fix(deps): update all non-major dependencies #22

renovate · 2026-01-05T10:35:39Z

This PR contains the following updates:

Package	Change	Age	Confidence
@commitlint/cli (source)	`20.2.0` → `20.3.0`
@commitlint/config-conventional (source)	`20.2.0` → `20.3.0`
@swc/helpers (source)	`0.5.17` → `0.5.18`
@typescript-eslint/eslint-plugin (source)	`8.50.1` → `8.51.0`
@typescript-eslint/parser (source)	`8.50.1` → `8.51.0`
pnpm (source)	`10.26.1` → `10.27.0`
posthog-js (source)	`1.310.1` → `1.313.0`
react (source)	`19.2.0` → `19.2.3`
react-dom (source)	`19.2.0` → `19.2.3`
typescript-eslint (source)	`8.50.1` → `8.51.0`
zod (source)	`4.2.1` → `4.3.4`

Release Notes

conventional-changelog/commitlint (@commitlint/cli)

`v20.3.0`

Compare Source

Note: Version bump only for package @commitlint/cli

conventional-changelog/commitlint (@commitlint/config-conventional)

`v20.3.0`

Compare Source

Note: Version bump only for package @commitlint/config-conventional

swc-project/swc (@swc/helpers)

`v0.5.18`

Compare Source

typescript-eslint/typescript-eslint (@typescript-eslint/eslint-plugin)

`v8.51.0`

Compare Source

🚀 Features

eslint-plugin: add namespace to plugin meta (#11885)
eslint-plugin: [no-useless-default-assignment] fix some cases to optional syntax (#11871)

🩹 Fixes

eslint-plugin: [prefer-optional-chain] handle MemberExpression in final chain position (#11835)
eslint-plugin: bump ts-api-utils to 2.2.0 (#11881)
eslint-plugin: remove fixable from no-dynamic-delete rule (#11876)
eslint-plugin: fix crash and false positives in no-useless-default-assignment (#11845)

❤️ Thank You

Josh Goldberg ✨
Kirk Waiblinger @kirkwaiblinger
mdm317
Ulrich Stark
Yannick Decat @mho22

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@typescript-eslint/parser)

`v8.51.0`

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

pnpm/pnpm (pnpm)

`v10.27.0`

Compare Source

`v10.26.2`: pnpm 10.26.2

Compare Source

Patch Changes

Improve error message when a package version exists but does not meet the minimumReleaseAge constraint. The error now clearly states that the version exists and shows a human-readable time since release (e.g., "released 6 hours ago") #10307.
Fix installation of Git dependencies using annotated tags #10335.

Previously, pnpm would store the annotated tag object's SHA in the lockfile instead of the actual commit SHA. This caused ERR_PNPM_GIT_CHECKOUT_FAILED errors because the checked-out commit hash didn't match the stored tag object hash.
Binaries of runtime engines (Node.js, Deno, Bun) are written to node_modules/.bin before lifecycle scripts (install, postinstall, prepare) are executed #10244.
Try to avoid making network calls with preferOffline #10334.

Platinum Sponsors

Gold Sponsors

PostHog/posthog-js (posthog-js)

`v1.313.0`

Compare Source

1.313.0

Minor Changes

#2832 f050f6c Thanks @rafaeelaudibert! - Introduce custom cookie properties for localStorage+cookie persistence using the new cookie_persisted_properties property. This allows people to opt-in to store properties in cookies even in localstorage+cookies mode
(2026-01-01)

`v1.312.0`

Compare Source

1.312.0

Minor Changes

#2834 548b466 Thanks @ordehi! - fix: Clear PageViewManager state on session rotation to prevent cross-session duration pollution

When a browser tab is backgrounded and the session rotates (30 min idle or 24 hour max), PageViewManager now clears its state. This prevents $prev_pageview_duration from spanning session boundaries, which was causing impossibly large values (94+ hours observed) in web analytics "Average Time on Page" metrics.

