chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
deno (source)	2.7.13 → 2.7.14
zod (source)	^4.3.6 → ^4.4.1

---

Release Notes

denoland/deno (deno)

v2.7.14

Compare Source

• feat(ext/node): add fs.Utf8Stream
• feat(upgrade): delta updates via bsdiff patches (#​33274)
• fix(bundle): treat CSS same-document fragment URLs as external (#​33492)
• fix(cache): add missing CacheStorage.keys() and Cache.keys() methods (#​33275)
• fix(config): don't exclude workspace members from deploy file patterns
  (#​33562)
• fix(coverage): exclude transformer-injected helpers from coverage (#​33481)
• fix(doc): remove background from operators in dark mode code blocks (#​33267)
• fix(ext/bundle): clearer error when Deno.bundle is called in compiled binary
  (#​33503)
• fix(ext/crypto): throw TypeMismatchError for non-TypedArray in getRand
  (#​33470)
• fix(ext/fetch): don't mutate caller's options in Deno.createHttpClient
  (#​33497)
• fix(ext/fetch): use byte ReadableStream for Node Readable request bodies
  (#​33432)
• fix(ext/fs): normalize Deno.watchFs paths so events drop ./ segments (#​33490)
• fix(ext/napi): implement napi_async_init and napi_async_destroy (#​33282)
• fix(ext/net): default Deno.listenDatagram hostname to 0.0.0.0 (#​33496)
• fix(ext/node): accept X.509v1 server certs in tls.createServer (#​33505)
• fix(ext/node): accept string mode in fs.mkdir and fs.mkdirSync (#​33409)
• fix(ext/node): add Server BlockList, asyncDispose, and misc net improvements
  (#​33417)
• fix(ext/node): add _idleStart and _idleTimeout to Timeout (#​33604)
• fix(ext/node): align crypto random* validation with Node (#​33456)
• fix(ext/node): align fs.truncate / ftruncate argument validation with Node
  (#​33418)
• fix(ext/node): align module.builtinModules / getBuiltinModule with Node
  (#​33404)
• fix(ext/node): align node:module behavior with Node (#​33482)
• fix(ext/node): align node:test it/describe with Node, enable passing
  compat tests (#​33593)
• fix(ext/node): align util.styleText with Node (#​33547)
• fix(ext/node): allow https.Agent() without new, enable passing compat
  tests (#​33601)
• fix(ext/node): async fs.stat/lstat throwIfNoEntry + deprecate fs.Stats
  (#​33436)
• fix(ext/node): attach input URL to ERR_INVALID_FILE_URL_PATH (#​33398)
• fix(ext/node): attach path/syscall to fs.lstat / realpath / link errors
  (#​33446)
• fix(ext/node): brand-check SecureContext._external accessor (#​33569)
• fix(ext/node): cache hash digest so it survives stream.pipeline (#​33440)
• fix(ext/node): cancelling Readable.toWeb(req) no longer destroys the socket
  (#​33570)
• fix(ext/node): close fd on error in http2 stream respondWithFile (#​33614)
• fix(ext/node): correct buffer-length check in Readable._fromList decoder
  branch (#​33624)
• fix(ext/node): defer drain in http2 shutdownWritable so pushStream after end()
  works (#​33619)
• fix(ext/node): drain pending TLS cleartext in enc_write_cb (#​33378)
• fix(ext/node): emit Buffer for http2 'goaway' opaqueData (#​33502)
• fix(ext/node): emit DEP0031 deprecation warning for ecdh.setPublicKey(
  (#​33468)
• fix(ext/node): emit DEP0182 deprecation for short AES-GCM auth tag (#​33469)
• fix(ext/node): emit HPE_INVALID_TRANSFER_ENCODING for CL+chunked respo
  (#​33488)
• fix(ext/node): emit StatWatcher 'stop' event asynchronously (#​33448)
• fix(ext/node): emit TimeoutNaNWarning for invalid timer durations (#​33472)
• fix(ext/node): emit http2 frameError on send failure with translated HTTP/2
  error code (#​33631)
• fix(ext/node): emit stream-level PROTOCOL_ERROR in node:http2
• fix(ext/node): emit tlsClientError instead of crashing on TLS init failure
  (#​33429)
• fix(ext/node): enable test-als-defaultvalue-original (AsyncLocalStorage
  default value) (#​33464)
• fix(ext/node): encode http2 headers as Latin-1 to fix response splitting
  (#​33531)
• fix(ext/node): encode more chars in url.pathToFileURL() (#​33397)
• fix(ext/node): enforce HTTP/2 server header list size limits (#​33494)
• fix(ext/node): enforce http2 maxSessionInvalidFrames limit (#​33515)
• fix(ext/node): expose http2 sensitive headers received with NV_FLAG_NO_INDEX
  flag (#​33626)
• fix(ext/node): fix EEXIST error and data loss in writeFileSync on Windows
  (#​33413)
• fix(ext/node): fix ERR_INVALID_CHAR message & OutgoingMessage.prototype.write
  (#​33430)
