chore(deps): Bump the production-dependencies group across 1 directory with 10 updates

[dependabot]

Bumps the production-dependencies group with 10 updates in the / directory:

Package	From	To
@hono/node-server	2.1.1	2.1.4
@hono/zod-openapi	1.6.1	1.6.3
drizzle-orm	0.45.2	0.45.4
hono	4.13.5	4.13.13
marked	18.0.11	18.1.0
nanoid	6.0.1	6.0.2
pg	8.23.0	8.23.1
pino	10.3.1	10.4.0
satori	0.33.4	0.47.1
zod	4.4.3	4.6.5

Updates @hono/node-server from 2.1.1 to 2.1.4

Release notes

Sourced from @​hono/node-server's releases.

v2.1.4

What's Changed

• chore: allow hono v5 as a peer dependency by @​yusukebe in honojs/node-server#406

Full Changelog: honojs/node-server@v2.1.3...v2.1.4

v2.1.3

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in hono v4.13.11.

v2.1.2

What's Changed

• ci: add autofix.ci by @​yusukebe in honojs/node-server#392
• fix: type error in early hints and add typecheck to CI by @​BlankParticle in honojs/node-server#390
• chore: add better benchmarks by @​BlankParticle in honojs/node-server#391
• docs(readme): update the benchmark by @​yusukebe in honojs/node-server#394
• test(request): accept asynchronous body read errors by @​usualoma in honojs/node-server#403
• fix(listener): avoid mutating response headers when setting Content-Length by @​usualoma in honojs/node-server#402

Full Changelog: honojs/node-server@v2.1.1...v2.1.2

Commits

• d57ed9b 2.1.4
• 92b014c chore: allow hono v5 as a peer dependency (#406)
• 720ac78 2.1.3
• 9821792 Merge commit from fork
• 35bca95 2.1.2
• 90a2600 fix(listener): avoid mutating response headers when setting Content-Length (#...
• fe7467c test(request): accept asynchronous body read errors (#403)
• 64dc09e docs(readm): update the benchmark (#394)
• 8f505ae chore: add better benchmarks (#391)
• 2469b1a fix: type error in early hints and add typecheck to CI (#390)
• Additional commits viewable in compare view

Updates @hono/zod-openapi from 1.6.1 to 1.6.3

Release notes

Sourced from @​hono/zod-openapi's releases.

@​hono/zod-openapi@​1.6.3

Patch Changes

• #2087 3b0860026438694e76c3155737cf0b8df32384f5 Thanks @​WolfieLeader! - fix: return 415 when a JSON or form request body's Content-Type matches none of the route's declared media types, instead of validating an empty object

@​hono/zod-openapi@​1.6.2

Patch Changes

• #2115 525564dc5c275bfe8468b330902ea12dc450f54d Thanks @​scttcper! - Flatten batched route type inference so large openapiRoutes tuples do not hit TypeScript's recursive instantiation limit.

• #2116 38232db06e1c366e5eb1fb7cf6949c2541debd8c Thanks @​scttcper! - Reuse projected response types between openapi() route handlers and returned schemas to reduce TypeScript checker work.

• #1986 28f1d39cd2a480d9d3bd557df9037c054a674279 Thanks @​VihaanAgarwal! - fix(zod-openapi): infer route middleware env in defineOpenAPIRoute handler

Changelog

Sourced from @​hono/zod-openapi's changelog.

1.6.3

Patch Changes

• #2087 3b0860026438694e76c3155737cf0b8df32384f5 Thanks @​WolfieLeader! - fix: return 415 when a JSON or form request body's Content-Type matches none of the route's declared media types, instead of validating an empty object

1.6.2

Patch Changes

• #2115 525564dc5c275bfe8468b330902ea12dc450f54d Thanks @​scttcper! - Flatten batched route type inference so large openapiRoutes tuples do not hit TypeScript's recursive instantiation limit.

• #2116 38232db06e1c366e5eb1fb7cf6949c2541debd8c Thanks @​scttcper! - Reuse projected response types between openapi() route handlers and returned schemas to reduce TypeScript checker work.

• #1986 28f1d39cd2a480d9d3bd557df9037c054a674279 Thanks @​VihaanAgarwal! - fix(zod-openapi): infer route middleware env in defineOpenAPIRoute handler

Commits

• bc7d9e6 Version Packages (#2123)
• 3b08600 fix(zod-openapi): return 415 for request bodies with undeclared content type ...
• b125de5 Version Packages (#2121)
• 28f1d39 fix(zod-openapi): infer route middleware env in defineOpenAPIRoute handler (#...
• 525564d perf(zod-openapi): Flatten batched route schemas (#2115)
• 38232db perf(zod-openapi): Reuse route response projections (#2116)
• See full diff in compare view

Updates drizzle-orm from 0.45.2 to 0.45.4

Release notes

Sourced from drizzle-orm's releases.

0.45.4

• Fixed postgres-js not using prepared queries on explicit .prepare(name)

0.45.3

New Netlify DB Driver

Note: The Netlify DB driver is developed and maintained by the Netlify team.

Installation:

npm i @netlify/db

Usage example:

import { drizzle } from 'drizzle-orm/netlify-db';
// reads NETLIFY_DB_URL and NETLIFY_DB_DRIVER env vars
const db = drizzle();
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';
const db = drizzle(process.env.DATABASE_URL);
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';

// Explicit client — consumer controls the driver
const db = drizzle({ client: netlifyDbClient });

const result = await db.execute('select 1');

Commits

• eab8bed Fixed postgres-js not using prepared queries on explicit .prepare(name) (...
• 15454db +
• 54e436f exclude gel from pull
• 0fd1cc6 remove gel
• d028db7 skip gel
• 93dc01e [All-kit]: Warn when journal timestamps can cause migrations to be skipped (#...
• b786252 Merge pull request #6049 from drizzle-team/drizzle-kit-announcements
• f9fc5bf Add drizzle-kit announcement manifest and schema doc
• 9d64532 Merge pull request #6004 from drizzle-team/pin-npm-11-main
• 0af2f2e Pin the release npm self-update to major 11: the npm 12.0.0 tarball is missin...
• Additional commits viewable in compare view

Updates hono from 4.13.5 to 4.13.13

Release notes

Sourced from hono's releases.

v4.13.13

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'
const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))
const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))

What's Changed

• test(client): simulate network error for undefined route in parseResponse test in honojs/hono#5439
• docs(request): fix jsdoc comments for some getters in honojs/hono#5445
• fix(jsx): allow JSXNode function component results in honojs/hono#5476
• feat(mount): introduce Mount Middleware and deprecate app.mount in honojs/hono#5221

Full Changelog: honojs/hono@v4.13.12...v4.13.13

v4.13.12

What's Changed

• fix(build): keep internal types private in bundled d.ts and avoid a self-referencing JSX.IntrinsicElements in honojs/hono#5485
• test(build): type-check the bundled declarations from a consumer project in honojs/hono#5486
• fix(etag): correctly match mixed-case header name in retainedHeader option in honojs/hono#5475
• fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap in honojs/hono#5487
• fix(combine): return a Response from a short-circuiting middleware in some() in honojs/hono#5391
• chore(deps): upgrade vite-plus to 1.0.0 in honojs/hono#5464

Full Changelog: honojs/hono@v4.13.11...v4.13.12

v4.13.11

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: hono/serve-static and the adapters built on it (hono/bun, hono/deno, hono/cloudflare-workers, @hono/bun, @hono/deno, @hono/cloudflare-workers). Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-5r4p-p66f-jhc7

... (truncated)

Commits

• 08a023c 4.13.13
• ae595de feat(mount): introduce Mount Middleware and deprecate app.mount (#5221)
• f23b146 fix(jsx): allow JSXNode function component results (#5476)
• 6d73a74 docs(request): fix jsdoc comments for some getters (#5445)
• deff529 test(client): simulate network error for undefined route in parseResponse tes...
• 6abd35b 4.13.12
• 95eb860 chore(deps): upgrade vite-plus to 1.0.0 (#5464)
• afb2068 fix(combine): return a Response from a short-circuiting middleware in some() ...
• e5bb206 fix(jsx): add px to numeric gridGap, gridRowGap and gridColumnGap (#5487)
• c3053cc fix(etag): correctly match mixed-case header name in retainedHeader option (#...
• Additional commits viewable in compare view

Updates marked from 18.0.11 to 18.1.0

Release notes

Sourced from marked's releases.

v18.1.0

18.1.0 (2026-10-05)

Bug Fixes

• avoid cubic backtracking on unicode whitespace in a link destination (#4106) (0d20220)
• load CLI configs with top-level await (#4100) (c61543e)
• reject unbalanced parentheses in link destinations (#4107) (3363c99)

Features

• add linkParenPossible to lexer state to fail fast for link token generation (#4070) (4ee44f7)

v18.0.14

18.0.14 (2026-09-22)

Bug Fixes

• allow indented lines in setext heading text (#4095) (7d05530)
• decode numeric character references in text (#4076) (cead8de)
• keep text after empty nested blockquote (#4101) (1b89557), closes #4098
• preserve internal tabs in list item content (#4086) (e136da7)
• strip whitespace when normalizing link reference labels (#4091) (c7ee43a)
• support GFM protocol autolinks (#4067) (7f7a496)

v18.0.13

18.0.13 (2026-09-12)

Bug Fixes

• allow tabs in the thematic break that ends a list item (#4087) (afbb27c)
• avoid O(n^2) scanning in reflinkSearch (#4090) (c6a25bb)
• case fold reference link labels (#4077) (aed9336)
• drop the leading whitespace after a hard line break (#4075) (123ce04)
• match html block start conditions when ending a list item (#4072) (c2facac)
• respect raw tokens when closing link labels (#4066) (ef394f7)
• strip a tab that follows spaces in an indented code block (#4080) (dbb393d)

v18.0.12

18.0.12 (2026-09-07)

Bug Fixes

• allow a tab before the closing sequence of an ATX heading (#4084) (4417582)
• allow one more level of nested brackets in a link label (#4064) (37b28d8)

... (truncated)

Commits

• e809386 chore(release): 18.1.0 [skip ci]
• 3363c99 fix: reject unbalanced parentheses in link destinations (#4107)
• 0d20220 fix: avoid cubic backtracking on unicode whitespace in a link destination (#4...
• c18a64f chore(deps): bump undici (#4122)
• 4ee44f7 feat: add linkParenPossible to lexer state to fail fast for link token genera...
• c61543e fix: load CLI configs with top-level await (#4100)
• ef0704c chore(release): 18.0.14 [skip ci]
• 23c82ad chore: update deps (#4108)
• 1b89557 fix: keep text after empty nested blockquote (#4101)
• 7f7a496 fix: support GFM protocol autolinks (#4067)
• Additional commits viewable in compare view

Updates nanoid from 6.0.1 to 6.0.2

Release notes

Sourced from nanoid's releases.

6.0.2

• Reduced JS bundle size (by @​bayandin).
• Fixed floats in size of customRandom (by @​lost-signals).
• Fixed performance of customRandom on changes size (by @​00200200).
• Fixed docs (by @​Likio3000 & @​lenamonj).

Changelog

Sourced from nanoid's changelog.

6.0.2

• Reduced JS bundle size (by @​bayandin).
• Fixed floats in size of customRandom (by @​lost-signals).
• Fixed performance of customRandom on changes size (by @​00200200).
• Fixed docs (by @​Likio3000 & @​lenamonj).

Commits

• 3167e10 Release 6.0.2 version
• 05057d8 Reduce Nano ID size to 117 bytes (#613)
• 85f50f1 Update size limit
• 0b2cec5 Fix non-integer size in customRandom() (#616)
• ccb0e6e fix: size customRandom's byte request from the ID length (#612)
• ac313f9 Update dependencies
• 5a33c04 Backport changelog changes from v3
• bb68abc docs: fix custom generator JSDoc examples (#610)
• 57009b5 Update Size Limit
• 8041d7d Update dependencies
• Additional commits viewable in compare view

Updates pg from 8.23.0 to 8.23.1

Changelog

Sourced from pg's changelog.

All major and minor releases are briefly explained below.

For richer information consult the commit log on github with referenced pull requests.

We do not include break-fix version release in this file.

Commits

• 0980cef Publish
• 2759b2c fix(pg): run a named statement with an empty text more than once (#3781)
• 7feb7df fix(pg): expose detail and hint on errors from the native client (#3780)
• 9683053 fix(pg): do not treat Sync as connection ending (#3772)
• 4589038 fix: validate server certificate against host when connecting to an IP addres...
• 9808955 cleanup: Fix typo in comment
• 2b02f64 fix: avoid mutating query config (#3720)
• 0cef6af Reject portal based queries in pipeline mode instead of misrouting rows (#3737)
• 2991480 Deprecate serializing invalid Dates (#3731)
• c940d7c Fail pipelined queries when the connection dies instead of hanging (#3736)
• Additional commits viewable in compare view

Updates pino from 10.3.1 to 10.4.0

Release notes

Sourced from pino's releases.