Users who implemented workarounds for inflated $prev_pageview_duration values (e.g., capping at 30 minutes) may want to review those after upgrading, as the root cause is now fixed. (2025-12-31)

`v1.311.0`

Compare Source

1.311.0

Minor Changes

#2813 4b7443c Thanks @ordehi! - feat(flags): add updateFlags() method for injecting flags without network request

Adds posthog.updateFlags(flags, payloads?, options?) to inject feature flag values from an external source (e.g., server-side evaluation, edge middleware) without making a network request. Supports { merge: true } option to merge with existing flags instead of replacing. (2025-12-29)

`v1.310.2`

Compare Source

1.310.2

Patch Changes

#2812 ad42eae Thanks @lucasheriques! - fix(surveys): queue callbacks when fetch is in progress instead of returning error
(2025-12-29)
#2814 3da6a4c Thanks @jurajmajerik! - Persist $device_id to cookies so it survives localStorage clears
(2025-12-29)

facebook/react (react)

`v19.2.3`: 19.2.3 (December 11th, 2025)

Compare Source

React Server Components

Add extra loop protection to React Server Functions (@sebmarkbage #35351)

`v19.2.2`: 19.2.2 (December 11th, 2025)

Compare Source

React Server Components

Move react-server-dom-webpack/*.unbundled to private react-server-dom-unbundled (@eps1lon #35290)
Patch Promise cycles and toString on Server Functions (@sebmarkbage, @unstubbable #35289)

`v19.2.1`: 19.2.1 (December 3rd, 2025)

Compare Source

React Server Components

Bring React Server Component fixes to Server Actions (@sebmarkbage #35277)

typescript-eslint/typescript-eslint (typescript-eslint)

`v8.51.0`

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

colinhacks/zod (zod)

`v4.3.4`

Compare Source

Commits:

1a8bea3 Add integration tests
e01cd02 Support patternProperties for looserecord (#5592)
089e5fb Improve looseRecord docs
decef9c Fix lint
9443aab Drop iso time in fromJSONSchema
66bda74 Remove .refine() from ZodMiniType
b4ab94c 4.3.4

Commits:

0fe8840 allow non-overwriting extends with refinements. 4.3.1

`v4.3.0`

Compare Source

This is Zod's biggest release since 4.0. It addresses several of Zod's longest-standing feature requests.

`z.fromJSONSchema()`

Convert JSON Schema to Zod (#5534, #5586)

You can now convert JSON Schema definitions directly into Zod schemas. This function supports JSON Schema "draft-2020-12", "draft-7", "draft-4", and OpenAPI 3.0.

import * as z from "zod";

const schema = z.fromJSONSchema({
  type: "object",
  properties: {
    name: { type: "string", minLength: 1 },
    age: { type: "integer", minimum: 0 },
  },
  required: ["name"],
});

schema.parse({ name: "Alice", age: 30 }); // ✅

The API should be considered experimental. There are no guarantees of 1:1 "round-trip soundness": MySchema > z.toJSONSchema() > z.fromJSONSchema(). There are several features of Zod that don't exist in JSON Schema and vice versa, which makes this virtually impossible.

Features supported:

All primitive types (string, number, integer, boolean, null, object, array)
String formats (email, uri, uuid, date-time, date, time, ipv4, ipv6, and more)
Composition (anyOf, oneOf, allOf)
Object constraints (additionalProperties, patternProperties, propertyNames)
Array constraints (prefixItems, items, minItems, maxItems)
$ref for local references and circular schemas
Custom metadata is preserved

`z.xor()` — exclusive union (#5534)

A new exclusive union type that requires exactly one option to match. Unlike z.union() which passes if any option matches, z.xor() fails if zero or more than one option matches.

const schema = z.xor([z.string(), z.number()]);

schema.parse("hello"); // ✅
schema.parse(42);      // ✅
schema.parse(true);    // ❌ zero matches

When converted to JSON Schema, z.xor() produces oneOf instead of anyOf.

`z.looseRecord()` — partial record validation (#5534)

A new record variant that only validates keys matching the key schema, passing through non-matching keys unchanged. This is used to represent patternProperties in JSON Schema.

const schema = z.looseRecord(z.string().regex(/^S_/), z.string());

schema.parse({ S_name: "John", other: 123 });
// ✅ { S_name: "John", other: 123 }
// only S_name is validated, "other" passes through

`.exactOptional()` — strict optional properties (#5589)

A new wrapper that makes a property key-optional (can be omitted) but does not accept undefined as an explicit value.

const schema = z.object({
  a: z.string().optional(),      // accepts `undefined`
  b: z.string().exactOptional(), // does not accept `undefined`
});

schema.parse({});                  // ✅
schema.parse({ a: undefined });    // ✅
schema.parse({ b: undefined });    // ❌

This makes it possible to accurately represent the full spectrum of optionality expressible using exactOptionalPropertyTypes.

`.apply()`

A utility method for applying arbitrary transformations to a schema, enabling cleaner schema composition. (#5463)

const setCommonChecks = <T extends z.ZodNumber>(schema: T) => {
  return schema.min(0).max(100);
};

const schema = z.number().apply(setCommonChecks).nullable();

`.brand()` cardinality

The .brand() method now accepts a second argument to control whether the brand applies to input, output, or both. Closes #4764, #4836.

// output only (default)
z.string().brand<"UserId">();           // output is branded (default)
z.string().brand<"UserId", "out">();    // output is branded
z.string().brand<"UserId", "in">();     // input is branded
z.string().brand<"UserId", "inout">();  // both are branded

Type predicates on `.refine()` (#5575)

The .refine() method now supports type predicates to narrow the output type:

const schema = z.string().refine((s): s is "a" => s === "a");

type Input = z.input<typeof schema>;   // string
type Output = z.output<typeof schema>; // "a"

`ZodMap` methods: `min`, `max`, `nonempty`, `size` (#5316)

ZodMap now has parity with ZodSet and ZodArray:

const schema = z.map(z.string(), z.number())
  .min(1)
  .max(10)
  .nonempty();

schema.size; // access the size constraint

`.with()` alias for `.check()` (359c0db)

A new .with() method has been added as a more readable alias for .check(). Over time, more APIs have been added that don't qualify as "checks". The new method provides a readable alternative that doesn't muddy semantics.

z.string().with(
  z.minLength(5),
  z.toLowerCase()
);

// equivalent to:
z.string().check(
  z.minLength(5),
  z.trim(),
  z.toLowerCase()
);

`z.slugify()` transform

Transform strings into URL-friendly slugs. Works great with .with():

// Zod
z.string().slugify().parse("Hello World");           // "hello-world"

// Zod Mini
// using .with() for explicit check composition
z.string().with(z.slugify()).parse("Hello World");   // "hello-world"

`z.meta()` and `z.describe()` in Zod Mini (947b4eb)

Zod Mini now exports z.meta() and z.describe() as top-level functions for adding metadata to schemas:

import * as z from "zod/mini";

// add description
const schema = z.string().with(
  z.describe("A user's name"),
);

// add arbitrary metadata
const schema2 = z.number().with(
  z.meta({ deprecated: true })
);

New locales

Armenian (am) (#5531)
Uzbek (uz) (#5519)

import * as z from "zod";
import { uz } from "zod/locales";

z.config(uz());

Bug fixes

All of these changes fix soundness issues in Zod. As with any bug fix there's some chance of breakage if you were intentionally or unintentionally relying on this unsound behavior.

⚠️ `.pick()` and `.omit()` disallowed on object schemas containing refinements (#5317)

Using .pick() or .omit() on object schemas with refinements now throws an error. Previously, this would silently drop the refinements, leading to unexpected behavior.

const schema = z.object({
  password: z.string(),
  confirmPassword: z.string(),
}).refine(data => data.password === data.confirmPassword);

schema.pick({ password: true });
// 4.2: refinement silently dropped ⚠️
// 4.3: throws error ❌

Migration: The easiest way to migrate is to create a new schema using the shape of the old one.

const newSchema = z.object(schema.shape).pick({ ... })

⚠️ `.extend()` disallowed on refined schemas (#5317)

Similarly, .extend() now throws on schemas with refinements. Use .safeExtend() if you need to extend refined schemas.

const schema = z.object({ a: z.string() }).refine(/* ... */);

// 4.2: refinement silently dropped ⚠️
// 4.3: throws error ✅
schema.extend({ b: z.number() });
// error: object schemas containing refinements cannot be extended. use `.safeExtend()` instead.

