build(deps): bump zod from 4.6.2 to 4.6.5 in the production-minor-and-patch group

[dependabot]

Bumps the production-minor-and-patch group with 1 update: zod.

Updates zod from 4.6.2 to 4.6.5

Release notes

Sourced from zod's releases.

v4.6.5

Commits:

• d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
• f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
• ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
• cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
• 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
• 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

• d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
• ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
• 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

• 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
• 75d63ee1 docs: show only the .properties() method form in the 4.6 post
• 46da9572 docs: match the error-message examples to what the parsers emit

Commits

• 59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump
• 0f3f5ee 4.6.5
• cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, ref...
• ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed w...
• 56222cd feat(instanceof): key the .properties() shape off the instance type (#6600)
• de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• d2b135c docs: add the 4.6.x patch highlights to the 4.6 post
• 2bb0871 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• 743aedb 4.6.4
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 21, 2026, 12:08 PM ET / 16:08 UTC.

ClawSweeper review

What this changes

Updates the locked Zod production dependency from 4.6.2 to 4.6.5 while preserving the existing package version range.

Merge readiness

✅ Ready for maintainer review

Keep open: the dependency update is not present on the reviewed main revision or v0.8.1, and no concrete compatibility or security defect was found.

Priority: P3
Reviewed head: 4f4d188c3254d22b36922580731125dc55ecb416

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused dependency update with matching registry metadata and no actionable defect found in the inspected consumers.
Proof confidence	🌊 off-meta tidepool	Not applicable: Dependabot-authored dependency maintenance is exempt from contributor runtime proof; schema-consumer tests were inspected, without claiming an executed after-update run.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Dependabot-authored dependency maintenance is exempt from contributor runtime proof; schema-consumer tests were inspected, without claiming an executed after-update run.
Evidence reviewed	6 items	Introduced change: The pinned introduction delta changes only the Zod importer version, package integrity entry, and snapshot key: four additions and four deletions. The verified test-merge comparison has the same single-file scope. Main and release still use the previous resolution: The reviewed main lockfile and the v0.8.1 lockfile both resolve Zod 4.6.2. The unchanged package.json range ^4.6.2 permits 4.6.5; this PR updates reproducible repository installs rather than introducing a new dependency. Concrete dependency consumers: src/provider-schema.ts imports Zod and calls z.toJSONSchema; src/provider-output.ts validates responses with safeParse, and src/fs.ts validates saved JSON. Existing provider tests cover nullable fields, strict object schemas, and malformed responses. No uses of the changed properties, instanceof, URL, currency-code, or compile APIs were found in src. Tests were inspected, not executed under this read-only review.
Findings	None	None.
Security	None	None.

How this fits together

Clawpatch uses Zod to validate provider responses and saved JSON state, and to generate schemas sent to providers. The lockfile determines which Zod version repository installs use.

flowchart LR
  A[Dependency lockfile] --> B[Zod validation library]
  C[Provider responses] --> B
  D[Saved JSON state] --> B
  B --> E[Validated workflow data]
  B --> F[Validation errors]
  B --> G[Provider request schemas]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Retain the focused lockfile update and existing schema contracts, with normal dependency and runtime checks governing landing.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this dependency maintenance PR reports no specific clawpatch failure; no runtime reproduction was attempted.

Is this the best way to solve the issue?

Yes: updating only the lockfile is appropriate because the existing dependency range already permits 4.6.5, and source inspection found no required consumer changes.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 4d3dad28a600.

Labels

Label changes:

• add P3: This is routine, narrowly scoped dependency maintenance with no demonstrated urgent user-facing failure.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Dependabot-authored dependency maintenance is exempt from contributor runtime proof; schema-consumer tests were inspected, without claiming an executed after-update run.

Label justifications:

• P3: This is routine, narrowly scoped dependency maintenance with no demonstrated urgent user-facing failure.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Dependabot-authored dependency maintenance is exempt from contributor runtime proof; schema-consumer tests were inspected, without claiming an executed after-update run.

Evidence

What I checked:

• Introduced change: The pinned introduction delta changes only the Zod importer version, package integrity entry, and snapshot key: four additions and four deletions. The verified test-merge comparison has the same single-file scope. (pnpm-lock.yaml:21, 4f4d188c3254)
• Main and release still use the previous resolution: The reviewed main lockfile and the v0.8.1 lockfile both resolve Zod 4.6.2. The unchanged package.json range ^4.6.2 permits 4.6.5; this PR updates reproducible repository installs rather than introducing a new dependency. (pnpm-lock.yaml:21, 4d3dad28a600)
• Concrete dependency consumers: src/provider-schema.ts imports Zod and calls z.toJSONSchema; src/provider-output.ts validates responses with safeParse, and src/fs.ts validates saved JSON. Existing provider tests cover nullable fields, strict object schemas, and malformed responses. No uses of the changed properties, instanceof, URL, currency-code, or compile APIs were found in src. Tests were inspected, not executed under this read-only review. (src/provider-schema.ts:22, 4f4d188c3254)
• Upstream compatibility inspection: The upstream comparison includes removal of the standalone properties schema, URL validation changes, and an equivalent required-key collection refactor in JSON-schema generation. The inspected changes did not establish a regression in clawpatch's used APIs. Source: colinhacks/zod@v4.6.2...v4.6.5. (packages/zod/src/v4/core/json-schema-processors.ts, 59bbc03e10c6)
• Registry identity and package integrity: The npm registry identifies colinhacks/zod as the package repository. Its 4.6.5 integrity exactly matches the introduced lockfile value; the package metadata lists no runtime dependencies or install lifecycle hooks. The upstream package manifest diff changes only the version. (packages/zod/package.json)
• Routing and prior dependency maintenance: Git history and GitHub metadata connect steipete to the previous Zod upgrade in merged chore: update dependencies and verify supported Node runtimes in CI #209. CODEOWNERS routes pnpm-lock.yaml to openclaw/openclaw-secops. Some deeper local history reads failed because unavailable objects could not be retrieved; GitHub commit metadata supplied the prior dependency patch. Broader PR search was unavailable, so no exhaustive duplicate-search claim is made. (.github/CODEOWNERS:20, b979f94701be)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• openclaw/openclaw-secops: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Included in merged #222: Zod is now 4.6.5, with the updated lockfile verified by the full remote suite and Node 22/24/26 CI. Closing this superseded update.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml