chore(deps): update npm packages

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
yaml (source)	2.9.0 → 2.9.1
zod (source)	4.5.4 → 4.6.2

---

Release Notes

eemeli/yaml (yaml)

v2.9.1

Compare Source

• Limit recursive merge aliases (#​685, #​713)
• Simplify line unfolding during quoted string parsing (#​714)

colinhacks/zod (zod)

v4.6.2

Compare Source

Commits:

• a00c3f3 docs: use Trigger.dev's brand-kit lockups for the platinum card
• 0c483c5 docs: Zod 4.6 announcement post (#​6546)
• 9446b5c fix: preserve undefined prefault outputs and object keys (#​6587)
• e359f73 4.6.2

v4.6.1

Compare Source

A patch on top of 4.6.0.

• b12aa523 fix: preserve unique tags with defaulted discriminators (#​6582) — closes #​6577
• dd9c36fa fix(v4): defer recursive object index inference (#​6580)
• 3b154992 feat(lang): add Tajik (tg) locale (#​6581) by @​ismoil77
• 2efa8b80 ci: give the npm wait a real budget and drop the back-publish path (#​6583)

v4.6.0

Compare Source

Commits:

• 908c9e1 fix(docs): retry the GitHub stars fetch and log the real status
• 93186ca docs(wiki): drop the zod-compiler benchmark (#​6505)
• 8ce9e8d feat(mini): publish Zod Mini as the standalone @​zod/mini package (#​6491)
• 2956c4c chore(mini): sync @​zod/mini to 4.5.4
• abd41ad docs(wiki): move plans and comparisons into a gitignored internal/ (#​6506)
• 8106573 chore(docs): build with Turbopack
• c7ec94d ci: check zod and @​zod/mini lockstep on npm after every publish (#​6507)
• c46eeff chore: narrow blanket biome-ignore comments (#​6504)
• a0898b4 ci: wait hours for npm to serve a publish, not ten minutes (#​6502)
• 1c0bce0 docs: bring the 4.5 charts and worked examples into the docs pages
• 70eb2c0 docs: drop the traits section and the compilation feature bullet
• 43b9bfc docs: drop the bound-methods section from the Zod package page
• cd4f9a6 perf(v4): report Standard Schema issues without constructing a ZodError (#​6509)
• f3cb364 docs: surface the blog on the home page and in the sidebar
• f3e7c72 fix(docs): render the docs 404 page inside the (doc) layout once
• f412178 ci: publish @​zod/mini to JSR in lockstep with npm (#​6510)
• 5ff9566 Stop re-exporting the compile internals from zod/v4/core (#​6511)
• 40b4d0b fix(ci): read zod's latest version with npm view when picking the backfill dist-tag
• a6b4939 Mark the compile internals @​internal instead of hiding them (#​6518)
• 3195ed0 docs: label the memory chart like the compile chart
• 8cd1250 docs: center the memory chart callout labels
• ff56a55 docs: center the memory chart callout labels and pad them off the number
• fb2fedf docs: tighten the memory chart callout, pad the canvas, say "less memory"
• 93f3ab3 docs: replace the blog navbar's GitHub icon with a star-count pill
• 7ae49d6 docs: drop the circle around the star pill's GitHub mark and center it on the pill's arc
• b801439 bench: add typebox (compiled and dynamic) to the moltar cross-library harness
• 1ec6b7c docs: add an RSS feed to the blog at /blog/rss.xml
• 08ba069 perf(v4): read Luhn digits with charCodeAt instead of string indexing (#​6529)
• 319f47f Emit a length-aware base64url pattern in toJSONSchema (#​6527)
• a2a019a Accept enum-typed targets in z.toZod (#​6528)
• 74f9a6d docs: drop the toZod enum block from basics and pin the page's curation rule in a comment
• f83ab51 fix(v4): reject component-only strings from z.emoji() (#​6532)
• 84dd3b0 perf: build literal and enum pattern regexes lazily (#​6531)
• 0227e53 docs: bump the star pill's GitHub mark to 20px
• 68a609a Widen literal inputs in property check types (#​6520)
• 2ec972e refactor: collapse toZod's enum leaf normalizer to a dummy union (#​6533)
