Bump zod from 4.4.3 to 4.6.0 in /mcp

[dependabot]

Bumps zod from 4.4.3 to 4.6.0.

Release notes

Sourced from zod's releases.

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

• .validate() — checks input validity without building a result (up to 35x faster than .safeParse().success on a compiled schema)
• z.instanceof().properties() — validates properties of an instance
• fromJSONSchema() — enforces six validation keywords it used to ignore
• z.iban() — electronic-format IBAN plus mod-97 checksum
• z.withParser() — installs a parser generated elsewhere, for environments without new Function
• Faster CommonJS — drops the getter on every export (~3x faster z.validate() under require)
• Memory retention in recursive schemas — releases the parsed input, fixing a 4.5 out-of-memory regression
• @zod/mini — Zod Mini as a standalone package, versioned in lockstep with zod since 4.5

.validate()

Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a ZodError, which makes rejection cheap. The return type is a guard on the schema's input type.

z.validate(z.string(), "hi"); // true
z.validate(z.string(), 42);   // false

It is a method on Zod Classic schemas too. (#6547)

const Player = z.object({
  username: z.string(),
  xp: z.number(),
});
if (Player.validate(data)) {
data.username; // narrowed
}

In conjunction with z.compile(), this can be up to 35x faster than .safeParse().success on invalid input.

Time per call on invalid input, compiled with z.compile() — lower is better (benchmark)

Without compilation it is up to 5.9x faster. The saving is the result object: .safeParse() allocates one with an accessor pair on every call, and .validate() allocates nothing.

... (truncated)

Commits

• 1c51cbe 4.6.0
• 661673a docs: make the 9thCO logo visible on the light theme
• 6de10dc docs: reconcile the sponsor listings against every active sponsorship (#6579)
• 213ee75 feat(compile): add z.withParser for externally generated parsers (#6575)
• f9465d4 docs: reconcile the sponsor listings with active sponsorships (#6576)
• f7fd554 perf(v4): drop the lookaheads from the email regex (#6573)
• 36f1796 fix(v4): stop the memoizer from pinning a finished parse (#6572)
• 22bed61 feat(v4): add z.iban() string format with mod-97 checksum (#6571)
• c5b9bcb bench: measure what a runtime island's leaked indent cost the generated source
• e54716c docs(ecosystem): add @​apical-ts/craft (#5946)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)