chore(deps): update npm non-major updates

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@cap-js/cds-types (source)	^0.15.0 → ^0.19.0
@sap/cds	9.7.0 → 9.9.3
@vitest/coverage-v8 (source)	3.2.4 → 3.2.7
@vitest/eslint-plugin	1.6.6 → 1.6.27
eslint (source)	9.39.2 → 9.39.5
eslint-plugin-prettier	5.5.5 → 5.5.6
typescript-eslint (source)	8.54.0 → 8.68.0
zod (source)	4.3.6 → 4.5.4

---

Release Notes

cap-js/cds-types (@​cap-js/cds-types)

v0.19.0

Compare Source

Added

• Added types for req.req and req.res in cds.Request
• cds.User now has an authInfo property typed against @sap/xssec's SecurityContext. @sap/xssec is an peer dependency.
• cds.ql is now typed as a callable universal converter: tagged template, function accepting a CQN object, or plain string — all returning SELECT<unknown>
• CXL helper functions (ref, val, expr, columns, expand, where, orderBy) are now exported from cds.ql and can be destructured from it
• cds.parse.cql, cds.run, and cds.read now accept tagged template literals
• Service.run(query) now proxies the entity type of the contained query through to the return type

Changed

• Bound action handlers now keep req.subject typed as the bound action's instance type (__self) instead of a class/ref hybrid.
• Subject-based query overloads (SELECT.from, SELECT.one.from, UPDATE, DELETE) now derive the entity class from the passed subject instance to preserve typed query results.

Deprecated

Removed

Fixed

• Types for SELECT.one includes undefined

Security

v0.18.0

Compare Source

Added

Changed

• Installing @cap-js/cds-types no longer executes a postinstall script that creates a symlink in node_modules/@types. Instead, use a paths entry in your tsconfig.json. This entry can be created by running cds add typescript in your project.

Deprecated

Removed

Fixed

Security

v0.17.0

Compare Source

Added

• Types for nested .where and .having predicates
• Passing events generated by cds-typer into service.on now offers code completion for the event's properties in the handler
• Allow all events that can be used in service.on to be used in service.once as well

Changed

• ResultHandler now returns unknown instead of void, to accommodate asynchronous functions when having @typescript-eslint/strict-void-return activated
• Documentation for cds.test.axios mentioning that @cap-js/cds-test@1 now returns an axios facade in absence of axios.
• made cds.context.locale optional
• cds.tx(ƒ) now returns the return type of ƒ

Deprecated

• cds.test.chai, cds.test.assert pointing to either cds.test.expect or a custom import of chai.
• cds.test.axios in favor of cds.test.defaults

Removed

Fixed

Security

v0.16.0

Compare Source

Added

• Added Request.messages, Request.errors and Request.results
• Types for SELECT.stream()
• service.actions

Changed

Deprecated

• service.operations
• Undocumented service.entities(), service.events(), service.types(), and service.operations()

Removed

Fixed

• Types for req.error() et al.
• Types for cds.error()
• Type for cds.middlewares.before

Security

vitest-dev/vitest (@​vitest/coverage-v8)

v3.2.7

Compare Source

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v3]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in #​10679 (b795e)

    View changes on GitHub

v3.2.6

Compare Source

v3.2.5

Compare Source

vitest-dev/eslint-plugin-vitest (@​vitest/eslint-plugin)

v1.6.27

Compare Source

   🐞 Bug Fixes

• valid-title:
  • Refine the reportEmptyTitle message  -  by @​ysknsid25 in #​941 (08973)
  • Handle missing argument in valid-title rule  -  by @​ysknsid25 in #​942 (ef700)

    View changes on GitHub

v1.6.26

Compare Source

   🐞 Bug Fixes

• Detect test modes in options objects  -  by @​Guflly in #​937 (68454)

    View changes on GitHub

v1.6.25

Compare Source

   🐞 Bug Fixes

• valid-expect: Support expect.assert members  -  by @​happykawayigt and Guan Tong in #​936 (bc37d)

    View changes on GitHub

v1.6.24

Compare Source

   🐞 Bug Fixes

• valid-expect: Fix poll and element taking 1 or 2 arguments  -  by @​julienw in #​931 (57e53)

    View changes on GitHub

v1.6.23

Compare Source

   🚀 Features

• prefer-expect-assertions: Add disallowHasAssertions option  -  by @​ssssota in #​929 (5e1e1)

   🐞 Bug Fixes

• 8 warnings for unexpected node version input  -  by @​hirehamir in #​928 (394dd)
• valid-expect: Handle static expect APIs  -  by @​w3lld1 in #​930 (79232)

    View changes on GitHub

v1.6.22

Compare Source

   🐞 Bug Fixes

• Handle expect.any separately from Chai any flag  -  by @​nami8824 in #​925 (34157)

    View changes on GitHub

v1.6.21

Compare Source

   🐞 Bug Fixes

• Support Chai-style expect chains  -  by @​nami8824 in #​920 (52692)
• prefer-called-with: Map calledOnce matcher to exact once with  -  by @​nami8824 in #​918 (8f671)

    View changes on GitHub

v1.6.20

Compare Source

   🐞 Bug Fixes

• hoisted-apis-on-top: Detect vitest.mock and aliased vi/vitest mock calls  -  by @​spokodev in #​909 (8fff9)
• require-test-timeout: Treat imported bindings as explicit timeouts  -  by @​spokodev in #​906 (bd82c)
• valid-expect: Treat .finally() as part of async assertion promise chains  -  by @​spokodev in #​908 (7c697)

    View changes on GitHub

v1.6.19

Compare Source

No significant changes

    View changes on GitHub

v1.6.18

Compare Source

   🐞 Bug Fixes

• Correct requiresTypeChecking metadata for four rules  -  by @​inglec-arista in #​905 (e06a3)

    View changes on GitHub

v1.6.17

Compare Source

   🐞 Bug Fixes

• Recommend toBeTypeOf instead of expectTypeOf in prefer-expect-type-of  -  by @​sheremet-va in #​896 (a4bcd)
• no-standalone-expect: Allow expect inside vi.defineHelper callbacks  -  by @​nami8824 in #​894 (fd8eb)

    View changes on GitHub

v1.6.16

Compare Source

   🚀 Features

• require-test-timeout: Support ancestor traversal  -  by @​hamirmahal in #​890 (8110b)

    View changes on GitHub

v1.6.15

Compare Source

What's Changed

• feat: allow same-file const variable timeouts by @​hamirmahal in #​888

Full Changelog: vitest-dev/eslint-plugin-vitest@v1.6.14...v1.6.15

v1.6.14

Compare Source

What's Changed

• chore: bump @​typescript-eslint packages to ^8.58.0 by @​null0rUndefined in #​886

New Contributors

• @​null0rUndefined made their first contribution in #​886

Full Changelog: vitest-dev/eslint-plugin-vitest@v1.6.13...v1.6.14

v1.6.13

Compare Source

   🚀 Features

• unbound-method: Re-enable rule  -  by @​FloEdelmann in #​883 (944f2)

    View changes on GitHub

v1.6.12

Compare Source

    View changes on GitHub

What's Changed

• fix: detect class/function type more reliably by @​FloEdelmann in #​882
• fix(no-alias-methods): reverse toThrow/toThrowError alias direction by @​FloEdelmann in #​881

Full Changelog: vitest-dev/eslint-plugin-vitest@v1.6.11...v1.6.12

v1.6.11

Compare Source

   🐞 Bug Fixes

• no-focused-tests: Not all chainable APIs are reported  -  by @​StyleShit in #​878 (703b0)

    View changes on GitHub

v1.6.10

Compare Source

   🚀 Features

• prefer-import-in-mock: Support doMock  -  by @​andreww2012 in #​875 (ef227)

    View changes on GitHub

v1.6.9

Compare Source

   🐞 Bug Fixes

• Correct dist entrypoints and type paths  -  by @​yyxi in #​872 (1cf79)

    View changes on GitHub

v1.6.8

Compare Source

No significant changes

    View changes on GitHub

What's Changed

• chore: bump up deps by @​veritem in #​871

Full Changelog: vitest-dev/eslint-plugin-vitest@v1.6.7...v1.6.8

v1.6.7

Compare Source

   🐞 Bug Fixes

• Fix default value propagation  -  by @​Roman3349 in #​866 (72b19)

    View changes on GitHub

eslint/eslint (eslint)

v9.39.5

Compare Source

Bug Fixes

• 253be16 fix: handle unavailable require cache (backport of #​20812 to v9.x) (#​21065) (Eric)

Documentation

• 74930ed docs: switch build to Node.js 24 (#​20894) (Milos Djermanovic)
• eaec8bb docs: Add ESLint v9.x EOL notice (#​20828) (Milos Djermanovic)

Chores

• 458205f chore: update @eslint/eslintrc and @eslint/js for v9.39.5 (#​21077) (Francesco Trotta)
• 202117b chore: package.json update for @​eslint/js release (Jenkins)
• d9eb6ed test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#​21074) (Francesco Trotta)
• 7b431a7 chore: override re2 dependency for @metascraper/helpers (#​21068) (Milos Djermanovic)
• daf7791 chore: pin fflate@​0.8.2 (#​20895) (Milos Djermanovic)
• daee8ba ci: use pnpm in eslint-flat-config-utils type integration test (#​20829) (Milos Djermanovic)
• 116d4be ci: unpin Node.js 25.x in CI (#​20619) (Copilot)

v9.39.4

Compare Source

Bug Fixes

• f18f6c8 fix: update dependency minimatch to ^3.1.5 (#​20564) (Milos Djermanovic)
• a3c868f fix: update dependency @​eslint/eslintrc to ^3.3.4 (#​20554) (Milos Djermanovic)
• 234d005 fix: minimatch security vulnerability patch for v9.x (#​20549) (Andrej Beles)
• b1b37ee fix: update ajv to 6.14.0 to address security vulnerabilities (#​20538) (루밀LuMir)

Documentation

• 4675152 docs: add deprecation notice partial (#​20520) (Milos Djermanovic)

Chores

• b8b4eb1 chore: update dependencies for ESLint v9.39.4 (#​20596) (Francesco Trotta)
• 71b2f6b chore: package.json update for @​eslint/js release (Jenkins)
• 1d16c2f ci: pin Node.js 25.6.1 (#​20563) (Milos Djermanovic)

v9.39.3

Compare Source

Bug Fixes

• 791bf8d fix: restore TypeScript 4.0 compatibility in types (#​20504) (sethamus)

Chores

• 8594a43 chore: upgrade @​eslint/js@​9.39.3 (#​20529) (Milos Djermanovic)
• 9ceef92 chore: package.json update for @​eslint/js release (Jenkins)
• af498c6 chore: ignore /docs/v9.x in link checker (#​20453) (Milos Djermanovic)

prettier/eslint-plugin-prettier (eslint-plugin-prettier)

v5.5.6

Compare Source

Patch Changes

• #​791 b5c96a3 Thanks @​JounQin! - chore: bump all (dev)Dependencies

typescript-eslint/typescript-eslint (typescript-eslint)

v8.68.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.67.0

Compare Source

🚀 Features

• typescript-eslint: export basic globs for using tseslint (#​12105)

❤️ Thank You

• Claude Sonnet 5
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨
• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.66.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.65.0

Compare Source

🚀 Features

• add warning when TS 7 is detected (#​12529)

❤️ Thank You

• Josh Goldberg ✨
• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.64.0

Compare Source

8.64.0 (2026-07-13)

🚀 Features

• support parsing import defer (#​12513)
• eslint-plugin: [no-loop-func] support using / await using declarations and deprecate the rule (#​12500)
• typescript-estree: throw for invalid definite assignment in class properties (#​12543)

🩹 Fixes

• eslint-plugin: [require-array-sort-compare] handle constrained arrays (#​12512)

❤️ Thank You

• Evyatar Daud @​StyleShit
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.63.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.1

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.62.0

Compare Source

🚀 Features

• remove redundant package.json "files" (#​12444)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.61.1

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.61.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.60.1

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.60.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.4

Compare Source

🩹 Fixes

• typescript-eslint: export Compatible* types from typescript-eslint to resolve pnpm TS error (#​12340)

❤️ Thank You

• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.3

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.2

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.1

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.59.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.58.2

Compare Source

🩹 Fixes

• remove tsbuildinfo cache file from published packages (#​12187)

❤️ Thank You

• Abhijeet Singh @​cseas

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.58.1

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.58.0

Compare Source

🚀 Features

• support TypeScript 6 (#​12124)

❤️ Thank You

• Evyatar Daud @​StyleShit

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.57.2

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.57.1

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.57.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.56.1

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.56.0

Compare Source

🚀 Features

• support ESLint v10 (#​12057)

❤️ Thank You

• Brad Zacher @​bradzacher
• Joshua Chen

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.55.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

colinhacks/zod (zod)

v4.5.4

Compare Source

Commits:

• 84e416f fix(v4): stop the cycle walk from firing a default factory (#​6500)
• e8e206f 4.5.4

v4.5.3

Compare Source

v4.5.2

Compare Source

Commits:

• a354314 fix(docs): keep blog posts out of the docs collection (#​6484)
• d378c42 ci: drop canary publishing from the release workflow (#​6487)
• 212b941 fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#​6488)
• e7576f5 docs(blog): let the page show through the navbar in dark mode (#​6489)
• fedb06f fix(docs): match the blog TOC hover bar to the 2px active indicator
• 6c932fc chore: bump devcontainer image to Node 24 (#​6470)
• 6635d9d docs(blog): soften the "method memoization" attribution
• 019ae29 fix(docs): drop ISR on the docs route so the home page hydrates
• 652bb43 chore(docs): drop the scroll log from the route-change scroller
• 571c8e8 fix(docs): render blog tabs with the stock fumadocs tab card
• 9a193aa 4.5.2

v4.5.1

Compare Source

Commits:

• 2e862db ci: gate the GitHub release and JSR publish on the version being live on npm
• 8e03380 4.5.1

v4.5.0

Compare Source

Zod 4.5 is now available.

npm install zod@latest

At a glance:

• z.compile() — the flagship feature of Zod 4.5
• z.creditCard() — 12–19 digits plus Luhn checksum
• z.properties() — the multi-property counterpart to z.property()
• z.deepPartial()/.exactPartial()
• z.validate(): boolean — a fast-path to verify input validity without a full parse (up to 16x faster on invalid data)
• 9x reduction in memory footprint
• New locales: Bengali (bn), Central Kurdish (ckb), Hindi (hi), Kannada (kn), Norwegian Nynorsk (nn), Brazilian Portuguese (pt-BR), Slovak (sk), Turkmen (tk)

z.compile()

You can now pre-compile any Zod schema using z.compile(schema). This dramatically speeds up parsing performance.

import * as z from "zod";

const Player = z.object({
  username: z.string(),
  bio: z.string(),
  xp: z.number()
});

const CompiledPlayer = z.compile(Player);

A compiled schema can be used exactly like an uncompiled one. There are no special rules around compiled schemas. They're just faster.

Player.parse({ ... });
CompiledPlayer.parse({ ... }); // ~2x faster

On objects, arrays, and unions, this speeds up parsing by a factor of ~3–7. More complex schemas stand to benefit more than simpler ones.

Time per parse by schema type, standard parser vs compiled — lower is better (benchmark)

Below are the Moltar benchmark results comparing Zod (compiled and uncompiled) against the Moltar ParseSafe bench.

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.