Skip to content

fix(deps): update all non-major dependencies - #490

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

fix(deps): update all non-major dependencies#490
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@hookform/resolvers (source) 5.6.0 → 5.9.1 age confidence
@storybook/addon-a11y (source) 10.5.5 → 10.5.10 age confidence
@storybook/addon-docs (source) 10.5.5 → 10.5.10 age confidence
@storybook/addon-links (source) 10.5.5 → 10.5.10 age confidence
@storybook/react-vite (source) 10.5.5 → 10.5.10 age confidence
@testing-library/react 16.3.2 → 16.3.3 age confidence
@testing-library/user-event 14.6.1 → 14.6.6 age confidence
@types/react-dom (source) 19.2.4 → 19.2.5 age confidence
@vitest/coverage-v8 (source) 4.1.10 → 4.1.11 age confidence
axios (source) 1.19.0 → 1.20.0 age confidence
commitlint (source) 21.2.1 → 21.2.2 age confidence
i18next (source) 26.3.6 → 26.4.0 age confidence
lint-staged 17.3.0 → 17.4.1 age confidence
react-hook-form (source) 7.84.0 → 7.87.0 age confidence
react-i18next 17.0.11 → 17.0.12 age confidence
react-router (source) 8.3.0 → 8.3.1 age confidence
sass-embedded 1.100.0 → 1.103.1 age confidence
storybook (source) 10.5.5 → 10.5.10 age confidence
vitest (source) 4.1.10 → 4.1.11 age confidence
zod (source) 4.4.3 → 4.5.4 age confidence

Release Notes

react-hook-form/resolvers (@​hookform/resolvers)

v5.9.1

Compare Source

v5.9.0

Compare Source

Features

v5.8.0

Compare Source

v5.7.1

Compare Source

v5.7.0

Compare Source

Features
storybookjs/storybook (@​storybook/addon-a11y)

v10.5.10

Compare Source

v10.5.9

Compare Source

v10.5.8

Compare Source

v10.5.7

Compare Source

v10.5.6

Compare Source

storybookjs/storybook (@​storybook/addon-docs)

v10.5.10

Compare Source

v10.5.9

Compare Source

v10.5.8

Compare Source

v10.5.7

Compare Source

v10.5.6

Compare Source

storybookjs/storybook (@​storybook/addon-links)

v10.5.10

Compare Source

v10.5.9

Compare Source

v10.5.8

Compare Source

v10.5.7

Compare Source

v10.5.6

Compare Source

storybookjs/storybook (@​storybook/react-vite)

v10.5.10

Compare Source

v10.5.9

Compare Source

v10.5.8

Compare Source

v10.5.7

Compare Source

v10.5.6

Compare Source

testing-library/react-testing-library (@​testing-library/react)

v16.3.3

Compare Source

Bug Fixes
testing-library/user-event (@​testing-library/user-event)

v14.6.6

Compare Source

Bug Fixes
  • default pointer event pointerType to empty string instead of the string "undefined" (#​1325) (71a5475)

v14.6.5

Compare Source

Bug Fixes

v14.6.4

Compare Source

v14.6.3

Compare Source

vitest-dev/vitest (@​vitest/coverage-v8)

v4.1.11

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
axios/axios (axios)

v1.20.0

Compare Source

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

  • HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#​11082)

🔒 Security Fixes

  • Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#​11141)

🐛 Bug Fixes

  • Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#​11087, #​11118)
  • Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#​11109)
  • XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#​11094, #​11121)
  • Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#​11091)
  • Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#​11096)

🔧 Maintenance & Chores

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog (axios/axios@v1.19.0...v1.20.0)

conventional-changelog/commitlint (commitlint)

v21.2.2

Compare Source

Note: Version bump only for package commitlint

i18next/i18next (i18next)

v26.4.0

Compare Source

  • perf: cache toResolveHierarchy results per (code, fallbackCode) pair. The hierarchy resolver runs on every t() call and calls Intl.getCanonicalLocales multiple times, which showed up prominently when profiling render-heavy UIs (e.g. virtualized data grids); with the cache the per-call cost drops from ~886 ns to ~41 ns. The cache is invalidated automatically when options.fallbackLng changes (reassignment or in-place array mutation); if you mutate other resolution-relevant options at runtime (load, lowerCaseLng, cleanCode, nonExplicitSupportedLngs), call i18next.services.languageUtils.clearCache() afterwards. Function-valued fallbackLng and per-call array/object fallbackLng options are never cached, so dynamic fallbacks keep working as before. Thanks @​equaterina (#​2444).
  • chore: update all devDependencies (Babel stays on 7.x until @rollup/plugin-babel supports 8, eslint on 9.x for neostandard). Removed the unused coveralls package (CI uses the Coveralls GitHub Action) and replaced sinon with nise + vitest.spyOn in the v1 compatibility tests, which resolves all open npm audit findings (0 vulnerabilities) and should close the dependabot alerts on the lockfile.
lint-staged/lint-staged (lint-staged)