v10.4.0

What's Changed

• Add warning on incompatible formatters.level with multi-target transports by @​lraveri in pinojs/pino#2381
• chore: use TSTyche for type testing by @​mrazauskas in pinojs/pino#2376
• Add Sentry Native Integration Docs by @​KyleTryon in pinojs/pino#2394
• docs: add flush limitation warning for pino-pretty, fix #1015 by @​mcollina in pinojs/pino#2402
• feat(browser): add redaction support by @​abhu85 in pinojs/pino#2396
• chore: lint the type declaration file by @​mrazauskas in pinojs/pino#2408
• chore: remove TSTyche config file by @​mrazauskas in pinojs/pino#2409
• docs: clarify multi-target formatter limitation by @​mcollina in pinojs/pino#2410
• No bots allowed by @​mcollina in pinojs/pino#2412
• build(deps): bump real-require from 0.2.0 to 1.0.0 by @​dependabot[bot] in pinojs/pino#2414
• build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 by @​dependabot[bot] in pinojs/pino#2418
• fix: use util.getCallSites when able to allow frozen intrinsics by @​CarlOlson in pinojs/pino#2294
• Update AWS Lambda reference in asynchronous docs by @​urbanautomaton in pinojs/pino#2413
• chore: update license by @​Tony133 in pinojs/pino#2375
• fix: add named default export by @​mrazauskas in pinojs/pino#2421
• Update contrib doc by @​jsumners in pinojs/pino#2424
• docs: use @​hono/structured-logger for Pino with Hono by @​brunorodmoreira in pinojs/pino#2425
• chore(deps): remove pre-commit by @​kshitijanurag in pinojs/pino#2423
• build(deps): bump actions/github-script from 8 to 9 by @​dependabot[bot] in pinojs/pino#2427
• build(deps-dev): bump eslint-plugin-promise from 6.6.0 to 7.3.0 by @​dependabot[bot] in pinojs/pino#2428
• build(deps-dev): bump tstyche from 6.2.0 to 7.1.0 by @​dependabot[bot] in pinojs/pino#2429
• test: fix flaky transport config test by @​mcollina in pinojs/pino#2434
• chore: upgrade typescript to v6.0.2 by @​Tony133 in pinojs/pino#2419
• docs: fix typo "compatability" → "compatibility" in README by @​premsreelathasugeendran in pinojs/pino#2435
• docs: warn against untrusted top-level log keys by @​mcollina in pinojs/pino#2450
• test(transport): keep event loop alive while awaiting async flush by @​YBJ0000 in pinojs/pino#2470
• docs: clarify Node.js version support policy in LTS doc by @​youdie006 in pinojs/pino#2472
• fix: honor per-target level filter on single-element targets array by @​mcollina in pinojs/pino#2432
• fix(multistream): resolve string level labels in write() by @​xianjianlf2 in pinojs/pino#2474
• fix: escape child binding keys by @​mcollina in pinojs/pino#2452
• docs: clarify stringification limits by @​mcollina in pinojs/pino#2475
• fix: add setBindings to the browser logger by @​ankit1324 in pinojs/pino#2471
• build(deps): bump actions/setup-node from 6 to 7 by @​dependabot[bot] in pinojs/pino#2486
• build(deps-dev): bump through2 from 4.0.2 to 5.0.10 by @​dependabot[bot] in pinojs/pino#2488
• build(deps-dev): bump bole from 5.0.29 to 6.0.7 by @​dependabot[bot] in pinojs/pino#2489
• build(deps-dev): bump eslint-plugin-n from 17.23.2 to 18.2.2 by @​dependabot[bot] in pinojs/pino#2492
• build(deps): bump actions/checkout from 6.0.2 to 7.0.1 by @​dependabot[bot] in pinojs/pino#2485
• fix: log objects with an own proto key instead of crashing by @​spokodev in pinojs/pino#2457
• fix: build the redaction shape without Object.prototype by @​luantaraschi in pinojs/pino#2495
• ci: add Node.js 26 to test matrix by @​aquie00t in pinojs/pino#2480
• fix(multistream): fix clone add crash and missing end/remove methods by @​spellsaif in pinojs/pino#2493
• ci: check pull requests target main by @​marktran0710 in pinojs/pino#2500
• build(deps-dev): bump docsify-cli from 4.4.4 to 5.0.0 by @​dependabot[bot] in pinojs/pino#2513
• build(deps-dev): bump eslint-plugin-n from 18.2.2 to 18.3.0 by @​dependabot[bot] in pinojs/pino#2515
• Delete .github/dependabot.yml by @​jsumners in pinojs/pino#2517
• docs: document the APIs that are unavailable in the browser by @​kavish-19 in pinojs/pino#2521
• ci: pin lock-threads to upstream v6.0.2 to fix token validation failure by @​simpleqt in pinojs/pino#2525
• Add bindings() method to browser logger by @​RT1811 in pinojs/pino#2504

... (truncated)

Commits

• b29dbe9 Bumped v10.4.0
• 6ba157b docs: fix the pino-pretty flush explanation after thread-stream#198 (#2524)
• 6429c14 docs: Note that serializers run on child bindings at creation time (#2518)
• 6c71bc9 Add bindings method to browser logger (#2504)
• b557f72 ci: pin lock-threads to upstream v6.0.2 to fix token validation failure (#2525)
• 1de1212 docs: document the APIs that are unavailable in the browser (#2521)
• af2fe10 Delete .github/dependabot.yml (#2517)
• 5aa6230 build(deps-dev): bump eslint-plugin-n from 18.2.2 to 18.3.0 (#2515)
• 6f5af07 build(deps-dev): bump docsify-cli from 4.4.4 to 5.0.0 (#2513)
• 2ffe576 ci: check pull requests target main (#2500)
• Additional commits viewable in compare view

Updates satori from 0.33.4 to 0.47.1

Release notes

Sourced from satori's releases.

0.47.1

0.47.1 (2026-10-09)

Bug Fixes

• Align text by its baseline (#873) (2bace17)
• Clamp the lines of vertical -webkit-box elements like browsers (#875) (680bbe4)
• Move tabs to the tab stops of their line (#876) (e441832)
• Only keep a character before an ellipsis at the start of a line (#874) (ca93f94)
• Show the background through transparent stops of radial gradients (#872) (b480215)

0.47.0

0.47.0 (2026-10-09)

Features

• Support backgroundBlendMode (#870) (75d20f5)
• Support textTransform: full-width and full-size-kana (#869) (d717b5a)

0.46.0

0.46.0 (2026-10-09)

Features

• Support fontKerning and fontVariant (#868) (23b8d1c)

0.45.0

0.45.0 (2026-10-09)

Features

• Support overflowWrap and wordWrap (#867) (d29185c)
• Support sizing keywords in sizes and flexBasis: content (#866) (368e18c)

0.44.3

0.44.3 (2026-10-09)

Bug Fixes

• Report the boxes of inline elements to onNodeDetected (#865) (f1fab0e)

0.44.2

0.44.2 (2026-10-09)

... (truncated)

Commits

• e441832 fix: Move tabs to the tab stops of their line (#876)
• 680bbe4 fix: Clamp the lines of vertical -webkit-box elements like browsers (#875)
• ca93f94 fix: Only keep a character before an ellipsis at the start of a line (#874)
• 2bace17 fix: Align text by its baseline (#873)
• b480215 fix: Show the background through transparent stops of radial gradients (#872)
• 75d20f5 feat: Support backgroundBlendMode (#870)
• d717b5a feat: Support textTransform: full-width and full-size-kana (#869)
• 23b8d1c feat: Support fontKerning and fontVariant (#868)
• d29185c feat: Support overflowWrap and wordWrap (#867)
• 368e18c feat: Support sizing keywords in sizes and flexBasis: content (#866)
• Additional commits viewable in compare view

Updates zod from 4.4.3 to 4.6.5

Release notes

Sourced from zod's releases.

v4.6.5

Commits:

• d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
• f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
• ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
• cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
• 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
• 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

• d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
• ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
• 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

• 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
• 75d63ee1 docs: show only the .properties() method form in the 4.6 post
• 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

• 9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585
• 0c483c58 docs: the Zod 4.6 announcement post (#6546)
• a00c3f34 docs: use Trigger.dev's brand-kit lockups for the platinum card

v4.6.1

A patch on top of 4.6.0.

• b12aa523 fix: preserve unique tags with defaulted discriminators (#6582) — closes #6577
• dd9c36fa fix(v4): defer recursive object index inference (#6580)
• 3b154992 feat(lang): add Tajik (tg) locale (#6581) by @​ismoil77
• 2efa8b80 ci: give the npm wait a real budget and drop the back-publish path (#6583)

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

... (truncated)

Commits

• 59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump
• 0f3f5ee 4.6.5
• cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, ref...
• ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed w...
• 56222cd feat(instanceof): key the .properties() shape off the instance type (#6600)
• de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• d2b135c docs: add the 4.6.x patch highlights to the 4.6 post
• 2bb0871 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• 743aedb 4.6.4
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade...

Description has been truncated