chore(deps): Update npm-deps

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@redocly/cli	2.52.1 → 2.53.3
@types/node (source)	24.13.4 → 24.13.5
@vitest/coverage-v8 (source)	5.0.0 → 5.0.1
eslint-plugin-sonarjs (source)	4.2.0 → 4.2.1
multer	2.3.0 → 2.4.0
prettier (source)	3.9.6 → 3.9.7
vitest (source)	5.0.0 → 5.0.1
zod (source)	4.6.2 → 4.6.5

---

Release Notes

Redocly/redocly-cli (@​redocly/cli)

v2.53.3

Compare Source

Patch Changes

• Fixed respect so a same-workflow goto no longer cleared $steps outputs from steps that already ran.
  Previously, this broke $steps expressions in the target step.
• Updated @​redocly/respect-core to v2.53.3.

v2.53.2

Compare Source

Patch Changes

• Added start and end line and column positions to each problem location in the --format=json lint output.
• Updated @​redocly/openapi-core to v2.53.2.

v2.53.1

Compare Source

Patch Changes

• Added a deprecation warning to the build-docs command about the upcoming switch to Redoc 3.

v2.53.0

Compare Source

Minor Changes

• Added a disallowDefault option to the operation-2xx-response rule, which requires an explicit 2xx response when enabled.
  There is no change in current behavior.

Patch Changes

• Updated @​redocly/openapi-core to v2.53.0.

vitest-dev/vitest (@​vitest/coverage-v8)

v5.0.1

Compare Source

   🚀 Features

• ui:
  • Move trace attempts selector to viewer header  -  by @​hi-ogawa, Hiroshi Ogawa and Codex in #​11189 (5dc4b)
  • Add focused trace view layout mode  -  by @​hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and Codex in #​11190 (376dc)

   🐞 Bug Fixes

• Exit 1 when vitest list fails collection  -  by @​hamed-bavar in #​11145 and #​11146 (6108b)
• Keep parse error details in static collection  -  by @​hamed-bavar in #​11150 and #​11151 (7c818)
• Avoid recursive prototype in automocking  -  by @​sheremet-va in #​11195 (99fc5)
• Prevent false Vitest import resolution  -  by @​sheremet-va in #​11196 (b426c)
• Keep metadata file when clearing the cache  -  by @​sheremet-va in #​11199 (73614)
• Correct typos in error message and comments  -  by @​shinji00222 and Shinji in #​11187 (115c3)
• Resolve ResolvedConfig exactOptionalPropertyTypes errors  -  by @​LukeAbby in #​11175 (498fb)
• Share the server on self-referencing extends  -  by @​sheremet-va in #​11034 (23dda)
• Warn when deprecated deps.optimizer.web is used  -  by @​im10furry in #​11214 (2ce29)
• browser:
  • Avoid double quotes in config.define  -  by @​sheremet-va in #​11198 (972e2)
• doctor:
  • Measure vm pools for custom environments  -  by @​sheremet-va in #​11212 (91ab1)
• expect:
  • Correct return value in toMatchAriaSnapshot  -  by @​sheremet-va in #​11208 (c119b)
• fakeTimers:
  • Force queueMicrotask and nextTick in toNotFake  -  by @​kingmakeruix, kingmakeruix, Hiroshi Ogawa, Codex and @​hi-ogawa in #​11261 (a47d7)
• snapshot:
  • Report obsolete keys next to skipped tests  -  by @​hamed-bavar, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #​11157 and #​11158 (17e2b)
• types:
  • Make public declarations self-contained  -  by @​ZoeySigel in #​11141 (45546)
• ui:
  • Fix collapse/expand suite with file name search  -  by @​hi-ogawa, Hiroshi Ogawa and Codex in #​11260 (0a712)
  • Fix explorer file summary count  -  by @​hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and Codex in #​11125 (05982)
• utils:
  • Fix deepMerge to handle prototype  -  by @​hi-ogawa, Hiroshi Ogawa and Codex in #​11215 (4944c)

    View changes on GitHub

SonarSource/SonarJS (eslint-plugin-sonarjs)

v4.2.1

Compare Source

expressjs/multer (multer)

v2.4.0

Compare Source

• Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)
• Add filename to LIMIT_FILE_SIZE and LIMIT_UNEXPECTED_FILE errors (#​1416)
• Accept a function for limits, called with the request, to set limits per request (#​1133)
• Add opt-in flush option to DiskStorage to fsync files before the callback runs (#​1458)
• Expose busboy's defCharset, highWaterMark and fileHwm options (#​1465)
• Add streamHandler option to feed busboy from pre-consumed bodies (Google Cloud Functions, Firebase) (#​1466)
• Allow multer.diskStorage() to be called without options (#​1471)
• Decode WHATWG-escaped characters (%0A, %0D, %22) in field names, matching file.originalname since 2.3.0: req.body keys, file.fieldname and err.field now carry the real name. If you matched the escaped spelling as a workaround, use the real name now (#​1473)
• Report the decoded filename in err.filename on LIMIT_FILE_SIZE errors, matching file.originalname (#​1478)
• Reject non-integer or negative limits values at construction time; a float limit silently disabled the check (#​1395, #​1335)
• Accept requests with exactly limits.parts parts; LIMIT_PART_COUNT now fires only when the limit is exceeded. If you set parts one higher to work around this, you can drop the extra one (#​1446)
• Files skipped by fileFilter no longer count towards maxCount (#​1426)
• Change the LIMIT_UNEXPECTED_FILE message to "Unexpected file field" (#​426)
• Remove the concat-stream dependency (#​1356)
• Docs: add JSDoc to the public API and document the storage engine stream contract (#​1467, #​1468)
• Docs: add FormData upload examples (#​896)
• Docs: remove the translated READMEs (#​1463)
• Internal: run the test suite on macOS (#​1464)

prettier/prettier (prettier)

v3.9.7

Compare Source

• Support Angular 22.2
• Fix regressions in v3.9

🔗 Changelog

colinhacks/zod (zod)

v4.6.5

Compare Source

Commits:

• d2b135c docs: add the 4.6.x patch highlights to the 4.6 post
• f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#​6598)
• 56222cd feat(instanceof): key the .properties() shape off the instance type (#​6600)
• ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#​6595)"
• cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#​6595)""
• 0f3f5ee 4.6.5
• 59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

Compare Source

A patch on top of 4.6.3.

• d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#​6595)
• ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#​6588)
• 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#​6153)

v4.6.3

Compare Source

A patch on top of 4.6.2.

• 413cce9a fix(v4): make z.properties() a check again (#​6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
• 75d63ee1 docs: show only the .properties() method form in the 4.6 post
• 46da9572 docs: match the error-message examples to what the parsers emit

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: d764f063-a552-45e9-8085-6109a5a85184

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}