v17.4.1

Compare Source

Patch Changes
  • #​1840 efe5b63 - This is a version-bump-only release because the previous version 17.4.0 was not published to npmjs.com due to problems with GitHub Actions and Changesets.
react-hook-form/react-hook-form (react-hook-form)

v7.87.0

Compare Source

Added
  • shouldTouch option for trigger()
  • OpaqueTypes registry for opaque leaf types
Fixed
  • Inconsistent behavior among useController().field.onChange()-like APIs
  • Controller under a null parent submitting undefined instead of a value
  • ERR_MODULE_NOT_FOUND resolving react-hook-form due to a react-server declaration (Next.js builds)
  • useWatch never reconciling when an Activity subtree is hidden on its first render
  • resetField not recomputing isValid for subscribe-only consumers
  • generateWatchOutput ignoring defaultValue for an array of names
  • useFormState never reconciling when an Activity subtree is hidden on its first render

v7.86.0

Compare Source

Added
  • Type-safe getErrors method
Performance
  • Improve createFormControl
  • Improve clone object check
  • Avoid cloning values in unregister without subscribers
Fixed
  • Field array update leaving stale errors and touched state at the updated index
  • flatten discarding File and Blob values instead of treating them as leaf nodes
  • validateField not passing the field error to setCustomValidity when criteriaMode is all
  • hasValidation treating falsy but valid values (min: 0, max: 0, minLength: 0, maxLength: 0, required: '') as no validation
  • setValue targeting a nested leaf not notifying a Controller registered on a field array item root
  • setValues not updating fields registered under an object or array value
  • useWatch returning a stale value on name change when the new value is null
  • unregister inverting keepDirty when broadcasting isDirty

v7.85.0

Compare Source

Added
  • Support <Activity />
Fixed
  • getFieldState error resolution from a field path
  • useWatch discarding useForm({ defaultValues }) in favor of its own defaultValue before the form mounts
  • setValue emitting a duplicate values state notification for fields without a native input ref
  • Stale render re-creating a field array path vacated by an array action
  • useFieldArray root-level error (errors.name.root) being lost on append/prepend/insert/remove
  • min/max validation being skipped for valueAsDate fields
i18next/react-i18next (react-i18next)

v17.0.12

Compare Source

  • fix(IcuTrans): key-less icu.macro nodes (<Trans>Welcome, {name}!</Trans>, <Select>, <Plural> without i18nKey) rendered an empty string since 17.0.0. The macro now emits <IcuTrans defaultTranslation="…"> without a key and IcuTrans passed undefined to t(), which returns ''. Like Trans, IcuTrans now uses defaultTranslation as the key when i18nKey is not provided.
remix-run/react-router (react-router)

v8.3.1

Compare Source

Patch Changes
  • Fix Expected fetcher: <key> error thrown on navigation when a fetcher is aborted during its post-action revalidation (#​15365)
  • Fix lazy route discovery caching a path as discovered when the triggering navigation was aborted after the manifest response settled but before the route tree was patched, which permanently (for the session) shadowed the real route behind a catch-all or produced 404s on every subsequent visit (#​15399)
  • Improve route matching performance for long paths (#​15417)
  • Improve validation of action request origins (#​15419)
  • Fix <ScrollRestoration> leaving history.scrollRestoration set to "auto" after a bfcache restore, which let the browser restore scroll on subsequent history traversals before the destination route had rendered (#​15397)
  • Properly respect the relative option in useSubmit/fetcher.submit when resolivng the action path (#​15400)
  • Add additional URL validation on client side navigations/redirects (#​15445)
sass/embedded-host-node (sass-embedded)

v1.103.1

Compare Source

  • No user-visible changes.

v1.102.0

Compare Source

  • Use the 2.4 gamma transfer function for rec2020, as specified by the latest
    draft of CSS Color 4.
storybookjs/storybook (storybook)

v10.5.10

Compare Source

v10.5.9

Compare Source

v10.5.8

Compare Source

v10.5.7

Compare Source

v10.5.6

Compare Source

colinhacks/zod (zod)

v4.5.4

Compare Source

Commits:

v4.5.3

Compare Source

v4.5.2

Compare Source

Commits:

  • a354314 fix(docs): keep blog posts out of the docs collection (#​6484)
  • d378c42 ci: drop canary publishing from the release workflow (#​6487)
  • 212b941 fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#​6488)
  • e7576f5 docs(blog): let the page show through the navbar in dark mode (#​6489)
  • fedb06f fix(docs): match the blog TOC hover bar to the 2px active indicator
  • 6c932fc chore: bump devcontainer image to Node 24 (#​6470)
  • 6635d9d docs(blog): soften the "method memoization" attribution
  • 019ae29 fix(docs): drop ISR on the docs route so the home page hydrates
  • 652bb43 chore(docs): drop the scroll log from the route-change scroller
  • 571c8e8 fix(docs): render blog tabs with the stock fumadocs tab card
  • 9a193aa 4.5.2

v4.5.1

Compare Source

Commits:

  • 2e862db ci: gate the GitHub release and JSR publish on the version being live on npm
  • 8e03380 4.5.1

v4.5.0

Compare Source

Zod 4.5 is now available.

npm install zod@latest

At a glance:

z.compile()

You can now pre-compile any Zod schema using z.compile(schema). This dramatically speeds up parsing performance.

import * as z from "zod";

const Player = z.object({
  username: z.string(),
  bio: z.string(),
  xp: z.number()
});

const CompiledPlayer = z.compile(Player);

A compiled schema can be used exactly like an uncompiled one. There are no special rules around compiled schemas. They're just faster.

Player.parse({ ... });
CompiledPlayer.parse({ ... }); // ~2x faster

On objects, arrays, and unions, this speeds up parsing by a factor of ~3–7. More complex schemas stand to benefit more than simpler ones.

Time per parse on a shared nanosecond axis, standard parser as a gray bar with the compiled time as a blue bar inside it: an array of 10 objects 377 ns to 68 ns (5.5x), a 20-key object 301 ns to 38 ns (7.8x), an array of 10 strings 241 ns to 33 ns (7.3x), a union of 3 objects 190 ns to 36 ns (5.3x), a 3-element tuple 119 ns to 33 ns (3.6x), a 5-key strict object 117 ns to 32 ns (3.7x), a discriminated union 92 ns to 27 ns (3.4x), a 5-key object 76 ns to 28 ns (2.8x); up to 7.8x faster when compiled

Time per parse by schema type, standard parser vs compiled — lower is better (benchmark)

Below are the Moltar benchmark results comparing Zod (compiled and uncompiled) against the Moltar ParseSafe bench.

Bar chart of operations per second on the moltar benchmark fixture, parseSafe category: Zod 4 compiled 47.5M, typia 45.3M, Zod 4 11.6M, valibot 1.8M, effect 1.7M, Zod 3 1.2M, arktype 152k, yup 121k

Throughput on the moltar benchmark fixture (parseSafe: returns a new object with unknown keys stripped) — higher is better (benchmark)

And the equivalent results for the Moltar AssertLoose bench. Tested against the new z.validate(schema, input) function (detailed later in the post).

Bar chart of operations per second on the moltar benchmark fixture, assertLoose category: typia 74.9M, arktype 66.2M, Zod 4 compiled 60.6M, Zod 4 6.5M, valibot 1.9M, effect 1.7M, Zod 3 1.2M, yup 124k

Throughput on the moltar benchmark fixture (assertLoose: returns a boolean, unknown keys allowed) — higher is better (benchmark)

Zod's entire test suite runs twice—once normally and again with auto-compilation enabled globally—to ensure perfect fidelity.

How it works

Under the hood, z.compile() walks the entire schema once and produces a hyperoptimized snippet of flat, loop-free JavaScript that can validate inputs far faster than a standard runtime validator. This snippet can be executed via new Function() (effectively a more powerful eval) to serve as a fast-path validator. Schemas use this to "fast check" validity, falling back to the regular runtime logic on validation failure to provide granular error information.

Take this simple Point schema:

const Point = z.object({
  x: z.number(),
  y: z.number()
});

Here is the generated snippet for it:

const isPoint = new Function("input", `
  if (typeof input !== "object" || input === null) return false;
  if (typeof input.x !== "number") return false;
  if (typeof input.y !== "number") return false;
  return true;
`);

isPoint({ x: 1, y: 2 }); // true
isPoint({ x: "1" });     // false

For the large majority of inputs, the generated function validates the data with the fastest logic JavaScript can express: straight-line typeof checks and property reads, with no interpreter in between. When it can't handle an input, Zod falls back to the standard parser.

This is the function Zod generates for the Player schema above:

if (typeof input !== "object" || input === null || Array.isArray(input)) return INVALID;
const v0 = input["username"];
if (typeof v0 !== "string") return INVALID;
const v1 = input["bio"];
if (typeof v1 !== "string") return INVALID;
const v2 = input["xp"];
if (typeof v2 !== "number" || !Number.isFinite(v2)) return INVALID;
const v3 = { "username": v0, "bio": v1, "xp": v2 };
return v3;

Armed with the power of new Function(), this happens in-process at runtime. There is no need to integrate with your build system.

The compiled schema is purely additive on top of the existing schema. It tacks on the pre-compiled fast path for checking valid inputs. When invalid data is detected, it returns the INVALID symbol to signal that parsing should fall back to the uncompiled parser. This structurally prevents subtle deviations in error reporting between compiled and uncompiled variants.

import "zod/compile"

To compile every schema in an application, import zod/compile once at the top of your entry point. Every schema constructed after that import is automatically compiled the first time it's used to parse data.

import "zod/compile"; // must come before modules that define schemas
import * as z from "zod";

const schema = z.object({ name: z.string() });
schema.parse({ name: "ok" }); // compiled on first parse

It also works as a Node.js CLI flag, which guarantees it runs before any module defines a schema:

node --import zod/compile app.js

Or set preload in bunfig.toml or nub.jsonc.

{
  "preload": ["zod/compile"]
}

All schemas benefit to varying degrees, though complex object/tuple/array schemas benefit more than simple scalar validators.

Read the docs, or the full technical writeup: Introducing z.compile()

z.creditCard()

A new string format: 12–19 digits, optionally separated by single spaces or hyphens, with a valid Luhn checksum. (#​5931)

z.creditCard().parse("4111 1111 1111 1111"); // ✅
z.creditCard().parse("4111 1111 1111 1112"); // ❌ bad checksum

z.properties()

The multi-property counterpart to z.property(). (#​5912)

const httpsUrl = z.instanceof(URL).check(
  ...z.properties({
    protocol: z.literal("https:" as string),
    hostname: z.string().regex(z.regexes.domain),
  })
);

httpsUrl.parse(new URL("https://example.com")); // ✅
httpsUrl.parse(new URL("http://localhost")); // ❌ protocol

z.deepPartial()

Back in functional form after being removed as a method in Zod 4. (#​5928)

const Post = z.object({
  title: z.string(),
  author: z.object({ name: z.string(), email: z.string() }),
});

const PartialPost = z.deepPartial(Post);
type PartialPost = z.output<typeof PartialPost>;
// => { title?: string; author?: { name?: string; email?: string } }

PartialPost.parse({ author: {} }); // ✅

The result is still a ZodObject, so .shape and .extend() keep working.

.exactPartial()

Like .partial(), but wraps each field in z.exactOptional() instead of z.optional(): keys may be omitted, but an explicit undefined is rejected. This matches TypeScript's Partial<> under exactOptionalPropertyTypes. (#​6065)

const Recipe = z.object({ title: z.string(), servings: z.number() });

const PartialRecipe = Recipe.exactPartial();
PartialRecipe.parse({});                    // ✅
PartialRecipe.parse({ title: undefined });  // ❌

In Zod Mini it's a top-level function: z.exactPartial(Recipe).

z.validate()

Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a ZodError, which makes rejection cheap: on invalid input it is up to 16x faster than .safeParse().success. The return type is a guard on the schema's input type, and z.validateAsync() covers schemas with async refinements. ([#​6471](https://redirect.github.com/colinhacks/zod/pull/

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Istanbul)

  • Branch creation
    • Between 07:00 AM and 09:59 AM, only on Monday (* 7-9 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner August 10, 2026 06:28
@changeset-bot

changeset-bot Bot commented Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 8311859

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from a02ce3c to 4407b29 Compare August 17, 2026 03:10
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 9 times, most recently from 2cabde0 to ea9d342 Compare August 25, 2026 15:00
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from bb25a08 to 363d2f2 Compare September 1, 2026 18:56
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 363d2f2 to 8311859 Compare September 2, 2026 03:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants