build(deps): bump the production-dependencies group across 1 directory with 2 updates

[dependabot]

Bumps the production-dependencies group with 2 updates in the / directory: chartjs-chart-treemap and zod.

Updates chartjs-chart-treemap from 4.2.0 to 4.2.2

Release notes

Sourced from chartjs-chart-treemap's releases.

v4.2.2

4.2.2 (2026-09-06)

Bug Fixes

• restore usage sample chart broken by legacy docs cleanup (970c5a2)

v4.2.1

4.2.1 (2026-09-05)

Bug Fixes

• grant compressed-size job permission to comment on PRs (ece5be4)
• run compressed-size-action's build-script as a full command (4abd14c)

Commits

• 970c5a2 fix: restore usage sample chart broken by legacy docs cleanup
• fff0595 ci: skip npm lifecycle scripts during install
• ec3cbd5 ci: scope secrets explicitly and scan workflow files with Sonar
• ece5be4 fix: grant compressed-size job permission to comment on PRs
• 4abd14c fix: run compressed-size-action's build-script as a full command
• 8270a24 ci: bump compressed-size-action to v3
• 00830cb build(deps-dev): bump the dev-dependencies group with 14 updates
• ab45ca2 chore: ignore TypeScript major bumps in dependabot dev-dependencies
• 54c2d37 chore: group dependabot updates and standardize README badges
• c38c9dc ci: point pr-ci and main-ci at the shared-ci reusable workflow
• Additional commits viewable in compare view

Updates zod from 4.5.4 to 4.6.4

Release notes

Sourced from zod's releases.

v4.6.4

A patch on top of 4.6.3.

• d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
• ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
• 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

• 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
• 75d63ee1 docs: show only the .properties() method form in the 4.6 post
• 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

• 9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585
• 0c483c58 docs: the Zod 4.6 announcement post (#6546)
• a00c3f34 docs: use Trigger.dev's brand-kit lockups for the platinum card

v4.6.1

A patch on top of 4.6.0.

• b12aa523 fix: preserve unique tags with defaulted discriminators (#6582) — closes #6577
• dd9c36fa fix(v4): defer recursive object index inference (#6580)
• 3b154992 feat(lang): add Tajik (tg) locale (#6581) by @​ismoil77
• 2efa8b80 ci: give the npm wait a real budget and drop the back-publish path (#6583)

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

• .validate() — checks input validity without building a result (up to 35x faster than .safeParse().success on a compiled schema)
• z.instanceof().properties() — validates properties of an instance
• fromJSONSchema() — enforces six validation keywords it used to ignore
• z.iban() — electronic-format IBAN plus mod-97 checksum
• z.withParser() — installs a parser generated elsewhere, for environments without new Function
• Faster CommonJS — drops the getter on every export (~3x faster z.validate() under require)
• Memory retention in recursive schemas — releases the parsed input, fixing a 4.5 out-of-memory regression
• @zod/mini — Zod Mini as a standalone package, versioned in lockstep with zod since 4.5

.validate()

... (truncated)

Commits

• 2bb0871 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• 743aedb 4.6.4
• f6e1701 chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)
• d6bc1e3 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by...
• ad32d75 perf: reduce validation and schema allocation overhead (#6588)
• 12e6272 4.6.3
• 413cce9 fix(v4): make z.properties() a check again (#6594)
• 75d63ee docs: show only the .properties() method form in the 4.6 post
• 46da957 docs: match the error-message examples to what the parsers emit
• e359f73 4.6.2
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/chartjs-chart-treemap	4.2.2	🟢 6.8	Details Check Score Reason Code-Review ⚠️ 0 Found 0/19 approved changesets -- score normalized to 0 Maintained 🟢 10 30 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected Packaging 🟢 10 packaging workflow detected SAST 🟢 9 SAST tool is not run on all commits -- score normalized to 9 Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches
npm/zod	4.6.4	🟢 5.4	Details Check Score Reason Security-Policy 🟢 10 security policy file detected Code-Review ⚠️ 0 Found 1/28 approved changesets -- score normalized to 0 Maintained 🟢 10 30 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• package-lock.json

[Aymen (aymenfurter)]

Approved: compatible production dependency updates with all checks passing.