• bc1157e docs: use a Response example for z.properties()
• 07c43e2 Keep the runtime base64 regexes linear so composed parse paths cannot overflow (#​6534)
• bec73be perf(v4): build the safeParse error on first read (#​6519)
• bf99021 perf: move util.cached's accessor to a prototype (#​6537)
• 69f2a7f Collapse toZod's normalizer and move its docs to the API reference (#​6539)
• abfb389 feat(v4): make z.properties() a schema, and give z.instanceof() a .properties() method (#​6536)
• 51caf01 refactor: collapse cachedInternal back into cached (#​6540)
• 81ded99 perf: answer z.validate from the compiled fast path on invalid input (#​6538)
• eca9687 fix(v4): enforce the six JSON Schema keywords fromJSONSchema silently dropped (#​6535)
• 68aca3d docs: cover the 4.5 API surface that never made it into the reference
• 18e71c7 Rename the JSON Schema process helper so bundler polyfills cannot collide (#​6541)
• 90269c6 Keep a numeric TS enum's reverse-mapping keys out of .options (#​6542)
• 4d73088 Release the parsed input once a failing safeParse builds its error (#​6543)
• cafbee4 fix(v4): parse recursive schemas built by a factory (#​6530)
• 62e6624 feat(v4): add .validate() and .validateAsync() to Zod Classic (#​6547)
• 07917f4 test(v4): pin the lazy safeParse error's stack behavior (#​6548)
• 764ac59 perf(v4): settle z.validate on the first failure in parse order (#​6544)
• e760471 docs: attribute the compiled failure cost to the fallback, not the double pass
• 5489a53 test(v4): pin the check-chain case that keeps compiled validate's definite guard (#​6551)
• 7a00236 fix(v4): don't let format checks overwrite tighter min/max bounds (#​6553)
• e4d67f3 Migrate development and CI to Nub (#​6562)
• 6f04836 fix(v4): derive JSON Schema constraints by folding checks in the converter (#​6554)
• 804e0f5 perf: seal the CommonJS exports so require("zod") stops reading through a getter (#​6564)
• 741981f perf(compile): for-in record walk, cheaper issue finalization, and a generative compile differential (#​6567)
• eb1c108 ci: release only on workflow_dispatch behind the npm environment (#​6569)
• 277613a docs: move the release procedure to the maintainer-local notes
• dcbcf05 fix(compile): unwind the doc indent when a child generator throws (#​6570)
• e54716c docs(ecosystem): add @​apical-ts/craft (#​5946)
• c5b9bcb bench: measure what a runtime island's leaked indent cost the generated source
• 22bed61 feat(v4): add z.iban() string format with mod-97 checksum (#​6571)
• 36f1796 fix(v4): stop the memoizer from pinning a finished parse (#​6572)
• f7fd554 perf(v4): drop the lookaheads from the email regex (#​6573)
• f9465d4 docs: reconcile the sponsor listings with active sponsorships (#​6576)
• 213ee75 feat(compile): add z.withParser for externally generated parsers (#​6575)
• 6de10dc docs: reconcile the sponsor listings against every active sponsorship (#​6579)
• 661673a docs: make the 9thCO logo visible on the light theme
• 1c51cbe 4.6.0
• 3b15499 feat(lang): add Tajik (tg) locale
• c532d76 test(locales): cover Tajik error branches
• 574d480 fix(locales): clarify Tajik discriminator value message
• dd9c36f fix(v4): defer recursive object index inference (#​6580)
• b12aa52 fix: preserve unique tags with defaulted discriminators (#​6582)

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • "before 10am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	yaml@​2.9.0 ⏵ 2.9.1	+1
	zod@​4.5.4 ⏵ 4.6.2

View full report

[github-actions]

✅ GitLab E2E passed

Commit: 56a14632b55d96f512f6c8d61509f2be6692cbee
Suite: full · Vite+ version: latest

GitLab pipeline · GitHub Actions run