[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
eslint-plugin-zod (source)	4.14.2 → 5.2.2

---

Release Notes

marcalexiei/eslint-zod (eslint-plugin-zod)

v5.2.2

Compare Source

Patch Changes

• #​584 9a6810b - fix(no-dynamic-schema-value): accept a schema built from a local const and a member access on a static value, and report parse results.

• #​585 ae6d0ac - fix: report isOptional, isNullable, isInt and isFinite on a schema bound to a const.

• Updated dependencies [2f4f585, 9a6810b, ae6d0ac]:

  • @​eslint-zod/utils@6.4.0

v5.2.1

Compare Source

Patch Changes

• #​570 d5f877f - refactor: check zod name tables against zod's own declarations; no rule's behavior changes

• #​571 2908981 - fix: drop unreachable type-changing method entries; no rule's behavior changes

• Updated dependencies [d5f877f, 2908981, 13234f6]:

  • @​eslint-zod/utils@6.3.0

v5.2.0

Compare Source

Minor Changes

• #​566 020a144 - feat(consistent-import): add the default syntax (import z from 'zod')

Patch Changes

• #​566 020a144 - fix(consistent-import): the autofix no longer breaks code nor drops comments, and imports inside declare module blocks are checked on their own
• Updated dependencies [020a144, 020a144]:
  • @​eslint-zod/utils@6.2.0

v5.1.0

Compare Source

eslint is no longer needed to use this plugin.
It loads without eslint (#​539), and it no longer depends on @typescript-eslint/utils (#​560), whose required eslint and typescript peers were installed along with it.
With oxlint, nothing from ESLint has to be installed.

Minor Changes

• #​537 232da5b - feat: drop consistent-object-schema-type from the stylistic config

• #​500 5adf57a - fix: lint .mts and .cts files, and register the exported plugin in each config so it can be re-registered.

Patch Changes

• #​519 35efcbe - fix(prefer-meta-last): keep .meta() before a parse call and in its original order

• #​505 9f0c4f2 - fix: stop crashing on a factory call that shares a method's name

• #​521 f8ae012 - fix(no-optional-and-default-together): only pair the two on the same schema

• #​548 1fd9cc4 - fix: withhold more fixes that would drop a comment

• #​543 3fa944f - fix(array-style): stop reading an argument-less z.array() as the method form

• #​529 8f5efaf - fix(no-conflicting-checks): stop comparing checks across a mutating check

• #​512 16c7cc6 - fix(no-conflicting-checks): stop crashing on a zero bigint divisor

• #​522 1e998a1 - fix(require-error-message): handle shorthand, quoted and computed keys

• #​503 e283a27 - fix(consistent-import): avoid false positive and invalid fix on every import in a plain JavaScript file

• #​526 dcd1ac8 - fix(no-duplicate-schema-methods): allow methods that are meant to repeat

• #​539 6f4051c - fix: load without eslint installed

• #​524 9cbc143 - fix: withhold fixes that would drop a comment

• #​514 551b0f4 - fix(prefer-enum-over-literal-union): only accept bare z.literal() members

• #​552 e4017fd - fix: stop two fixes moving a length check ahead of a check that rewrites the value

• #​530 9fe66d9 - fix(no-dynamic-schema-value): ignore the input of a chained parse call

• #​541 4667778 - fix(consistent-object-schema-type): rename the factory in the suggestion

• #​540 46ba6f6 - fix(prefer-meta): leave a spread argument unfixed

• #​550 a6ccfa1 - fix: treat toJSONSchema(), isOptional(), isNullable() and apply() as ending a schema chain

• #​518 1d9095b - fix(prefer-tuple-over-array-length): guard the fix against unsafe rewrites

• #​516 67ce5a3 - fix: stop the top-level factory fix dropping arguments or reordering

• #​536 db50ed6 - fix: apply the shared configs to .mts and .cts files

• #​553 ff227b1 - fix(no-conflicting-checks): stop comparing across a callback check or past a mutated literal

• #​528 b9c6460 - fix(schema-error-property-style): check the refine() / custom() call itself

• #​513 9e5ad45 - fix: stop fixes unbalancing a parenthesized receiver

• #​532 69844b9 - fix(no-throw-in-refine): check every .refine() and more statement kinds

• #​560 5f3da15 - refactor: drop the @typescript-eslint/utils dependency, and with it its required eslint and typescript peers

• #​533 20381b0 - fix(no-conflicting-checks): analyse negative bounds and z.iso.*() factories

• #​517 316715e - fix: stop collapsing bounds across a type-changing method or an opaque check

• #​551 59b045e - fix: withhold the top-level factory fix for a second deprecated format or after a .check()

• #​523 f0e4b3f - fix: the trim rules leave z.partialRecord() and z.looseRecord() keys alone

• #​542 bbdfcf6 - fix(no-any-schema): only suggest renaming the any factory itself

• #​525 a13491d - fix(require-brand-type-parameter): accept a brand named by a value argument

• #​535 b81695b - fix: cover record variants, transform factory keys and .nonempty()

• #​505 9f0c4f2 - fix(no-optional-and-default-together): stop emitting a broken fix for the wrapper form

• #​554 58d32e3 - fix: the trim rules leave the key of a record built from named imports alone

• #​547 32006a3 - fix: stop judging a chain resumed after a property access by the factory before it

• #​527 0798a2b - fix(no-transform-in-record-key): read the key of the record() call itself

• #​511 070a2d5 - fix(array-style): keep an aliased namespace in the fix

• #​520 d353312 - fix: stop hoisting an object modifier over a method that overrides it

• #​538 8ee7aa6 - fix: keep tsc -b output out of the published packages

• Updated dependencies [52e42d5, 9f0c4f2, d479242, 1fd9cc4, 8f5efaf, 16c7cc6, 1e998a1, e283a27, 6f4051c, 3f2542d, 9cbc143, 551b0f4, e4017fd, 9fe66d9, 4667778, e9b2bad, a6ccfa1, 1d9095b, 67ce5a3, ff227b1, b9c6460, 9e5ad45, 69844b9, 0adfa55, 5752bec, bc110d2, 20381b0, 316715e, 59b045e, 97169bc, bbdfcf6, a13491d, b81695b, 5d0b05c, 32006a3, 0798a2b, 5f3da15, d353312, 8ee7aa6]:

  • @​eslint-zod/utils@6.1.0

v5.0.1

Compare Source

Patch Changes

• #​493 43ad93e - fix(consistent-schema-var-name): keep the suggested name camelCase when before ends in a letter, so user becomes zUser rather than zuser.

• #​492 1a9ab36 - fix(consistent-schema-var-name): ignore a parse result whose chain continues after a property access, such as .parse(input).tags.map(fn).

• Updated dependencies [43ad93e, 1a9ab36]:

  • @​eslint-zod/utils@6.0.1

v5.0.0

Compare Source

Major Changes

• #​473 353e773 - feat!: remove the deprecated no-string-schema-with-uuid rule; use prefer-top-level-string-formats instead.

• #​474 ae3ae1a - feat!: split configs into recommended, strict, stylistic and all.

Migration guide

recommended now holds only rules that catch bugs or deprecated APIs.
Nine rules left it:

• to stylistic: array-style, prefer-enum-over-literal-union, prefer-loose-object, prefer-meta, prefer-meta-last, prefer-nullish, prefer-strict-object, prefer-string-schema-with-trim
• to strict: prefer-trim-before-string-length-checks

Two rules joined it: no-conflicting-checks and no-transform-in-record-key.

To keep every rule you had, add stylistic and switch to strict:

 export default defineConfig(
-  eslintPluginZod.configs.recommended,
+  eslintPluginZod.configs.strict,
+  eslintPluginZod.configs.stylistic,
 );

Both configs also enable rules that were in no config before.
To avoid them, stay on recommended and re-enable the rules you want one by one:

{
  rules: {
    'zod/array-style': 'error',
    'zod/prefer-trim-before-string-length-checks': 'error',
  },
}

In Oxlint, spread each config's rules the same way.

• #​475 c227d7a - feat!: publish ESM only and require Node ^20.19 || ^22.12 || >=24; CommonJS configs still load the package through require(), under .default.

Patch Changes

• Updated dependencies [c227d7a]:
  • @​eslint-zod/utils@6.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	eslint-plugin-zod@​4.14.2 ⏵ 5.2.2	+1			+1

View full report