Skip to content

chore(deps): bump zod and expo - #373

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-d340f9053d
Closed

chore(deps): bump zod and expo#373
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-d340f9053d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown

Bumps zod to 4.6.7 and updates ancestor dependency expo. These dependencies need to be updated together.

Updates zod from 4.4.3 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

  • b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

  • 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
  • 9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales
  • 34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note
  • 74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)
  • b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors
  • 8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze
  • bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles
  • c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)
  • a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)
  • a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)
  • 529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6
  • 9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

v4.6.5

Commits:

  • d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
  • f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
  • de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
  • 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
  • ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
  • cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
  • 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
  • 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

  • d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
  • ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
  • 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
  • f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

  • 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
  • 75d63ee1 docs: show only the .properties() method form in the 4.6 post
  • 46da9572 docs: match the error-message examples to what the parsers emit

... (truncated)

Commits
  • b500a2e 4.6.7
  • 9c21983 ci: stage at verbose so a failed OIDC token exchange says why
  • 529f78d 4.6.6
  • a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
  • a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
  • c42596b release: hold the run on the release-approval environment until the staged ve...
  • bacad51 docs: square the Code for Japan logo to match the other bronze tiles
  • 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
  • b2ef983 docs: add Code for Japan to bronze sponsors
  • 74304ce release: stage npm versions instead of publishing them (#6622)
  • Additional commits viewable in compare view

Updates expo from 55.0.29 to 58.0.22

Release notes

Sourced from expo's releases.

expo@58.0.22

Patch Changes

expo-modules-jsi@58.0.21

Patch Changes

  • [iOS] Add JavaScriptFunction.call(argumentCount:emplacing:) and call(argumentCount:returning:emplacing:) to call a JavaScript function with any JavaScriptEncodable arguments, and make JavaScriptValuesBuffer.emplace(_:at:) public. (#52210 by @​tsapeta)
  • [iOS] Reduce the overhead of calling a JavaScript function that a @JS function received as a closure, when native code calls it on the JavaScript thread. (#52208 by @​tsapeta)
  • [iOS] Reduce the overhead of JavaScriptActor.assumeIsolated with a throwing closure, and of blocking JavaScriptCallback calls on the JavaScript thread. The throwing assumeIsolated now throws untyped errors. (#52210 by @​tsapeta)
  • [iOS] Reduce the overhead of converting Swift arrays of numbers, booleans, strings and optionals to JavaScript arrays, by encoding each element straight into the array's buffer with JavaScriptEncodable.encode(_:into:in:). (#52293 by @​tsapeta)
  • [iOS] Add encode(_:into:in:) to Array and Dictionary, which move the array or the object they create into the slot, and set dictionary entries with setProperty(_:encoding:in:). This reduces the overhead of encoding nested arrays and dictionaries, and arrays and dictionaries in record properties. (#52350 by @​tsapeta)
  • [iOS] Add JavaScriptEncodable.encode(_:into:in:), which encodes a value straight into a JavaScriptValue.Slot. Numbers, booleans, strings and optionals construct the engine value in the slot, and JavaScriptValuesBuffer.emplace(_:at:in:) uses it, which reduces the overhead of passing these values as arguments to JavaScript functions. (#52286 by @​tsapeta)
  • [iOS] Add JavaScriptRuntime.HostFunctionClosure, a host function closure that writes its result into the engine's result slot with JavaScriptEncodable.encode(_:into:in:) and receives the runtime as a parameter, with createFunction and JavaScriptObject.setProperty(_:function:) overloads for it. This reduces the overhead of returning numbers, booleans and strings from native functions. (#52328 by @​tsapeta)
  • Fix a deadlock on iOS when a JavaScript error clears the React Native scheduler queues while a task holds a promise or callback. When a promise or callback is dropped on the JavaScript thread, it now schedules the release of its state from another thread. (#51880 by @​douglowder)
  • [iOS] Add JavaScriptObject.setProperty(_:encoding:), which encodes a value in the runtime of the object with encode(_:into:in:) straight into the engine value that the property is set to, and JavaScriptValue.Slot.emplace(_:) overloads for a JavaScriptObject and a JavaScriptArray. Setting a number, a boolean or a string property this way skips the intermediate JavaScriptValue. (#52346 by @​tsapeta)
  • [iOS] Create the standalone Hermes runtime (JavaScriptRuntime()) with the microtask queue and GC config of React Native's bridgeless runtime, so promise jobs go to the native microtask queue instead of running synchronously through a setImmediate shim. Add JavaScriptRuntime.drainMicrotasks(): a host of a standalone runtime calls it after each task, like React Native does. (#52254 by @​tsapeta)
  • [iOS] Add JavaScriptValue methods that convert tuples, and the arrays, optionals and dictionaries that hold them, for the code that expo-modules-macros generates: decodeTuple, encodeTuple, decodeArray, encodeArray, decodeOptional, encodeOptional, decodeDictionary and encodeDictionary. An unlabeled tuple converts to an array, and a labeled tuple to an object. The encode methods write into a JavaScriptValue.Slot. Also add JavaScriptObject.setProperty(_:encodingWith:) and JavaScriptValuesBuffer.emplace(at:encodingWith:), which encode a value straight into a slot of the property or the argument, JavaScriptValue.encoding(in:_:), which creates a value from what is written into a slot, and JavaScriptCallback.invokeBlocking(_:argumentCount:decoding:emplacing:), which decodes the result of a JavaScript function with a closure. (#52392 by @​tsapeta)
  • Rebuild precompiled iOS binaries against React Native 0.88.1. (#52404 by @​intergalacticspacehighway)

expo-sharing@58.0.21

Patch Changes

  • Updated dependencies.
    • @​expo/config-plugins@​58.0.11

expo@58.0.21

Patch Changes

... (truncated)

Changelog

Sourced from expo's changelog.

58.0.22

Patch Changes

58.0.21

Patch Changes

58.0.20

Patch Changes

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump zod and expo
41ab476 
Bumps [zod](https://github.com/colinhacks/zod) to 4.6.7 and updates ancestor dependency [expo](https://github.com/expo/expo/tree/HEAD/packages/expo). These dependencies need to be updated together.


Updates `zod` from 4.4.3 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.6.7)

Updates `expo` from 55.0.29 to 58.0.22
- [Release notes](https://github.com/expo/expo/releases)
- [Changelog](https://github.com/expo/expo/blob/expo@58.0.22/packages/expo/CHANGELOG.md)
- [Commits](https://github.com/expo/expo/commits/expo@58.0.22/packages/expo)

---
updated-dependencies:
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: indirect
- dependency-name: expo
  dependency-version: 58.0.22
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 2, 2026
@github-actions

github-actions Bot commented Nov 2, 2026

Copy link
Copy Markdown

🔀 Mergeability-Report

✅ Konfliktfrei mergebar (blocked).
⚠️ Ziel-Branch main – laut Policy gehen Feature-PRs gegen testing, nicht direkt gegen main.

CI-Checks: ✅ keine fehlgeschlagenen Checks

⏭️ pr-review
⏭️ pr-review
✅ dev-standards-audit / dev-standards-audit
⏳ gitignore-audit / gitignore-audit
✅ security-scan / security-scan
⏳ mergeability / mergeability
⏳ 🔍 Code Quality & Linting
⏳ 🔒 Security Audit
⏳ 🔐 Docs Privacy Check
✅ 🔧 Platform Compatibility
⏳ 🔑 Keystore & Credential Scan

Merge-Checkliste

  • CI-Checks grün
  • Keine Merge-Konflikte
  • Ziel-Branch korrekt
  • (Optional) tiefes KI-Review via /review aus Claude Code (Pro-Abo, ohne API-Kosten)

Kostenlos generiert von reusable-mergeability.yml · keine API-Kosten · review-gate: success

@S540d S540d mentioned this pull request Nov 3, 2026
Merged
2 of 5 tasks
@S540d

S540d commented Nov 3, 2026

Copy link
Copy Markdown
Owner

Überholt: zod-Advisory ist auf testing adressiert (1e653e6, Allowlist für zod@3 via @expo/cli) und kommt mit Release-PR #375 nach main.

@S540d S540d closed this Nov 3, 2026
@dependabot @github

dependabot Bot commented on behalf of github Nov 3, 2026

Copy link
Copy Markdown
Author

OK, I won't notify you again about this release, but will get in touch when a new version is available.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/multi-d340f9053d branch November 3, 2026 09:21
S540d added a commit that referenced this pull request Nov 3, 2026
@S540d @claude
Release v1.9.0 (versionCode 71)
bc77530 
Release-PR für **v1.9.0 / versionCode 71**: Play Store steht auf 1.8.0 /
vc69, vc70 wurde nie veröffentlicht.

> ⚠️ **Nicht mergen ohne ausdrückliche Freigabe.** Merge auf `main` löst
sofort den GitHub-Pages-Deploy aus (`deploy.yml`). Die Web-Demo geht
damit zu 100 % live, unabhängig vom gestaffelten Play-Store-Rollout.

## Inhalt

Vollständige Liste im `CHANGELOG.md` unter `[1.9.0]`. Die wichtigsten
Punkte:

**Neu:** Pause-Vorschlag alle 5 Level, Impressum/Datenschutz im
Über-Dialog (7 Sprachen), Micro-Animationen, Web-Auffindbarkeit und
Play-Store-Attribution
**Geändert:** neues App-Icon/Splash (Haus-Motiv), Design-System Blau
statt Violett, Einstellungen gruppiert, Startseite entschlackt, ruhiger
Merke-Timer, Replay- und Web-Canvas-Performance
**Behoben:** Konfetti/Abzeichen bei gleicher Sternzahl,
Darkmode-Sichtbarkeit, Galerie-Status beim Neustart, Web-Fills bei
gebrochener Canvas-Breite, PWA-Tags/Icons
**Security:** diverse `npm audit fix`, Audit-Gate mit befristeter
Allowlist

## Status vor Merge

- [x] `package.json` / `app.json`: 1.9.0, versionCode 71
- [x] Lokal: `tsc` ✅, Lint ✅, 52 Suites / 482 Tests ✅
- [ ] **Audit-Gate:** neue High-Advisories seit 2026-10-29
  - node-forge → Fix in #374 (gegen `testing`)
- decode-uri-component (GHSA-qr28-fpjm-wq7f, via expo-router →
query-string) → Entscheidung offen
- [ ] CHANGELOG-Datum `[1.9.0] - TBD` setzen
- [ ] Dependabot-PR #373 (zod/expo, gegen `main`) schließen; zod ist
bereits auf `testing` adressiert

## Nach dem Merge

1. AAB aus `main` bauen (production, vc71)
2. Play Console: Produktion, **gestaffelte Einführung 10 %**
3. Tag `v1.9.0` setzen
4. Android Vitals einige Tage beobachten, dann Anteil erhöhen

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: S540d <S540d@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
@S540d S540d mentioned this pull request Nov 3, 2026
Open
5 of 8 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@S540d