Skip to content

build: update dependency zod to v4.6.6 (22.2.x) - #34331

Merged
alan-agius4 merged 1 commit into
angular:22.2.xfrom
angular-robot:ng-renovate/22.2.x-zod-4-x
Oct 13, 2026
Merged

alan-agius4 merged 1 commit into
angular:22.2.xfrom
angular-robot:ng-renovate/22.2.x-zod-4-x

Conversation

@angular-robot

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
zod (source) 4.6.5 → 4.6.6 age adoption passing confidence

  • If you want to rebase/retry this PR, check this box

Release Notes

colinhacks/zod (zod)

v4.6.6

Compare Source

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #​6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243f, the pre-rewrite copy of 9c21983 with identical contents.

Commits:

  • 0cd3af5 docs: load the en locale directly in Zod Mini
  • 9d5e60f docs: import locales from zod/locales, not z.locales
  • 34a626f docs: tighten the z.locales tree-shaking note
  • 74304ce release: stage npm versions instead of publishing them (#​6622)
  • b2ef983 docs: add Code for Japan to bronze sponsors
  • 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
  • bacad51 docs: square the Code for Japan logo to match the other bronze tiles
  • c42596b release: hold the run on the release-approval environment until the staged versions are approved (#​6638)
  • a2ba4a6 fix(types): declare record output and input as members, not base type arguments (#​6645)
  • a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#​6652)
  • 529f78d 4.6.6
  • 9c21983 ci: stage at verbose so a failed OIDC token exchange says why

See associated pull request for more information.
@angular-robot angular-robot added action: merge The PR is ready for merge by the caretaker area: build & ci Related the build and CI infrastructure of the project target: automation This PR is targeted to only merge into the branch defined in Github [bot use only] labels Oct 13, 2026

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the version of the zod dependency in packages/angular/cli/package.json from 4.6.5 to 4.6.6. I have no feedback to provide as there are no review comments and the change is straightforward.

@alan-agius4 alan-agius4 linked an issue Oct 13, 2026 that may be closed by this pull request
1 task
@alan-agius4
alan-agius4 merged commit c0b6659 into angular:22.2.x Oct 13, 2026
40 checks passed
@alan-agius4
alan-agius4 deleted the ng-renovate/22.2.x-zod-4-x branch October 13, 2026 16:00
@alan-agius4

Copy link
Copy Markdown
Collaborator

This PR was merged into the repository. The changes were merged into the following branches:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

action: merge The PR is ready for merge by the caretaker area: build & ci Related the build and CI infrastructure of the project target: automation This PR is targeted to only merge into the branch defined in Github [bot use only]

Projects

None yet

Development

Successfully merging this pull request may close these issues.

@angular/cli zod vulnerable dependency 22.2.2

2 participants