chore(deps): Bump the production-dependencies group across 1 directory with 5 updates

[dependabot]

Bumps the production-dependencies group with 5 updates in the / directory:

Package	From	To
@hono/zod-openapi	1.6.1	1.6.3
hono	4.13.5	4.13.7
marked	18.0.11	18.0.12
stripe	22.6.0	22.6.2
zod	4.4.3	4.6.2

Updates @hono/zod-openapi from 1.6.1 to 1.6.3

Release notes

Sourced from @​hono/zod-openapi's releases.

@​hono/zod-openapi@​1.6.3

Patch Changes

• #2087 3b0860026438694e76c3155737cf0b8df32384f5 Thanks @​WolfieLeader! - fix: return 415 when a JSON or form request body's Content-Type matches none of the route's declared media types, instead of validating an empty object

@​hono/zod-openapi@​1.6.2

Patch Changes

• #2115 525564dc5c275bfe8468b330902ea12dc450f54d Thanks @​scttcper! - Flatten batched route type inference so large openapiRoutes tuples do not hit TypeScript's recursive instantiation limit.

• #2116 38232db06e1c366e5eb1fb7cf6949c2541debd8c Thanks @​scttcper! - Reuse projected response types between openapi() route handlers and returned schemas to reduce TypeScript checker work.

• #1986 28f1d39cd2a480d9d3bd557df9037c054a674279 Thanks @​VihaanAgarwal! - fix(zod-openapi): infer route middleware env in defineOpenAPIRoute handler

Changelog

Sourced from @​hono/zod-openapi's changelog.

1.6.3

Patch Changes

• #2087 3b0860026438694e76c3155737cf0b8df32384f5 Thanks @​WolfieLeader! - fix: return 415 when a JSON or form request body's Content-Type matches none of the route's declared media types, instead of validating an empty object

1.6.2

Patch Changes

• #2115 525564dc5c275bfe8468b330902ea12dc450f54d Thanks @​scttcper! - Flatten batched route type inference so large openapiRoutes tuples do not hit TypeScript's recursive instantiation limit.

• #2116 38232db06e1c366e5eb1fb7cf6949c2541debd8c Thanks @​scttcper! - Reuse projected response types between openapi() route handlers and returned schemas to reduce TypeScript checker work.

• #1986 28f1d39cd2a480d9d3bd557df9037c054a674279 Thanks @​VihaanAgarwal! - fix(zod-openapi): infer route middleware env in defineOpenAPIRoute handler

Commits

• bc7d9e6 Version Packages (#2123)
• 3b08600 fix(zod-openapi): return 415 for request bodies with undeclared content type ...
• b125de5 Version Packages (#2121)
• 28f1d39 fix(zod-openapi): infer route middleware env in defineOpenAPIRoute handler (#...
• 525564d perf(zod-openapi): Flatten batched route schemas (#2115)
• 38232db perf(zod-openapi): Reuse route response projections (#2116)
• See full diff in compare view

Updates hono from 4.13.5 to 4.13.7

Release notes

Sourced from hono's releases.

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

---

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

• fix(client): keep a param value of "index" in $url() and $path() in honojs/hono#5297
• fix(client): normalize root WebSocket URLs in honojs/hono#5291
• fix(types): allow symbol keys in Context get and set fallbacks in honojs/hono#5300
• chore: bump editorconfig-checker in honojs/hono#5336
• refactor(on-handler): use forEach for consistent handler iteration in honojs/hono#5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

Commits

• eebdf7b 4.13.7
• 2b8ed40 Merge commit from fork
• cac0c4d 4.13.6
• dac5d57 refactor(on-handler): use forEach for consistent handler iteration (#5326)
• ec648d6 chore: bump editorconfig-checker (#5336)
• e2740d5 fix(types): allow symbol keys in Context<any> get and set fallbacks (#5300)
• 499c35e fix(client): normalize root WebSocket URLs (#5291)
• 50b8788 fix(client): keep a param value of "index" in $url() and $path() (#5297)
• See full diff in compare view

Updates marked from 18.0.11 to 18.0.12

Release notes

Sourced from marked's releases.

v18.0.12

18.0.12 (2026-09-07)

Bug Fixes

• allow a tab before the closing sequence of an ATX heading (#4084) (4417582)
• allow one more level of nested brackets in a link label (#4064) (37b28d8)
• do not add a newline to an empty code block (#4073) (23b1706)
• escape character references in autolink destinations (#4053) (8f432f0)
• reject GFM email autolink when the domain ends in _ or - (#4063) (df57534)
• reject invalid characters in HTML tag names (#4083) (300bb1d)
• remove up to the fence indentation from each content line (#4074) (0244f08)

