fix(deps): update dependency zod (4.6.6 → 4.6.7)

[its-miso]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
zod (source)	4.6.6 → 4.6.7

---

Release Notes

colinhacks/zod (zod)

v4.6.7

Compare Source

Commits:

• b500a2e 4.6.7

---

Configuration

📅 Schedule: (in timezone America/Edmonton)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M3 (anthropic) — primary route · pr-reviewer-action v3.4.1

Recommendation

Approve. A Renovate-generated patch bump of zod that touches only package-lock.json (one package, one resolved URL, one integrity hash). package.json is unchanged, no source files are modified, no manifest or CI inputs shift, and CI on the head commit is green across the board (lint, typecheck, build, tests, coverage, npm audit, smoke, both Docker builds, database integration and migrations).

Change-by-change findings

package-lock.json — node_modules/zod (@@ -11731,9 +11731,9 @@):

• Bumps zod from 4.6.6 → 4.6.7, with matching resolved URL and integrity hash update. Three lines changed, three lines removed. No other packages move.
• I verified the diff scope by reading the current package-lock.json around the node_modules/zod entry: only the version, resolved, and integrity fields differ in that block. The PR metadata reports changedFiles: 1, additions: 3, deletions: 3, consistent with the diff.
• The package.json declared range "zod": "^4.4.3" is unchanged (read directly), so 4.6.7 is allowed by the existing semver range — no version-range edit is needed.

Upstream verification (zod 4.6.7):

• GitHub release v4.6.7 was published 2026-10-12 and contains a single commit (b500a2e, "4.6.7"). The upstream compare shows this is a pure version bump: zod/package.json, @zod/mini/package.json, @zod/zod/jsr.json and packages/zod/src/v4/core/versions.ts flip 4.6.6 → 4.6.7, plus the matching pnpm-lock.yaml snapshot entries. No source code, type surface, or peer dependency changes in the upstream diff. Consistent with a patch-version increment and the project's history (4.6.5 → 4.6.6 Renovate bumps for the same package already shipped via the same pattern).

Claims assessment

• Claim 1 (only zod changes in package-lock.json, 4.6.6→4.6.7): Held: 1/1. Confirmed against the head diff and the surrounding lockfile context I read.
• Claim 2 (package.json zod range unchanged): Held: 1/1. Read directly: "zod": "^4.4.3" on the head.
• Claim 3 (only package-lock.json modified, zero source-code changes): Held: 2/2 items. PR metadata and diff agree: changedFiles: 1, the single file is package-lock.json. No edits under src/, lib/, test/, charts/, prisma/, Dockerfile, or any workflow.

Must-checks

• "check for breaking API changes in updated dependencies" — satisfied. Patch bump (4.6.6 → 4.6.7) on zod per semver. The package.json declared range ^4.4.3 already permits this version, no range change is being made. The upstream compare is a version-only change in zod's own manifest/lockfile with a single "4.6.7" commit; no exported type surface moves. No application-code callers are modified.
• "run full test suite after upgrade" — satisfied. The CI section above shows the head commit 17284c28 succeeded on Tests (and Coverage, Lint, Typecheck, Build, npm audit, smoke, both Docker builds, Database integration, Database migrations, Workflow lint). Renovate's digest release-provenance images were not part of this PR (no image changes), so the OCI provenance caveat is not applicable.

Sources

• Head diff (this conversation).
• Head package-lock.json, node_modules/zod block (read directly): the post-change version: 4.6.7, resolved: https://registry.npmjs.org/zod/-/zod-4.6.7.tgz, integrity: sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==.
• Head package.json (read directly): "zod": "^4.4.3".
• Upstream GitHub release v4.6.7 (single "4.6.7" commit b500a2e, published 2026-10-12).
• Upstream GitHub compare v4.6.6...v4.6.7 (version-only changes in packages/zod/package.json, packages/mini/package.json, packages/zod/src/v4/core/versions.ts, and matching pnpm-lock.yaml snapshots; no source-code edits).
• Repository history confirms the same Renovate pattern has shipped for prior zod patch bumps (e.g., 4.6.5 → 4.6.6) and the prior @testing-library/user-event bumps.
• CI for 17284c28... — see the CI Check Results section above.

Tool Harness Findings

All six tool calls completed without errors. The harness confirmed: (1) exactly one file changed (package-lock.json only), (2) package.json's declared zod: ^4.4.3 range is unchanged, and (3) the node_modules/zod lockfile block carries the expected 4.6.6→4.6.7 swap. No defects surfaced.