[dependabot]

Bumps zod to 4.6.6 and updates ancestor dependency @angular/cli. These dependencies need to be updated together.

Updates zod from 4.4.2 to 4.6.6

Release notes

Sourced from zod's releases.

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

• 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
• 9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales
• 34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note
• 74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)
• b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors
• 8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze
• bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles
• c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)
• a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)
• a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)
• 529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6
• 9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

v4.6.5

Commits:

• d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
• f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
• ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
• cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
• 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
• 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

• d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
• ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
• 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

• 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
• 75d63ee1 docs: show only the .properties() method form in the 4.6 post
• 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

• 9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585
• 0c483c58 docs: the Zod 4.6 announcement post (#6546)

... (truncated)

Commits

• 9c21983 ci: stage at verbose so a failed OIDC token exchange says why
• 529f78d 4.6.6
• a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
• a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
• c42596b release: hold the run on the release-approval environment until the staged ve...
• bacad51 docs: square the Code for Japan logo to match the other bronze tiles
• 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
• b2ef983 docs: add Code for Japan to bronze sponsors
• 74304ce release: stage npm versions instead of publishing them (#6622)
• 34a626f docs: tighten the z.locales tree-shaking note
• Additional commits viewable in compare view

Updates @angular/cli from 22.0.1 to 22.2.5

Release notes

Sourced from @​angular/cli's releases.

22.2.5

@​schematics/angular

Commit	Description
	avoid adding web worker snippet to server configuration files
	ignore non-workspace stylesheet entries when adding Tailwind
	include the SSR entry file in the trust-proxy-headers migration
	include the type separator in the class spec import
	keep the default getter access type of spyOnProperty in refactor-jasmine-vitest
	migrate CallInfo returnValue and object in refactor-jasmine-vitest
	migrate spy.calls.first().args in refactor-jasmine-vitest
	set explicit type for the module --route component
	set explicit type for the app-shell component

@​angular/cli

Commit	Description
	explain how to pick a project when a schematic cannot determine one
	handle bun registry error output and 404 detection
	support resolving subproject dependencies in bun workspaces

@​angular-devkit/build-angular

Commit	Description
	resolve dev-server sslKey and sslCert relative to the workspace root (#34399)

@​angular-devkit/core

Commit	Description
	only invoke smart default provider when value is undefined

@​angular-devkit/schematics

Commit	Description
	support delegating trees in partition (#34539)
	support delegating trees in the filter rule (#34539)

@​angular/build

Commit	Description
	escape prerender redirect URLs
	include the oxc-parser WASI binding as an optional dependency
	only require karma-coverage when coverage is enabled
	resolve dev-server sslKey and sslCert relative to the workspace root (#34399)
	serialize server manifest asset paths
	suggest the istanbul provider in the unit-test V8 browser coverage error
	warn about unsupported options in the unit-test karma runner
	write the stats file in a stable, deterministic order
	avoid duplicate Domino bundling in server bundles
	avoid web worker channel overhead in library parallel compilation

@​angular/ssr

Commit	Description
	preserve trailing slashes in query and fragment of redirect URLs

... (truncated)

Changelog

Sourced from @​angular/cli's changelog.

22.2.5 (2026-10-28)

@​angular/cli

Commit	Type	Description
7efeeb9caa	fix	explain how to pick a project when a schematic cannot determine one
ee61e328ac	fix	handle bun registry error output and 404 detection
0d8898c289	fix	support resolving subproject dependencies in bun workspaces

@​schematics/angular

Commit	Type	Description
982c3dcbfc	fix	avoid adding web worker snippet to server configuration files
18e5dc6fe8	fix	ignore non-workspace stylesheet entries when adding Tailwind
dd18bda9db	fix	include the SSR entry file in the trust-proxy-headers migration
b7e24561e7	fix	include the type separator in the class spec import
7f3840c70c	fix	keep the default getter access type of spyOnProperty in refactor-jasmine-vitest
eaf2343be4	fix	migrate CallInfo returnValue and object in refactor-jasmine-vitest
6680d289cb	fix	migrate spy.calls.first().args in refactor-jasmine-vitest
9cba0da43f	fix	set explicit type for the module --route component
e9ae950364	fix	set explicit type for the app-shell component

@​angular-devkit/build-angular

Commit	Type	Description
0c4bd19ace	fix	resolve dev-server sslKey and sslCert relative to the workspace root (#34399)

@​angular-devkit/core

Commit	Type	Description
ad04d689bb	fix	only invoke smart default provider when value is undefined

@​angular-devkit/schematics

Commit	Type	Description
e7fd1bd9cb	fix	support delegating trees in partition (#34539)
1854c1714d	fix	support delegating trees in the filter rule (#34539)

@​angular/build

Commit	Type	Description
6d45d1007f	fix	escape prerender redirect URLs
6298fb89e6	fix	include the oxc-parser WASI binding as an optional dependency
325f6a0f48	fix	only require karma-coverage when coverage is enabled

... (truncated)

Commits

• 9e8eea0 release: cut the v22.2.5 release
• e3134b4 fix(@​angular/build): warn about unsupported options in the unit-test karma ru...
• 199775b build: update dependency webpack-dev-middleware to v8.5.0
• 7efeeb9 fix(@​angular/cli): explain how to pick a project when a schematic cannot dete...
• 6298fb8 fix(@​angular/build): include the oxc-parser WASI binding as an optional depen...
• 7f3840c fix(@​schematics/angular): keep the default getter access type of spyOnPropert...
• 325f6a0 fix(@​angular/build): only require karma-coverage when coverage is enabled
• e7fd1bd fix(@​angular-devkit/schematics): support delegating trees in partition (#34...
• 1854c17 fix(@​angular-devkit/schematics): support delegating trees in the filter rul...
• 9701ae9 docs(@​angular-devkit/build-angular): correct browser-esbuild statsJson descri...
• Additional commits viewable in compare view