chore(deps): bump the production group with 4 updates

[dependabot]

Bumps the production group with 4 updates: @oxlint/plugins, @types/bun, @types/node and zod.

Updates @oxlint/plugins from 1.81.0 to 1.83.0

Release notes

Sourced from @​oxlint/plugins's releases.

oxlint v1.83.0 & oxfmt v0.68.0

Table of Contents

• Oxlint v1.83.0
• Oxfmt v0.68.0

Oxlint v1.83.0

🚀 Features

• afe950d linter/react: Update lint rules to accomodate changes in React 19.3 (#26571) (Connor Shea)

🐛 Bug Fixes

• fb87ed7 linter/unicorn/prefer-array-flat-map: Report .filter().flatMap() chains (#26626) (camc314)
• 336b654 linter/unicorn/prefer-at: Report single-character substring calls (#26623) (camc314)
• a5bba6d linter/eslint/no-unused-vars: Respect rest params after-used option (#26579) (Bartok)
• c1470a2 linter/eslint/no-unused-vars: Preserve ambient implicit exports (#26582) (Dex Hunter)
• 9a469d2 linter/unicorn/prefer-global-this: Preserve window event method references (#26611) (Dex Hunter)
• aaff758 linter/unicorn/prefer-default-parameters: Report violation for ??= and ||= (#26607) (Bartok)
• 2bed25a linter/unicorn/prefer-array-flat: Skip plain concat normalization (#26604) (im10furry)
• 72bc7f2 oxlint: Replace backlashes path for "no js runtime" diagnostic (#26599) (Sysix)
• 1aa5ec1 linter/typescript/prefer-for-of: Handle computed collections (#26584) (camc314)
• 1e90019 linter/typescript: Mark no-unnecessary-type-parameters and prefer-find suggestions as implemented (#26586) (Mikhail Baev)
• 4231536 linter: Compare label text in runtime optimization assertion (#26526) (camc314)
• 36d5534 linter: Include file path in diagnostic assertion (#26525) (camc314)
• 31508b1 parser: Reject return types on constructor overloads (#26523) (camc314)

⚡ Performance

• 1d681b0 linter/react/jsx-pascal-case: Avoid temporary name segment vector (#26531) (camc314)
• 2ad7d49 linter/promise/catch-or-return: Avoid temporary formatting vectors (#26505) (camc314)
• 203235b linter/jsx-a11y/no-static-element-interactions: Avoid role vector (#26504) (camc314)
• 2e95167 linter/jsx-a11y/anchor-is-valid: Avoid temporary attribute vector (#26501) (camc314)
• deafdba linter/react/exhaustive-deps: Avoid temporary dependency vector (#26502) (camc314)
• 4f1627f linter/oxc/branches-sharing-code: Compute deletion spans lazily (#26500) (camc314)
• c068fd2 linter/react/jsx-curly-brace-presence: Avoid newline position allocation (#26499) (camc314)
• ed4357c linter/eslint/no-restricted-properties: Skip empty configurations (#26497) (camc314)
• 92e41b7 linter/oxc/no-barrel-file: Iterate module requests directly (#26498) (camc314)
• 5255ee3 linter/unicorn/prefer-single-call: Avoid temporary argument vector (#26494) (camc314)
• 96ef365 linter/unicorn/prefer-includes: Reduce suggestion allocations (#26492) (camc314)
• a71fd7f linter/unicorn/no-new-buffer: Avoid temporary argument vector (#26491) (camc314)
• 11085e7 linter/jsdoc/require-yields: Short-circuit JSDoc checks (#26488) (camc314)
• 9b1aff8 linter/unicorn/no-useless-undefined: Skip calls without trailing undefined (#26481) (camc314)
• 1e5d5d7 linter/eslint/no-unused-vars: Skip absent global declaration checks (#26457) (camc314)
• 403f899 linter/eslint/no-undef: Check globals once per unresolved name (#26456) (camc314)
• 118adb0 linter/eslint/no-restricted-imports: Avoid redundant import scans (#26455) (camc314)
• ab848f2 linter/eslint/no-useless-assignment: Skip tracking exported symbols (#26449) (camc314)
• 1b6e409 linter/unicorn/prefer-object-from-entries: Avoid allocating configured paths (#26448) (camc314)
• 2206875 linter/eslint/new-cap: Avoid unnecessary callee name allocations (#26447) (camc314)

... (truncated)

Commits

• 7bf68f7 release(apps): oxlint v1.83.0 && oxfmt v0.68.0 (#26631)
• b4da00b release(apps): oxlint v1.82.0 && oxfmt v0.67.0 (#26384)
• See full diff in compare view

Updates @types/bun from 1.4.0 to 1.4.2

Commits

• See full diff in compare view

Updates @types/node from 26.4.1 to 26.6.1

Commits

• See full diff in compare view

Updates zod from 4.5.4 to 4.6.5

Release notes

Sourced from zod's releases.

v4.6.5

Commits:

• d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
• f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
• ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
• cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
• 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
• 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

• d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
• ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
• 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

• 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
• 75d63ee1 docs: show only the .properties() method form in the 4.6 post
• 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

• 9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585
• 0c483c58 docs: the Zod 4.6 announcement post (#6546)
• a00c3f34 docs: use Trigger.dev's brand-kit lockups for the platinum card

v4.6.1

A patch on top of 4.6.0.

• b12aa523 fix: preserve unique tags with defaulted discriminators (#6582) — closes #6577
• dd9c36fa fix(v4): defer recursive object index inference (#6580)
• 3b154992 feat(lang): add Tajik (tg) locale (#6581) by @​ismoil77
• 2efa8b80 ci: give the npm wait a real budget and drop the back-publish path (#6583)

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

... (truncated)

Commits

• 59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump
• 0f3f5ee 4.6.5
• cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, ref...
• ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed w...
• 56222cd feat(instanceof): key the .properties() shape off the instance type (#6600)
• de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• d2b135c docs: add the 4.6.x patch highlights to the 4.6 post
• 2bb0871 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• 743aedb 4.6.4
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: a603f847-9778-4c79-8e95-c6d9f944b77c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Benchmark comparison

Benchmark results were unavailable or failed validation. No speed comparison is claimed.
Workflow run and raw results

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.