• fix(ext/node): fix TLS client certificate authentication verification (#​33576)
• fix(ext/node): fix TLS socket error ordering and app data leak before identity
  verification (#​33585)
• fix(ext/node): fix TLS socket lifecycle and readStop backpressure (#​33524)
• fix(ext/node): fix closeIdleConnections destroying active connections (#​33596)
• fix(ext/node): fix fs.glob skipping siblings with */../ patterns (#​33372)
• fix(ext/node): fix spawnSync internal API for monkey-patching and killSignal
  (#​33545)
• fix(ext/node): flush GOAWAY before destroying http2 socket and expose
  internal/http2/core (#​33566)
• fix(ext/node): flush HTTP/2 client preface after settings submission (#​33387)
• fix(ext/node): forward enableConnectProtocol setting to peer in HTTP/2
  SETTINGS frame (#​33616)
• fix(ext/node): handle undefined http2 ping payload and cancel pending pings on
  destroy (#​33561)
• fix(ext/node): hide aggregateTwoErrors frame in AggregateError stack (#​33402)
• fix(ext/node): honor http2 strictFieldWhitespaceValidation option (#​33506)
• fix(ext/node): honor requestCert/ca on node:tls server, populate
  getPeerCertificate() (#​33439)
• fix(ext/node): honor weight option in http2 client.request and emit DEP0194
  (#​33622)
• fix(ext/node): http2 createConnection support and per-frame socket writes
  (#​33520)
• fix(ext/node): implement BlockList.rules / isBlockList / toJSON / fromJSON
  (#​33445)
• fix(ext/node): implement Socket.resetAndDestroy with TCP RST in node:net
  (#​33415)
• fix(ext/node): implement StatWatcher.ref() / unref() (#​33408)
• fix(ext/node): implement dns Resolver cancel() and timeout support (#​33580)
• fix(ext/node): implement dns.reverse() and fix dns.lookup() family parameter
  (#​33579)
• fix(ext/node): implement fs.mkdtempDisposableSync /
  fsPromises.mkdtempDisposable (#​33533)
• fix(ext/node): implement node:cluster fork/Worker and worker-side detection
  (#​33493)
• fix(ext/node): implement process.debugPort with ToInt32 coercion (#​33403)
• fix(ext/node): import kIncomingMessage/kServerResponse in http2 allowHTTP1
  fallback (#​33435)
• fix(ext/node): improve Node.js timer compatibility (#​33479)
• fix(ext/node): improve perf_hooks timerify and add missing exports (#​33581)
• fix(ext/node): include accepted values in Console colorMode error (#​33424)
• fix(ext/node): isolate parentPort from globalThis in worker_threads (#​32596)
• fix(ext/node): make Buffer.prototype methods generic-callable (#​33466)
• fix(ext/node): make http2 session.origin() round-trip origins and respect TLS
  servername (#​33629)
• fix(ext/node): make process.constructor a proper instanceof check (#​33447)
• fix(ext/node): name custom-promisified functions after their originals
  (#​33407)
• fix(ext/node): null-proto child_process options to block prototype pollution
  (#​33555)
• fix(ext/node): pass reusePort flags in Server.listen() without host (#​33530)
• fix(ext/node): pass signal name to process signal handlers (#​33425)
• fix(ext/node): pass stream fd to child process stdio instead of inheriting
  (#​33525)
• fix(ext/node): plumb llhttp error code, reason, and bytes parsed through
  HTTPParser (#​33591)
• fix(ext/node): prevent duplicate close emit when http2 client socket i
  (#​33538)
• fix(ext/node): re-arm Windows named pipe server after accept (#​33369)
• fix(ext/node): rebind http2 state buffers post-snapshot, enforce
  maxHeaderListPairs (#​33495)
• fix(ext/node): reject non-ArrayBufferView data in fs.writeFileSync (#​33406)
• fix(ext/node): rename _destroySsl to _destroySSL to match Node.js API (#​33599)
• fix(ext/node): replace unwrap with error propagation in parallel cp (#​33396)
• fix(ext/node): return relative path from fs.watch with recursive option
  (#​33428)
• fix(ext/node): strip trailing dot from SRV target in dns.resolveSrv() (#​33578)
• fix(ext/node): submit http2 RST_STREAM before flushing END_STREAM DATA frame
  on respondWithFD read (#​33633)
• fix(ext/node): support ALPNCallback in http2.createSecureServer (#​33521)
• fix(ext/node): support BlockList, AbortSignal, and constructor options in
  node:net Socket (#​33414)
• fix(ext/node): support ignore option in fs.watch and fs.promises.watch
  (#​33610)
• fix(ext/node): support encoding option in fs.readdir; don't double-call glob
  callback (#​33501)
• fix(ext/node): support http2 pushStream and client push events (#​33516)
• fix(ext/node): support reusePort option and fix bind/pipe handling in node:net
  (#​33416)
• fix(ext/node): support util.promisify on http2.connect (#​33489)
• fix(ext/node): support v1 X.509 certs and http2 ALPN fallback (#​33510)
• fix(ext/node): throw ERR_INVALID_ARG_VALUE when rmdir gets options.recursive
  (#​33565)
• fix(ext/node): throw ERR_INVALID_URL from http/https request string URL
  (#​33427)
• fix(ext/node): throw TypeError for Symbol keys/values in process.env (#​33399)
• fix(ext/node): timer _destroyed flag, Symbol.dispose, and setInterval abort
  (#​33528)
• fix(ext/node): track http2 custom settings and SETTINGS ACK callbacks (#​33518)
• fix(ext/node): treat unsolicited HTTP/2 PING ACK as connection-level protocol
  error (#​33625)
• fix(ext/node): use AbortSignal.addEventListener in addAbortListener (#​33557)
• fix(ext/node): use ERR_INVALID_ARG_TYPE for tls.createServer non-object
  options (#​33589)
• fix(ext/node): use ERR_INVALID_ARG_VALUE in module.createRequire (#​33449)
• fix(ext/node): use Node's address-type check in dgram Socket.send (#​33420)
• fix(ext/node): use node:timers for http server connection checks, expo
  (#​33483)
• fix(ext/node): use proper error codes for require() invalid arguments (#​33609)
• fix(ext/node): validate fs.watch boolean options (#​33627)
• fix(ext/node): validate boolean arg in process.setSourceMapsEnabled (#​33473)
• fix(ext/node): validate ciphers option in tls.createSecureContext() (#​33597)
• fix(ext/node): validate dgram options.recvBufferSize / sendBufferSize (#​33444)
• fix(ext/node): validate oaepHash in publicEncrypt/privateDecrypt (#​33388)
• fix(ext/node): validate options.type in Readable.toWeb (#​33560)
• fix(ext/node): validate process.chdir argument is a string (#​33401)
• fix(ext/node): walk sandbox prototype chain in vm property_query (#​33463)
• fix(ext/node): wire JSStreamSocket handle write/shutdown for http2 (#​33526)
• fix(ext/node): wire up captureRejection handler for http2 servers (#​33542)
• fix(ext/node): yield to I/O in http2 write path so stream pipeline finishes
  (#​33541)
• fix(ext/web): align AbortSignal.timeout error message with Node (#​33460)
• fix(ext/web): allow transferring non-serializable types in structuredClone
  (#​33491)
• fix(ext/web): handle late write racing with TransformStream cancel (#​33478)
• fix(ext/web): narrow ReadableStreamBYOBRequest.view to Uint8Array (#​33477)
• fix(ext/web): retain source from MessageEventInit (#​33500)
• fix(ext/web): route console.dirxml through the log printer (#​33443)
• fix(ext/web): set ERR_MISSING_ARGS code on URL.revokeObjectURL no-arg (#​33471)
• fix(ext/web): structuredClone of non-serializable Web types throws
  DataCloneError (#​33465)
• fix(ext/webidl): set ERR_ILLEGAL_CONSTRUCTOR code on illegal constructor calls
  (#​33535)
• fix(ext/webidl): set ERR_INVALID_THIS code on brand-check TypeError (#​33467)
• fix(node/buffer): fix panic in transcode with odd-length UTF-16LE input
  (#​33390)
• fix(node/compat): disable flaky test-child-process-exec-kill-throws on Windows
  (#​33426)
• fix(node/compat): disable flaky test-fs-read-stream-pos on Windows (#​33421)
• fix(node/compat): fix shard report merging and fetching in CI reporting
  (#​33431)
• fix(permissions): normalize paths for macOS filesystem comparison (#​33451)
• fix(task): match workspace directory name in --filter (#​33499)
• fix(task): use explicit workspace root check in directory-name fallback
  (#​33540)
• fix(x): forward --unstable-* flags to JSR and URL targets (#​33450)
• fix: bound fs.readFile on non-terminating sources (#​33262)
• fix: drop config-only unstable features from unstable_args() (#​33452)
• fix: match single-char wildcard segments in npm package imports (#​33513)
• perf(ext/node): pool 64KB read buffers to reduce allocation pressure (#​33395)
• perf: optimize worker and MessagePort message passing (#​32657)
• perf: upgrade rusty_v8 to 147.4.0 (#​33422)

colinhacks/zod (zod)

v4.4.1

Compare Source

v4.4.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "after 2am and before 3am"
• Automerge
  • "after 1am and before 2am"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nitro.build	Ready	Preview, Comment	May 1, 2026 4:28pm

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/nitro@4235

commit: e57d48e