⚠️ Stricter object masking methods (#5581)

Object masking methods (.pick(), .omit()) now validate that the keys provided actually exist in the schema:

const schema = z.object({ a: z.string() });

// 4.3: throws error for unrecognized keys
schema.pick({ nonexistent: true });
// error: unrecognized key: "nonexistent"

Additional changes

Fixed JSON Schema generation for z.iso.time with minute precision (#5557)
Fixed error details for tuples with extraneous elements (#5555)
Fixed includes method params typing to accept string | $ZodCheckIncludesParams (#5556)
Fixed numeric formats error messages to be inclusive (#5485)
Fixed implementAsync inferred type to always be a promise (#5476)
Tightened E.164 regex to require a non-zero leading digit and 7–15 digits total (#5524)
Fixed Dutch (nl) error strings (#5529)
Convert Date instances to numbers in minimum/maximum checks (#5351)
Improved numeric keys handling in z.record() (#5585)
Lazy initialization of ~standard schema property (#5363)
Functions marked as @__NO_SIDE_EFFECTS__ for better tree-shaking (#5475)
Improved metadata tracking across child-parent relationships (#5578)
Improved locale translation approach (#5584)
Dropped id uniqueness enforcement at registry level (#5574)

Configuration

📅 Schedule: Branch creation - "before 5am on monday" in timezone America/Chicago, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

vercel · 2026-01-05T10:35:44Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
rdap	Ready	Preview, Comment	Jan 5, 2026 10:35am

fix(deps): update all non-major dependencies

351571c

renovate bot merged commit afdff7c into master Jan 5, 2026
3 checks passed

renovate bot deleted the renovate/all-non-major-dependencies branch January 5, 2026 10:35

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update all non-major dependencies #22

fix(deps): update all non-major dependencies #22

Uh oh!

renovate bot commented Jan 5, 2026

Uh oh!

Uh oh!

vercel bot commented Jan 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

fix(deps): update all non-major dependencies #22

fix(deps): update all non-major dependencies #22

Uh oh!

Conversation

renovate bot commented Jan 5, 2026

Release Notes

🚀 Features

🩹 Fixes

❤️ Thank You

v10.26.2: pnpm 10.26.2

Patch Changes

Platinum Sponsors

Gold Sponsors

1.313.0

Minor Changes

1.312.0

Minor Changes

1.311.0

Minor Changes

1.310.2

Patch Changes

v19.2.3: 19.2.3 (December 11th, 2025)

React Server Components

v19.2.2: 19.2.2 (December 11th, 2025)

React Server Components

v19.2.1: 19.2.1 (December 3rd, 2025)

React Server Components

Commits:

Commits:

z.fromJSONSchema()

z.xor() — exclusive union (#​5534)

z.looseRecord() — partial record validation (#​5534)

.exactOptional() — strict optional properties (#​5589)

.apply()

.brand() cardinality

Type predicates on .refine() (#​5575)

ZodMap methods: min, max, nonempty, size (#​5316)

.with() alias for .check() (359c0db)

z.slugify() transform

z.meta() and z.describe() in Zod Mini (947b4eb)

New locales

Bug fixes

⚠️ .pick() and .omit() disallowed on object schemas containing refinements (#​5317)

⚠️ .extend() disallowed on refined schemas (#​5317)

⚠️ Stricter object masking methods (#​5581)

Additional changes

Configuration

Uh oh!

Uh oh!

vercel bot commented Jan 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`v10.26.2`: pnpm 10.26.2

`v19.2.3`: 19.2.3 (December 11th, 2025)

`v19.2.2`: 19.2.2 (December 11th, 2025)

`v19.2.1`: 19.2.1 (December 3rd, 2025)

`z.fromJSONSchema()`

`z.xor()` — exclusive union (#5534)

`z.looseRecord()` — partial record validation (#5534)

`.exactOptional()` — strict optional properties (#5589)

`.apply()`

`.brand()` cardinality

Type predicates on `.refine()` (#5575)

`ZodMap` methods: `min`, `max`, `nonempty`, `size` (#5316)

`.with()` alias for `.check()` (359c0db)

`z.slugify()` transform

`z.meta()` and `z.describe()` in Zod Mini (947b4eb)

⚠️ `.pick()` and `.omit()` disallowed on object schemas containing refinements (#5317)

⚠️ `.extend()` disallowed on refined schemas (#5317)

⚠️ Stricter object masking methods (#5581)