chore: add security policy and refresh tooling deps

.github/workflows/test.yml

@@ -9,6 +9,9 @@ on:
       - main
       - v4
 
+permissions:
+  contents: read
+
 jobs:
   test-node:
     runs-on: ${{ matrix.os }}

SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please report suspected security vulnerabilities privately through GitHub Security Advisories:
+
+https://github.com/colinhacks/zod/security/advisories/new
+
+Do not open a public issue for a suspected vulnerability. Include enough detail to reproduce the issue, the affected version or commit, and any known mitigations.
+
+Security fixes are published in the latest release line. Older major versions may receive fixes at maintainer discretion.

package.json

@@ -16,9 +16,8 @@
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "^0.17.4",
-    "madge": "^8.0.0",
     "@biomejs/biome": "^1.9.4",
-    "@seriousme/openapi-schema-validator": "2.5.0",
+    "@seriousme/openapi-schema-validator": "2.9.0",
     "@types/benchmark": "^2.1.5",
     "@types/semver": "^7.7.0",
     "@web-std/file": "^3.0.3",
@@ -28,24 +27,26 @@
     "console-table-printer": "^2.12.1",
     "esbuild": "^0.25.5",
     "execa": "^9.5.2",
-    "globby": "^14.1.0",
+    "globby": "^16.2.0",
     "husky": "^9.1.7",
     "jsr": "^0.12.4",
-    "lint-staged": "^16.1.0",
+    "lint-staged": "^16.4.0",
+    "madge": "^8.0.0",
     "mitata": "^0.1.14",
     "prettier": "^3.5.3",
     "recheck": "^4.5.0",
     "rolldown": "1.0.0-beta.18",
-    "rollup": "^4.39.0",
+    "rollup": "^4.60.2",
     "semver": "^7.7.2",
     "supershy": "^1.0.0",
     "tinybench": "^2.9.0",
-    "ts-morph": "^14.0.0",
+    "ts-morph": "^28.0.0",
-    "tsdown": "^0.12.8",
+    "tsdown": "^0.21.10",
     "tslib": "^2.8.1",
     "tsx": "^4.19.3",
     "typescript": "~5.5.4",
-    "vitest": "^4.0.10",
+    "vite": "^7.3.2",
+    "vitest": "^4.1.5",
     "zod": "workspace:*",
     "zod3": "npm:zod@~3.24.0",
     "zshy": "^0.7.2"

packages/bench/package.json

@@ -3,12 +3,12 @@
   "private": true,
   "type": "module",
   "devDependencies": {
+    "@types/node": "^22.10.5",
     "arktype": "^2.1.19",
-    "valibot": "^1.0.0",
+    "valibot": "^1.3.1",
     "zod": "workspace:*",
     "zod3": "npm:zod@~3.24.0",
-    "zod4": "npm:[email protected]",
+    "zod4": "npm:[email protected]"
-    "@types/node": "^22.10.5"
   },
   "scripts": {
     "bench": "tsx --conditions @zod/source index.ts"

packages/docs/package.json

@@ -9,7 +9,7 @@
     "postinstall": "fumadocs-mdx"
   },
   "dependencies": {
-    "@inkeep/cxkit-react": "^0.5.99",
+    "@inkeep/cxkit-react": "^0.5.117",
     "@radix-ui/react-accordion": "^1.2.4",
     "@vercel/analytics": "^1.5.0",
     "@vercel/og": "^0.6.8",
@@ -18,7 +18,7 @@
     "fumadocs-ui": "15.1.0",
     "gray-matter": "^4.0.3",
     "lucide-react": "^0.483.0",
-    "next": "15.5.9",
+    "next": "15.5.15",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "remark": "^15.0.1",
@@ -27,13 +27,13 @@
     "remark-stringify": "^11.0.0"
   },
   "devDependencies": {
-    "@tailwindcss/postcss": "^4.0.14",
+    "@tailwindcss/postcss": "^4.2.4",
     "@types/mdx": "^2.0.13",
     "@types/node": "22.13.10",
     "@types/react": "^19.0.10",
     "@types/react-dom": "^19.0.4",
-    "postcss": "^8.5.3",
+    "postcss": "^8.5.12",
-    "tailwindcss": "^4.0.14",
+    "tailwindcss": "^4.2.4",
     "typescript": "^5.8.2"
   }
 }

packages/integration/package.json

@@ -8,7 +8,7 @@
     "@ai-sdk/openai": "^3.0.2",
     "@types/node": "^22.13.13",
     "ai": "^6.0.5",
-    "drizzle-orm": "^0.45.1",
+    "drizzle-orm": "^0.45.2",
     "drizzle-zod": "^0.8.3",
     "typescript": "^5.8.2"
   },

packages/treeshake/package.json

@@ -9,16 +9,16 @@
     "bundle:esbuild": "esbuild --bundle ./in.ts --conditions=@zod/source --outfile=./out.js --bundle --format=esm"
   },
   "devDependencies": {
-    "@rollup/plugin-commonjs": "^28.0.3",
+    "@rollup/plugin-commonjs": "^29.0.2",
     "@rollup/plugin-node-resolve": "^16.0.1",
-    "@rollup/plugin-terser": "^0.4.4",
+    "@rollup/plugin-terser": "^1.0.0",
     "@rollup/plugin-typescript": "^12.1.2",
     "@types/node": "^22.13.13",
-    "zod": "workspace:*",
+    "rollup": "^4.60.2",
-    "rollup": "^4.37.0",
-    "rollup-plugin-filesize": "^10.0.0",
     "rollup-plugin-bundle-size": "^1.0.3",
-    "valibot": "^1.0.0",
+    "rollup-plugin-filesize": "^10.0.0",
+    "valibot": "^1.3.1",
+    "zod": "workspace:*",
     "zod3": "npm:zod@^3.24.0",
     "zod4": "npm:zod@^3.25.0"
   }

packages/tsc/package.json

@@ -10,7 +10,7 @@
     "@typescript/analyze-trace": "^0.10.1",
     "arktype": "^2.0.0",
     "execa": "^9.5.2",
-    "valibot": "^1.0.0",
+    "valibot": "^1.3.1",
     "zod": "workspace:*",
     "zod3": "npm:zod@^3.0.0",
     "zod4": "npm:[email protected]"