chore(deps): bump the production-minor-patch group across 1 directory with 2 updates

[dependabot]

Bumps the production-minor-patch group with 2 updates in the / directory: @o3co/ts.hocon and zod.

Updates @o3co/ts.hocon from 1.8.0 to 1.13.0

Release notes

Sourced from @​o3co/ts.hocon's releases.

v1.13.0

Added

• adapters/json5 — JSON5 1.0.0 ingestion (spec F3.3). A new @o3co/ts.hocon/adapters/json5 subpath exporting parseJson5, a port of go.hocon's adapters/json5 shipping in lockstep with it (go.hocon#193) and with the py.hocon / rs.hocon ports. The accepted grammar is JSON5 1.0.0 as defined by the reference implementation (the json5 npm package, the dialect owner) — but JSON5 changes the token grammar itself (unquoted identifier keys, single-quoted strings with line continuations, hex integers, leading and trailing decimal points, an explicit plus sign), so unlike the jsonc adapter this is a hand-rolled scanner and recursive-descent parser. Zero new dependencies. Where the mapping spec is stricter than JSON5, the spec wins: integers — decimal or hex — must fit in int64, carried past 2^53 as lossless digits (F0.5); Infinity/NaN in every spelling are errors (F0.6); an unpaired \uXXXX surrogate escape is an error and a valid pair combines (F3.5 — the scanner is ours here, so unlike adapters/jsonc the four implementations agree; a raw lone surrogate code unit in source is still host string data); duplicate keys follow HOCON semantics — objects merge, otherwise last-wins (F0.7); and exactly one top-level value with a strict EOF check (the F3.2 strictness rule). A // comment ends at LS/PS as well as LF/CR — deliberately different from the jsonc dialect, whose owner ends comments at LF/CR only.
• Config.renderHocon() — HOCON emitter (E18): renders a resolved, data-only Config back to HOCON text. The correctness contract is the round trip — parseString(cfg.renderHocon()) yields the same value tree — not byte-for-byte formatting: a string is quoted whenever leaving it bare would re-parse as another type ("8080", keyword look-alikes such as no/on, ${…} look-alikes), numbers / booleans / null emit raw, and a multi-line string is triple-quoted only when that is lossless (no CR, no embedded """, no trailing "). An unresolved Config throws ConfigError — a substitution has no textual round trip through a value tree. Lockstep with go.hocon v1.11.0 RenderHOCON and the py.hocon / rs.hocon ports; verified against the shared xx.hocon emitter-roundtrip corpus (rt01–rt10, synced by make testdata).

Fixed

• BREAKING (spec fix, S21.2–S21.4): byte units now match the Lightbend reference exactly. The kilo-decimal spelling is kB — KB, kb and every other case variant the old case-insensitive fallback accepted (Megabytes, mB, kiB, …) are now errors, matching typesafe-config's case-sensitive table (probe 2026-08-18). The table also extends through PB–YB, Pi/PiB–Yi/YiB (+ long forms) and single-letter Z/z/ Y/y; magnitudes at or above 2^53 bytes still raise the documented overflow guard. Part of the four-impl units audit.
• getDuration now accepts the bare nano/nanos, micro/micros, and milli/millis unit aliases (S19.1–S19.3) — part of the spec's unit lists

... (truncated)

Changelog

Sourced from @​o3co/ts.hocon's changelog.

[1.13.0] - 2026-08-19

Added

• adapters/json5 — JSON5 1.0.0 ingestion (spec F3.3). A new @o3co/ts.hocon/adapters/json5 subpath exporting parseJson5, a port of go.hocon's adapters/json5 shipping in lockstep with it (go.hocon#193) and with the py.hocon / rs.hocon ports. The accepted grammar is JSON5 1.0.0 as defined by the reference implementation (the json5 npm package, the dialect owner) — but JSON5 changes the token grammar itself (unquoted identifier keys, single-quoted strings with line continuations, hex integers, leading and trailing decimal points, an explicit plus sign), so unlike the jsonc adapter this is a hand-rolled scanner and recursive-descent parser. Zero new dependencies. Where the mapping spec is stricter than JSON5, the spec wins: integers — decimal or hex — must fit in int64, carried past 2^53 as lossless digits (F0.5); Infinity/NaN in every spelling are errors (F0.6); an unpaired \uXXXX surrogate escape is an error and a valid pair combines (F3.5 — the scanner is ours here, so unlike adapters/jsonc the four implementations agree; a raw lone surrogate code unit in source is still host string data); duplicate keys follow HOCON semantics — objects merge, otherwise last-wins (F0.7); and exactly one top-level value with a strict EOF check (the F3.2 strictness rule). A // comment ends at LS/PS as well as LF/CR — deliberately different from the jsonc dialect, whose owner ends comments at LF/CR only.
• Config.renderHocon() — HOCON emitter (E18): renders a resolved, data-only Config back to HOCON text. The correctness contract is the round trip — parseString(cfg.renderHocon()) yields the same value tree — not byte-for-byte formatting: a string is quoted whenever leaving it bare would re-parse as another type ("8080", keyword look-alikes such as no/on, ${…} look-alikes), numbers / booleans / null emit raw, and a multi-line string is triple-quoted only when that is lossless (no CR, no embedded """, no trailing "). An unresolved Config throws ConfigError — a substitution has no textual round trip through a value tree. Lockstep with go.hocon v1.11.0 RenderHOCON and the py.hocon / rs.hocon ports; verified against the shared xx.hocon emitter-roundtrip corpus (rt01–rt10, synced by make testdata).

Fixed

• BREAKING (spec fix, S21.2–S21.4): byte units now match the Lightbend reference exactly. The kilo-decimal spelling is kB — KB, kb and every other case variant the old case-insensitive fallback accepted (Megabytes, mB, kiB, …) are now errors, matching typesafe-config's case-sensitive table (probe 2026-08-18). The table also extends through PB–YB, Pi/PiB–Yi/YiB (+ long forms) and single-letter Z/z/ Y/y; magnitudes at or above 2^53 bytes still raise the documented overflow guard. Part of the four-impl units audit.
• getDuration now accepts the bare nano/nanos, micro/micros, and milli/millis unit aliases (S19.1–S19.3) — part of the spec's unit lists

... (truncated)

Commits

• 0a14cc9 chore(release): 1.13.0
• f7468f7 fix(render-hocon): Copilot review 対応 — include key の quoting / fileURLToPath ...
• 0af0df2 feat(config): renderHocon — E18 emitter の ts port (round-trip contract)
• b380e8f test(json5): codecov patch 対応 — 移植 battery が逃していた分岐を pin
• d05909c fix(json5): Copilot review 対応 — -0x0 の符号保持 (BigInt は -0 を持てない)
• 64000ed feat(adapters): json5 — JSON5 1.0.0 ingestion、手書き scanner で依存ゼロ (F3.3)
• 68837af docs,test: Copilot review 対応 — toThrow(ConfigError) 明示 + S21.4 の stale note 更新
• 96f3c61 fix(s19,s21): unit table を Lightbend に完全整合 — kB case / PB-YB / bare alias
• 61c9e13 fix(s9.2,s13.12): Lightbend conformance — triple-quote 先頭改行保持 + array 要素の und...
• 806327c test(s13a12): 誤って上書きした fold-self-ref-unit を復元し S13a.12 unit テストを統合
• Additional commits viewable in compare view

Updates zod from 4.4.3 to 4.5.2

Release notes

Sourced from zod's releases.

v4.5.2

Commits:

• a354314ac04fdd5484aa62dd5c3a4b553211a0e4 fix(docs): keep blog posts out of the docs collection (#6484)
• d378c42aff6869f0929058a7923cd775880f5c4c ci: drop canary publishing from the release workflow (#6487)
• 212b941791e7faae078e17645eb612824fd8f79a fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#6488)
• e7576f542a7bc7ef3cc5eeec237714fd0e6b6e98 docs(blog): let the page show through the navbar in dark mode (#6489)
• fedb06fafe33a66ce0b5c236ad2557e0a5a170fe fix(docs): match the blog TOC hover bar to the 2px active indicator
• 6c932fcb2eea6eb671710ea058ca9fdc382ada89 chore: bump devcontainer image to Node 24 (#6470)
• 6635d9dd367a664109de83c021995821f48efa29 docs(blog): soften the "method memoization" attribution
• 019ae299cc75daa132bf1acf59086a520abf6b85 fix(docs): drop ISR on the docs route so the home page hydrates
• 652bb438aa4c626c1cd7948c6849c4691239fca7 chore(docs): drop the scroll log from the route-change scroller
• 571c8e8a3d73b4305f4abfdd6977773cc12f2bf5 fix(docs): render blog tabs with the stock fumadocs tab card
• 9a193aa24b4efa3b315b91d4c56c8bc385b8513f 4.5.2

v4.5.1

Commits:

• 2e862dbf89da2835e5206a8fd3d3be61afe3cf7f ci: gate the GitHub release and JSR publish on the version being live on npm
• 8e03380510db36fa6fda979fc78a375fdea8021c 4.5.1

v4.5.0

Zod 4.5 is now available.

npm install zod@latest

At a glance:

• https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADmhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADmhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — the flagship feature of Zod 4.5
• https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADChttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — 12–19 digits plus Luhn checksum
• https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADshttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADshttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — the multi-property counterpart to z.property()
• https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADPhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD/https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADxhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADPhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADxhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD
• https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADvhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD:https://github.com/colinhacks/zod/blob/HEAD https://github.com/colinhacks/zod/blob/HEADbhttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADnhttps://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADvhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — a fast-path to verify input validity without a full parse (up to 16x faster on invalid data)
• 9x reduction in memory footprint
• New locales: Bengali (bn), Central Kurdish (ckb), Hindi (hi), Kannada (kn), Norwegian Nynorsk (nn), Brazilian Portuguese (pt-BR), Slovak (sk), Turkmen (tk)

z.compile()

You can now pre-compile any Zod schema using z.compile(schema). This dramatically speeds up parsing performance.

import * as z from "zod";
const Player = z.object({
username: z.string(),
bio: z.string(),
xp: z.number(),
// ...20 more properties...
</tr></table>

... (truncated)

Commits

• 9a193aa 4.5.2
• 571c8e8 fix(docs): render blog tabs with the stock fumadocs tab card
• 652bb43 chore(docs): drop the scroll log from the route-change scroller
• 019ae29 fix(docs): drop ISR on the docs route so the home page hydrates
• 6635d9d docs(blog): soften the "method memoization" attribution
• 6c932fc chore: bump devcontainer image to Node 24 (#6470)
• fedb06f fix(docs): match the blog TOC hover bar to the 2px active indicator
• e7576f5 docs(blog): let the page show through the navbar in dark mode (#6489)
• 212b941 fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (...
• d378c42 ci: drop canary publishing from the release workflow (#6487)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions