build:
      dependsOn: ['^build']
    test:
      dependsOn: ['build']
    lint: {}

  ^name means the named task in each of the project's workspace dependencies; a bare name means the task in the same project; an entry with no dependsOn declares an empty dependency list. A task with no entry behaves as dependsOn: ['^<its own name>'], which is exactly what the previous chunked ordering implied — an unconfigured workspace gets the scheduler improvement and nothing else changes meaning. A project without the script is reported skipped and passes its edges through to its own dependencies, so a scriptless package does not sever a chain.

  Also part of this change:

  • A dependency cycle among the tasks of a run is now an error naming the participating tasks (ERR_PNPM_TASK_CYCLE) instead of silently running in an arbitrary order. Setting ignoreWorkspaceCycles: true downgrades the error to a warning: the cycle's tasks run in an arbitrary order relative to each other.
  • --resume-from now skips exactly the transitive dependencies of the anchor package; work unrelated to the anchor still runs.
  • Under --no-bail, tasks whose dependencies failed are reported as skipped, not failed, and do not add to the exit code.
  • With --bail (the default), the first failure still ends the run at once and nothing new is dispatched — including scripts already queued behind the concurrency limit.
  • pnpm -r run --dry-run <script> prints the task graph that would execute without running anything (including skipping the verifyDepsBeforeRun check); --json emits the tasks and their resolved dependency edges.
  • Output is inherited rather than piped only when at most one script can ever be in flight (--workspace-concurrency=1, or the graph forces the scripts to run one after another).

Patch Changes

• An _auth entry in the global config file no longer decides which registry packages come from when something else says. A registry or registries declared in pnpm-workspace.yaml or the global config now wins over the route inferred from a stored credential, which still applies where nothing else declares one. The pnpm_config__auth environment variable is unchanged: it stays the way to point a CI runner at a mandated proxy, and still overrides what a repository declares.

• Prevent installs through a symlinked node_modules directory from rewriting the target checkout pnpm/pnpm#14286.

• Treat empty scripts selected by a regular expression as missing before running dependent tasks.

• The options type of the fetch command now declares allowBuilds, a setting its handler already forwarded to the installer. Type-level only — what pnpm fetch does is unchanged.

• Filter hidden scripts matched by a regular expression during recursive runs when a visible script also matches.

• Fixed automatically switched pnpm versions forcing all descendant pnpm processes to use the same version pnpm/pnpm#14309.

• Fixed ERR_PNPM_UNUSED_PATCH validation during incremental installs pnpm/pnpm#13692.

• Fixed pnpm deploy --prod failing when an excluded dev dependency was also declared as an optional peer dependency pnpm/pnpm#14302.

• pnpm update -g no longer downgrades a global package. --latest resolves the latest dist-tag, which can point at an older release than the one installed — after pnpm add -g <pkg>@next, for instance #​14270.

  pnpm update -g also no longer changes the pnpm version. pnpm's own global install belongs to pnpm self-update #​14270.

• Copying a built package to its other hoisted locations no longer replaces the destination directory. With nodeLinker: hoisted, that replacement deleted the dependencies nested inside the destination's node_modules, and made concurrent copies of the same build chunk fail with ERR_PNPM_ENOENT: no such file or directory, rename '.../node_modules/_tmp_...' #​12880.

• pnpm update no longer replaces the specifier a project declares for a dependency that is also listed in overrides. A catalog: reference stays a catalog: reference, and a declared range stays as written, instead of being rewritten to the version the override resolved to #​12115.

• pnpm update no longer moves the range a project declares for a dependency that overrides also lists, even when the override repeats that range verbatim. Previously the updated package.json disagreed with the lockfile, so the next pnpm install --frozen-lockfile failed with a specifier mismatch #​14224.

• Make pnpm add --lockfile-only skip dependency linking pnpm/pnpm#14286.

• --production is accepted again as an alias of --prod on install, fetch, prune, update, list, why, and sbom, and the install that verifyDepsBeforeRun reproduces is now spelled with --prod. pnpm run no longer aborts with "unexpected argument '--production' found" after a production-only install #​14147.

• The progress output no longer overwrites the lines above it once it grows taller than the terminal window #​14270.

• Restoring a dependency's build from the remote side-effects cache no longer downloads files the store already holds.

• Forward patchedDependencies hashes and packageExtensions to pnpr so server-side resolution preserves patches and package extensions in the lockfile and installed packages.

• Published the workspace task graph and scheduler as @pnpm/workspace.task-scheduler so other workspace commands can use the same dependency-aware scheduling as recursive run and exec.

• The environment variables for the remote side-effects cache are named for the setting they configure: PNPM_SIDE_EFFECTS_CACHE_REMOTE_KEY_ID, ..._BUILDER_ID, ..._IMAGE_DIGEST, ..._ARCHITECTURE_BASELINE, ..._PRIVATE_KEY, ..._BUILD_ENV, ..._TRUSTED_KEYS and ..._PUBLISH. The PNPM_REMOTE_SIDE_EFFECTS_CACHE_* names keep working, and the new one wins when both are set.

• A devEngines.packageManager range pin on pnpm is now recorded in pnpm-lock.yaml's packageManagerDependencies when the running pnpm already satisfies it, using the running version and keeping the range as the recorded specifier. Previously only an exact pin — or a range resolved on the way through a version switch — reached the lockfile, so a range pin written by hand (or by any tool other than pnpm add / pnpm self-update) left the project without the shared resolution the pin exists to provide.

• Fixed recursive run cleanup on Windows when a lifecycle script fails while another script's process tree is still running.

• The update notification now suggests pnpm self-update when PNPM_HOME manages the pnpm in use, and the standalone install script otherwise — under Corepack, or when another package manager installed pnpm. pnpm self-update under Corepack names the standalone install script too.

• Enforce allowBuilds when a prepared git dependency is reused from the shared store, and use the lockfile's canonical git resolution ID in approval suggestions.

• Topologically sorting workspace projects now runs in linear time, fixing installs and lockfile updates that stalled for seconds on workspaces with thousands of projects forming deep dependency chains #​14149, #​14151.

Platinum Sponsors

Gold Sponsors

v11.24.0: pnpm 11.24

Compare Source

Minor Changes

• Added global build approvals pnpm/pnpm#14101.

Patch Changes

• Fixed pnpm v11 incorrectly reporting confirmModulesPurge as unrecognized when set in pnpm-workspace.yaml. The Rust CLI now identifies the unsupported option as a pnpm v11 setting instead of suggesting an unrelated setting.

• pnpm install --frozen-lockfile no longer fails with ERR_PNPM_FROZEN_LOCKFILE_WITH_OUTDATED_LOCKFILE when the pinned pnpm version recorded in pnpm-lock.yaml has to be re-resolved before it can be installed. It runs the pnpm version the lockfile pins and leaves the lockfile unchanged #​14124.

• Under nodeLinker: hoisted, peer-resolution variants of an injected directory dependency (a file: snapshot) are materialized as separate copies again instead of collapsing onto the first-seen variant. Each copy keeps its own peer-resolved dependency set, so a project pinning one peer version no longer resolves another project's variant — Bit root components with conflicting peers across injected copies rely on this.

• Fixed pnpm install --merge-git-branch-lockfiles --frozen-lockfile failing with ERR_PNPM_OUTDATED_LOCKFILE when a branch lockfile predates the removal of a dependency, or its move to another dependency group #​13966. A dependency that no project declares anymore is no longer reinstated by the merge, and the packages it was the only path to are dropped with it.

• Batch workspace publishing accepts a shared scope-specific credential, rejects mismatched credentials for a registry before publishing, and runs the publish and postpublish scripts after each completed registry group pnpm/pnpm#14101.

• The Rust CLI now honors five settings it recognized but ignored: updateNotifier, legacyDirFiltering, initAuthorName / initAuthorEmail / initAuthorUrl, initLicense, and initVersion. pnpm install and pnpm add check once a day for a newer pnpm and print how to get it (turn it off with updateNotifier: false); a {<dir>} filter selector can go back to matching the subtree below the directory with legacyDirFiltering: true; and pnpm init writes the configured author, license, and version into the package.json it scaffolds. PNPM_CONFIG_INIT_VERSION is now read as well.

  maxsockets, npm's spelling of maxSockets, is no longer ignored: both spellings are read from pnpm-workspace.yaml, the global config file, the environment, and the command line, in that increasing order of precedence — a value passed on the command line now wins even when the two sides spelled the setting differently.

  A lastUpdateCheck timestamp dated in the future — after a clock change, a restored snapshot, or a hand-edited state file — no longer silences the update check until that time comes around.

  legacyDirFiltering no longer reaches the workspace-root selectors pnpm generates for itself: the !{<workspace-root>} exclusion a recursive run / exec / add / test appends, and the {<workspace-root>} inclusion --workspace-root appends. Read as subtree matches they named every project below the root, so a recursive command under the setting selected nothing at all, and --workspace-root pulled in every project below the root instead of the root alone #​14101.

• pnpm install --frozen-lockfile no longer fails when pnpm-lock.yaml records the pinned pnpm version alongside an engine package the running pnpm does not install it from. An entry pinning another version is still refused, and a plain install rewrites the block #​14124.

vuejs/core (vue)

v3.5.42

Compare Source

Bug Fixes

• hydration: handle async component unmount before lazy hydration (#​15252) (6e1814a)
• hydration: handle moving unresolved async fragment (#​15263) (a72036f)
• runtime-core: avoid caching unmounted suspense children (#​15291) (b535917), closes #​15288
• runtime-core: keep .trim result when combined with .number v-model modifier (#​15346) (f8d42e1)
• runtime-core: resolve $el for dev root comment fragment (#​15313) (8654f35), closes #​12680
• runtime-dom: support !important on CSS custom properties in style binding (#​15348) (31da934)
• server-renderer: reject CR in attribute names (#​15266) (a2b40db)
• shared: correctly compare Map and Set values (#​15328) (ef82a26), closes #​15320
• suspense: don't treat the leaving branch as the fallback while its mount is pending (#​15333) (cd19745), closes #​15332
• v-model: re-sync select when model is overridden in change handler (#​15298) (6eaecc1), closes #​10505

vuejs/router (vue-router)

v5.3.1

Compare Source

   🐞 Bug Fixes

• experimental: Handle non-string params for isActive  -  by @​posva (92cfd)

    View changes on GitHub

v5.3.0

Compare Source

   🚀 Features

• Prevent race condition dev-only error  -  by @​meihao550 in #​2789 (d2b87)
• scroll: Skip scroll computation based on history.scrollRestoration  -  by @​posva (033f1)
• unplugin: Don't crash on duplicate definePage() calls  -  by @​posva in #​2753 (686bf)
• volar: Narrow typeof useRoute in a type context  -  by @​Anoesj in #​2759 (7a4c8)

   🐞 Bug Fixes

• history:
  • Remove visibilitychange listener to prevent focus steal in Edge  -  by @​Mini-Sylar in #​2704 (17b58)
• router:
  • Skip scroll saving for unknown pop direction  -  by @​ifer47 in #​1431 and #​2780 (23150)
• types:
  • Allow unsetting a route name with false in EditableTreeNode  -  by @​Anoesj in #​2752 (8e2e1)
• unplugin:
  • Sort and dedupe params in generated types  -  by @​posva (a25fa)
  • Skip unnamed params in generated route types  -  by @​posva (c694e)
  • Report unnamed params once per route  -  by @​posva (52058)
  • Generate param types from override paths and stop inheritance on absolute overrides  -  by @​G100my in #​2646 (67bab)

   🏎 Performance

• Replace json5 and yaml with confbox  -  by @​danielroe in #​2769 (aab28)
• Avoid depending on the current route to resolve absolute locations  -  by @​danielroe (9b7e3)
• experimental: Avoid tracking currentRoute in absolute string locations  -  by @​posva (084fc)

    View changes on GitHub

colinhacks/zod (zod)

v4.5.4

Compare Source

Commits:

• 84e416f fix(v4): stop the cycle walk from firing a default factory (#​6500)
• e8e206f 4.5.4

v4.5.3

Compare Source

v4.5.2

Compare Source

Commits:

• a354314 fix(docs): keep blog posts out of the docs collection (#​6484)
• d378c42 ci: drop canary publishing from the release workflow (#​6487)
• 212b941 fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#​6488)
• e7576f5 docs(blog): let the page show through the navbar in dark mode (#​6489)
• fedb06f fix(docs): match the blog TOC hover bar to the 2px active indicator
• 6c932fc chore: bump devcontainer image to Node 24 (#​6470)
• 6635d9d docs(blog): soften the "method memoization" attribution
• 019ae29 fix(docs): drop ISR on the docs route so the home page hydrates
• 652bb43 chore(docs): drop the scroll log from the route-change scroller
• 571c8e8 fix(docs): render blog tabs with the stock fumadocs tab card
• 9a193aa 4.5.2

v4.5.1

Compare Source

Commits:

• 2e862db ci: gate the GitHub release and JSR publish on the version being live on npm
• 8e03380 4.5.1

v4.5.0

Compare Source

Zod 4.5 is now available.

npm install zod@latest

At a glance:

• z.compile() — the flagship feature of Zod 4.5
• z.creditCard() — 12–19 digits plus Luhn checksum
• z.properties() — the multi-property counterpart to z.property()
• z.deepPartial()/.exactPartial()
• z.validate(): boolean — a fast-path to verify input validity without a full parse (up to 16x faster on invalid data)
• 9x reduction in memory footprint
• New locales: Bengali (bn), Central Kurdish (ckb), Hindi (hi), Kannada (kn), Norwegian Nynorsk (nn), Brazilian Portuguese (pt-BR), Slovak (sk), Turkmen (tk)

z.compile()

You can now pre-compile any Zod schema using z.compile(schema). This dramatically speeds up parsing performance.

import * as z from "zod";

const Player = z.object({
  username: z.string(),
  bio: z.string(),
  xp: z.number()
});

const CompiledPlayer = z.compile(Player);

A compiled schema can be used exactly like an uncompiled one. There are no special rules around compiled schemas. They're just faster.

Player.parse({ ... });
CompiledPlayer.parse({ ... }); // ~2x faster

On objects, arrays, and unions, this speeds up parsing by a factor of ~3–7. More complex schemas stand to benefit more than simpler ones.

Time per parse by schema type, standard parser vs compiled — lower is better (benchmark)

Below are the Moltar benchmark results comparing Zod (compiled and uncompiled) against the Moltar ParseSafe bench.

Throughput on the moltar benchmark fixture (parseSafe: returns a new object with unknown keys stripped) — higher is better (benchmark)

And the equivalent results for the Moltar AssertLoose bench. Tested against the new z.validate(schema, input) function (detailed later in the post).

Throughput on the moltar benchmark fixture (assertLoose: returns a boolean, unknown keys allowed) — higher is better (benchmark)

Zod's entire test suite runs twice—once normally and again with auto-compilation enabled globally—to ensure perfect fidelity.

How it works

Under the hood, z.compile() walks the entire schema once and produces a hyperoptimized snippet of flat, loop-free JavaScript that can validate inputs far faster than a standard runtime validator. This snippet can be executed via new Function() (effectively a more powerful eval) to serve as a fast-path validator. Schemas use this to "fast check" validity, falling back to the regular runtime logic on validation failure to provide granular error information.

Take this simple Point schema:

const Point = z.object({
  x: z.number(),
  y: z.number()
});

Here is the generated snippet for it:

const isPoint = new Function("input", `
  if (typeof input !== "object" || input === null) return false;
  if (typeof input.x !== "number") return false;
  if (typeof input.y !== "number") return false;
  return true;
`);

isPoint({ x: 1, y: 2 }); // true
isPoint({ x: "1" });     // false

For the large majority of inputs, the generated function validates the data with the fastest logic JavaScript can express: straight-line typeof checks and property reads, with no interpreter in between. When it can't handle an input, Zod falls back to the standard parser.

This is the function Zod generates for the Player schema above:

if (typeof input !== "object" || input === null || Array.isArray(input)) return INVALID;
const v0 = input["username"];
if (typeof v0 !== "string") return INVALID;
const v1 = input["bio"];
if (typeof v1 !== "string") return INVALID;
const v2 = input["xp"];
if (typeof v2 !== "number" || !Number.isFinite(v2)) return INVALID;
const v3 = { "username": v0, "bio": v1, "xp": v2 };
return v3;

Armed with the power of new Function(), this happens in-process at runtime. There is no need to integrate with your build system.

The compiled schema is purely additive on top of the existing schema. It tacks on the pre-compiled fast path for checking valid inputs. When invalid data is detected, it returns the INVALID symbol to signal that parsing should fall back to the uncompiled parser. This structurally prevents subtle deviations in error reporting between compiled and uncompiled variants.

import "zod/compile"

To compile every schema in an application, import zod/compile once at the top of your entry point. Every schema constructed after that import is automatically compiled the first time it's used to parse data.

import "zod/compile"; // must come before modules that define schemas
import * as z from "zod";

const schema = z.object({ name: z.string() });
schema.parse({ name: "ok" }); // compiled on first parse

It also works as a Node.js CLI flag, which guarantees it runs before any module defines a schema:

node --import zod/compile app.js

Or set preload in bunfig.toml or nub.jsonc.

{
  "preload": ["zod/compile"]
}

All schemas benefit to varying degrees, though complex object/tuple/array schemas benefit more than simple scalar validators.

Read the docs, or the full technical writeup: Introducing z.compile()

z.creditCard()

A new string format: 12–19 digits, optionally separated by single spaces or hyphens, with a valid Luhn checksum. (#​5931)

z.creditCard().parse("4111 1111 1111 1111"); // ✅
z.creditCard().parse("4111 1111 1111 1112"); // ❌ bad checksum

z.properties()

The multi-property counterpart to z.property(). (#​5912)

const httpsUrl = z.instanceof(URL).check(
  ...z.properties({
    protocol: z.literal("https:" as string),
    hostname: z.string().regex(z.regexes.domain),
  })
);

httpsUrl.parse(new URL("https://example.com")); // ✅
httpsUrl.parse(new URL("http://localhost")); // ❌ protocol

z.deepPartial()

Back in functional form after being removed as a method in Zod 4. (#​5928)

const Post = z.object({
  title: z.string(),
  author: z.object({ name: z.string(), email: z.string() }),
});

const PartialPost = z.deepPartial(Post);
type PartialPost = z.output<typeof PartialPost>;
// => { title?: string; author?: { name?: string; email?: string } }

PartialPost.parse({ author: {} }); // ✅

The result is still a ZodObject, so .shape and .extend() keep wo

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "after 2am and before 3am"
• Automerge
  • "after 1am and before 2am"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
hr-folio	Error		Sep 5, 2026 1:12am UTC

[changeset-bot]

⚠️ No Changeset found

Latest commit: 078b8ef

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

? Verifying lockfile against supply-chain policies (1677 entries)...
✓ Lockfile passes supply-chain policies (1677 entries in 9.9s)
Progress: resolved 1, reused 0, downloaded 0, added 0
[WARN] deprecated eslint@9.39.5: This version is no longer supported. Please see https://eslint.org/version-support for other options.
Progress: resolved 157, reused 0, downloaded 0, added 0
Progress: resolved 294, reused 0, downloaded 0, added 0
Progress: resolved 359, reused 0, downloaded 0, added 0
Progress: resolved 434, reused 0, downloaded 3, added 0
Progress: resolved 551, reused 0, downloaded 5, added 0
Progress: resolved 697, reused 0, downloaded 5, added 0
Progress: resolved 720, reused 0, downloaded 5, added 0
Progress: resolved 1009, reused 0, downloaded 5, added 0
Progress: resolved 1127, reused 0, downloaded 5, added 0
Progress: resolved 1280, reused 0, downloaded 7, added 0
Progress: resolved 1417, reused 0, downloaded 9, added 0
Progress: resolved 1603, reused 0, downloaded 10, added 0
Progress: resolved 1645, reused 0, downloaded 10, added 0
Progress: resolved 1658, reused 0, downloaded 10, added 0
Progress: resolved 1659, reused 0, downloaded 10, added 0
Progress: resolved 1660, reused 0, downloaded 10, added 0
[ERR_PNPM_NO_MATURE_MATCHING_VERSION] 2 versions do not meet the minimumReleaseAge constraint:
  @upstash/redis@1.38.4 was published at 2026-09-04T11:00:05.232Z, within the minimumReleaseAge cutoff (2026-09-03T01:11:36.377Z)
  motion-v@2.4.1 was published at 2026-09-04T15:33:32.569Z, within the minimumReleaseAge cutoff (2026-09-03T01:11:36.377Z)