Commits

• 24bf47c chore(release): 18.0.12 [skip ci]
• 475ba3d chore(deps-dev): bump eslint from 10.9.1 to 10.10.0 (#4088)
• 4417582 fix: allow a tab before the closing sequence of an ATX heading (#4084)
• 23b1706 fix: do not add a newline to an empty code block (#4073)
• df57534 fix: reject GFM email autolink when the domain ends in _ or - (#4063)
• 37b28d8 fix: allow one more level of nested brackets in a link label (#4064)
• 8f432f0 fix: escape character references in autolink destinations (#4053)
• 44ddc31 docs: add inspect.software health badge (#4062)
• 0244f08 fix: remove up to the fence indentation from each content line (#4074)
• 300bb1d fix: reject invalid characters in HTML tag names (#4083)
• Additional commits viewable in compare view

Updates stripe from 22.6.0 to 22.6.2

Release notes

Sourced from stripe's releases.

v22.6.2

• #2841 Validate that webhook secrets are non-empty

See the changelog for more details.

v22.6.1

• #2831 Use cryptographically secure boundaries for multipart file uploads
• #2836 update OtherString docstring
• #2835 Fix request coercion for GET and DELETE parameters
  • Fixes serialization of schema-coerced values, including Decimal, in GET and DELETE query parameters.
• #2829 Harden API requestor code against malicious URLs

See the changelog for more details.

Changelog

Sourced from stripe's changelog.

22.6.2 - 2026-09-09

• #2841 Validate that webhook secrets are non-empty

22.6.1 - 2026-09-01

• #2831 Use cryptographically secure boundaries for multipart file uploads
• #2836 update OtherString docstring
• #2835 Fix request coercion for GET and DELETE parameters
  • Fixes serialization of schema-coerced values, including Decimal, in GET and DELETE query parameters.
• #2829 Harden API requestor code against malicious URLs

Commits

• d9d0927 Bump version to 22.6.2
• a7baa7e Validate that webhook secrets are non-empty (#2841)
• b64815c Print npm HTTP logs in the publish job when debug logging is on (#2838)
• 998f558 Restore the NODE_AUTH_TOKEN placeholder in the publish job (#2837)
• 9f82c46 Bump version to 22.6.1
• d157b22 Use cryptographically secure boundaries for multipart file uploads (#2831)
• 6b2a81c update OtherString docstring (#2836)
• b4a248e Fix request coercion for GET and DELETE parameters 🪿✨ (#2835)
• 56ff49e Harden API requestor code against malicious URLs (#2829)
• edca154 Add open vs closed enum section to README (#2811)
• Additional commits viewable in compare view

Updates zod from 4.4.3 to 4.6.2

Release notes

Sourced from zod's releases.

v4.6.2

A patch on top of 4.6.1.

• 9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585
• 0c483c58 docs: the Zod 4.6 announcement post (#6546)
• a00c3f34 docs: use Trigger.dev's brand-kit lockups for the platinum card

v4.6.1

A patch on top of 4.6.0.

• b12aa523 fix: preserve unique tags with defaulted discriminators (#6582) — closes #6577
• dd9c36fa fix(v4): defer recursive object index inference (#6580)
• 3b154992 feat(lang): add Tajik (tg) locale (#6581) by @​ismoil77
• 2efa8b80 ci: give the npm wait a real budget and drop the back-publish path (#6583)

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

• .validate() — checks input validity without building a result (up to 35x faster than .safeParse().success on a compiled schema)
• z.instanceof().properties() — validates properties of an instance
• fromJSONSchema() — enforces six validation keywords it used to ignore
• z.iban() — electronic-format IBAN plus mod-97 checksum
• z.withParser() — installs a parser generated elsewhere, for environments without new Function
• Faster CommonJS — drops the getter on every export (~3x faster z.validate() under require)
• Memory retention in recursive schemas — releases the parsed input, fixing a 4.5 out-of-memory regression
• @zod/mini — Zod Mini as a standalone package, versioned in lockstep with zod since 4.5

.validate()

Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a ZodError, which makes rejection cheap. The return type is a guard on the schema's input type.

z.validate(z.string(), "hi"); // true
z.validate(z.string(), 42);   // false

It is a method on Zod Classic schemas too. (#6547)

const Player = z.object({
  username: z.string(),
  xp: z.number(),
});
</tr></table>

... (truncated)

Commits

• e359f73 4.6.2
• 9446b5c fix: preserve undefined prefault outputs and object keys (#6587)
• 0c483c5 docs: Zod 4.6 announcement post (#6546)
• a00c3f3 docs: use Trigger.dev's brand-kit lockups for the platinum card
• 62311eb 4.6.1
• 2efa8b8 ci: give the npm wait a real budget and drop the back-publish path (#6583)
• b12aa52 fix: preserve unique tags with defaulted discriminators (#6582)
• dd9c36f fix(v4): defer recursive object index inference (#6580)
• 574d480 fix(locales): clarify Tajik discriminator value message
• c532d76 test(locales): cover Tajik error branches
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions