chore(deps): update dependency zod to v4.6.5 #4

Merged

EgorEast merged 1 commit from renovate/devdependencies-(non-major) into main 2026-10-06 08:49:15 +00:00

Conversation 1 Commits 1 Files changed 1 +1 -1

EgorEast commented 2026-09-28 06:09:45 +00:00

Owner

Copy link

This PR contains the following updates:

Package	Change	Age	Confidence
zod (source)	4.3.5 → 4.6.5

---

Release Notes

colinhacks/zod (zod)

v4.6.5

Compare Source

Commits:

• d2b135c docs: add the 4.6.x patch highlights to the 4.6 post
• f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#​6598)
• 56222cd feat(instanceof): key the .properties() shape off the instance type (#​6600)
• ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#​6595)"
• cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#​6595)""
• 0f3f5ee 4.6.5
• 59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

Compare Source

A patch on top of 4.6.3.

• d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#​6595)
• ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#​6588)
• 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#​6153)

v4.6.3

Compare Source

A patch on top of 4.6.2.

• 413cce9a fix(v4): make z.properties() a check again (#​6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
• 75d63ee1 docs: show only the .properties() method form in the 4.6 post
• 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

Compare Source

A patch on top of 4.6.1.

• 9446b5cc fix: preserve undefined prefault outputs and object keys (#​6587) — closes #​6585
• 0c483c58 docs: the Zod 4.6 announcement post (#​6546)
• a00c3f34 docs: use Trigger.dev's brand-kit lockups for the platinum card

v4.6.1

Compare Source

A patch on top of 4.6.0.

• b12aa523 fix: preserve unique tags with defaulted discriminators (#​6582) — closes #​6577
• dd9c36fa fix(v4): defer recursive object index inference (#​6580)
• 3b154992 feat(lang): add Tajik (tg) locale (#​6581) by @​ismoil77
• 2efa8b80 ci: give the npm wait a real budget and drop the back-publish path (#​6583)

v4.6.0

Compare Source

Zod 4.6 is now available.

npm install zod@latest

At a glance:

• .validate() — checks input validity without building a result (up to 35x faster than .safeParse().success on a compiled schema)
• z.instanceof().properties() — validates properties of an instance
• fromJSONSchema() — enforces six validation keywords it used to ignore
• z.iban() — electronic-format IBAN plus mod-97 checksum
• z.withParser() — installs a parser generated elsewhere, for environments without new Function
• Faster CommonJS — drops the getter on every export (~3x faster z.validate() under require)
• Memory retention in recursive schemas — releases the parsed input, fixing a 4.5 out-of-memory regression
• @zod/mini — Zod Mini as a standalone package, versioned in lockstep with zod since 4.5

.validate()

Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a ZodError, which makes rejection cheap. The return type is a guard on the schema's input type.

z.validate(z.string(), "hi"); // true
z.validate(z.string(), 42);   // false

It is a method on Zod Classic schemas too. (#​6547)

const Player = z.object({
  username: z.string(),
  xp: z.number(),
});

if (Player.validate(data)) {
  data.username; // narrowed
}

In conjunction with z.compile(), this can be up to 35x faster than .safeParse().success on invalid input.

Time per call on invalid input, compiled with z.compile() — lower is better (benchmark)

Uncompiled schemas

Without compilation it is up to 5.9x faster. The saving is the result object: .safeParse() allocates one with an accessor pair on every call, and .validate() allocates nothing.

Time per call on invalid input, plain schemas — lower is better (benchmark)

Both charts measure the failure path. The key feature of .validate() is that it can short-circuit on the first issue it encounters, instead of aggregating a full ZodIssue[] array.

[!NOTE]
Async refinements are covered by .validateAsync().

z.properties()

A new API for validating specific properties of an object. Unlike z.object() it validates in-place, so it plays nice with class instances. (#​6536)

const responseLike = z.properties({ status: z.number().min(200).max(299) });

responseLike.parse(new Response("ok", { status: 200 }));  // ✅ a real Response
responseLike.parse({ status: 204 });                      // ✅ a plain object

A corresponding .properties() method has been added to ZodInstanceOf.

Zod

const okResponse = z.instanceof(Response).properties({
  ok: z.literal(true),
  status: z.number().min(200).max(299),
});

Zod Mini

const okResponse = z.instanceof(Response).check(...z.properties({
  ok: z.literal(true),
  status: z.number().check(z.minimum(200), z.maximum(299)),
}));

The input comes back untouched, so the prototype survives and the methods still work. That is the part z.object() cannot do: it would hand back a plain object and the Response would be gone.

const res = await fetch("/api/user");

okResponse.parse(res) === res; // ✅ true

fromJSONSchema()

Six additional JSON Schema keywords are now supported in z.fromJSONSchema(). (#​6535)

• minProperties / maxProperties
• uniqueItems
• contains
• minContains / maxContains

const schema = z.fromJSONSchema({
  type: "object",
  minProperties: 2,      // also maxProperties
});

schema.parse({ a: 1 });        // ❌ too few properties
schema.parse({ a: 1, b: 2 });  // ✅

Both property bounds count the input's own keys. Array uniqueness is structural, so [{ a: 1 }, { a: 1 }] is a duplicate.

z.fromJSONSchema({ type: "array", uniqueItems: true }).parse([{ a: 1 }, { a: 1 }]); // ❌

z.fromJSONSchema({
  type: "array",
  contains: { type: "number" },   // also minContains and maxContains
  minContains: 2,
}).parse(["a", 2]);               // ❌ only one number

z.iban()

A new string format: an IBAN in electronic format, with a valid ISO 7064 MOD 97-10 checksum. (#​6571)

z.iban().parse("DE89370400440532013000"); // ✅
z.iban().parse("DE89370400440532013001"); // ❌ bad checksum

z.withParser()

z.compile() builds its parser with new Function, which a strict Content Security Policy blocks. z.withParser() is that installer on its own: it takes a parser generated somewhere else, at build time or by a native compiler, and installs it under the same contract. (#​6575)

const Player = z.object({ username: z.string(), xp: z.number() });

// isPlayer is a type guard your build step generated
const Fast = z.withParser(Player, (input) =>
  isPlayer(input) ? { username: input.username, xp: input.xp } : z.INVALID
);

The supplied parser owns the whole result, so it has to return what the schema would have returned. This one rebuilds the object rather than handing back its input, because z.object() strips unknown keys. Returning z.INVALID hands the input to the runtime, which stays the only source of ZodErrors.

Faster CommonJS

TypeScript compiles a re-export to a getter, and 252 of the 255 exports on Zod 4.5's CommonJS entrypoint were getters. V8 could not see a constant callee behind one, so it could not inline the call. The 4.6 build emits plain properties and freezes the exports object. On a compiled schema, z.validate() under require is about 3x faster than it was in Zod 4.5. (#​6564)

const { z } = require("zod");
const CompiledPlayer = z.compile(Player);

z.validate(CompiledPlayer, data); // ~3x faster than Zod 4.5

Only calls through the namespace were affected. A method call like Player.safeParse(data) never reads the exports object, and the ESM build is unchanged.

Memory retention in recursive schemas

A recursive schema held the input and output of its last parse until the next parse replaced it, so one long-lived schema pinned every object it had touched. Zod 4.4 released that input and Zod 4.5 did not, which surfaced as an out-of-memory failure on a repository-wide lint run. The parse state is weak throughout now: one parse of a 29k-node tree retains 2.2 MB where it used to retain 10.1 MB, and recursive parses give up about 6% for it. (#​6572)

const Category = z.object({
  name: z.string(),
  get children() {
    return z.array(Category);
  },
});

Bug fixes

⚠️ Error maps run on the first read of error

Because safeParse() now builds its error lazily, error maps — global, locale, and per-schema error — run when result.error is first read, not at parse time. Code that swaps z.config() between the parse and the read gets the newer configuration. (#​6519)

const result = schema.safeParse(12);
z.config(z.locales.fr());
result.error.issues[0].message; // French in 4.6, English in 4.5

An error map with a side effect never runs if nothing reads the error. Throwing parses are unaffected — .parse() builds and throws its error immediately, never takes the lazy path, and its stack still points at your call site.

⚠️ z.emoji() rejects component-only strings

Unicode's Emoji_Component property covers the pieces that attach to an emoji, so z.emoji() accepted "123", "#", "*", and a lone zero-width joiner, variation selector, or skin tone modifier. The pattern now requires at least one pictograph, regional indicator, or keycap. (#​6532)

z.emoji().parse("😀");   // ✅
z.emoji().parse("1️⃣");   // ✅ the keycap is the anchor
z.emoji().parse("123");  // ❌ was accepted in 4.5

Flags, subdivision flags, skin-tone-modified emoji, and ZWJ sequences are unchanged. Closes #​6515.

⚠️ Numeric enum options no longer include the reverse mappings

A numeric TypeScript enum also carries its reverse mapping (0 to "UK") at runtime. The parser already ignored those keys, but .options was read straight off the enum object, so a three-member enum listed six values and three of them failed to parse. (#​6542)

enum Country { UK, Germany, France }

z.enum(Country).options; // 4.5: ["UK", "Germany", "France", 0, 1, 2] — 4.6: [0, 1, 2]

⚠️ base64 patterns

The runtime patterns for z.base64() and z.base64url() are the character sets, with length and padding enforced in code, so a multi-megabyte string can no longer overflow the regex stack through a composed schema. The JSON Schema output still emits the exact block forms, so z.toJSONSchema() is unchanged. (#​6534, #​6527)

Composing z.base64() into a template literal now checks the alphabet but not the length, which is how z.creditCard() already behaves there. The exported z.regexes.base64url is now the length-aware form, so it overflows on a multi-megabyte input the same way z.regexes.base64 does.

⚠️ The email pattern dropped its lookaheads

z.email() opened with two lookaheads, and the second scanned the whole string before the match began. Both are gone, and the rule they enforced — no empty segment in the local part — is expressed structurally instead, so z.email() accepts and rejects exactly what it did before. Valid addresses validate roughly twice as fast. (#​6573)

The pattern string is user-visible, and every copy of it changes: z.regexes.email, which has no capture groups now — neither of the two it used to expose held a usable value; issue.pattern on a failed z.email(); and the pattern that z.toJSONSchema() emits, which no longer carries a lookahead, so validators outside ECMAScript can compile it.

Composing an email into a template literal also stops applying its no-consecutive-dots rule to the rest of the string.

z.templateLiteral([z.email(), "|", z.string()]).parse("a@b.cc|a..b");
// 4.5: ❌ — the lookahead reached past the email segment — 4.6: ✅

⚠️ Chained checks no longer overwrite each other in JSON Schema

Each check used to write its own bounds into the schema as it attached, in chain order, so a format check applied after .min() and .max() replaced the tighter values with its own range. The converter folds the checks as a conjunction now. The order they are chained in no longer changes the output. (#​6554, #​6553)

z.toJSONSchema(z.number().min(0).max(23).int());
// 4.5: { minimum: -9007199254740991, maximum: 9007199254740991 }
// 4.6: { minimum: 0, maximum: 23 }

Runtime parsing enforced the bounds in every version. Only the emitted schema was wrong. The same fold fixes two more cases: a repeated multipleOf kept the first divisor and dropped the rest, so z.number().multipleOf(2).multipleOf(3) emitted a schema that accepts 4, and z.string().min(8).length(5) emitted minLength: 5, widening a bound the runtime still rejected. Closes #​6550.

⚠️ Metadata members materialize on first read

Eight members on a Zod Classic schema — .format, .minLength, .maxLength, .minValue, .maxValue, .isInt, .minDate and .maxDate — are computed from the checks now instead of being written onto every instance at construction. Each one is a prototype getter that becomes an own property on first read. (#​6554)

const s = z.string().min(3).max(9);

Object.keys(s); // 4.5: ["def", "type", "format", "minLength", "maxLength"] — 4.6: ["def", "type"]
s.minLength;    // 3 in both
Object.keys(s); // 4.6: ["def", "type", "minLength"]

A key is absent until something reads it, and Object.assign({}, schema) copies only the members that have been read. Deleting one restores the getter, and the next read recomputes it.

The values can move too, because the getters read the same fold the JSON Schema converter does. An order-dependent chain reports the tighter bound now instead of whichever check wrote last.

z.string().min(8).length(5).minLength; // 4.5: 5 — 4.6: 8

Commits

Zod 4.6 rolls up 72 commits.

• 661673ae docs: make the 9thCO logo visible on the light theme by @​colinhacks
• 6de10dce docs: reconcile the sponsor listings against every active sponsorship (#​6579) by @​colinhacks
• 213ee75d feat(compile): add z.withParser for externally generated parsers (#​6575) by @​colinhacks
• f9465d4e docs: reconcile the sponsor listings with active sponsorships (#​6576) by @​colinhacks
• f7fd5548 perf(v4): drop the lookaheads from the email regex (#​6573) by @​colinhacks
• 36f17960 fix(v4): stop the memoizer from pinning a finished parse (#​6572) by @​colinhacks
• 22bed613 feat(v4): add z.iban() string format with mod-97 checksum (#​6571) by @​colinhacks
• c5b9bcb3 bench: measure what a runtime island's leaked indent cost the generated source by @​colinhacks
• e54716cb docs(ecosystem): add @​apical-ts/craft (#​5946) by @​gunzip
• dcbcf052 fix(compile): unwind the doc indent when a child generator throws (#​6570) by @​colinhacks
• 277613a6 docs: move the release procedure to the maintainer-local notes by @​colinhacks
• eb1c1089 ci: release only on workflow_dispatch behind the npm environment (#​6569) by @​colinhacks
• 741981ff perf(compile): for-in record walk, cheaper issue finalization, and a generative compile differential (#​6567) by @​colinhacks
• 804e0f52 perf: seal the CommonJS exports so require("zod") stops reading through a getter (#​6564) by @​colinhacks
• 6f048367 fix(v4): derive JSON Schema constraints by folding checks in the converter (#​6554) by @​colinhacks
• e4d67f3e Migrate development and CI to Nub (#​6562) by @​colinhacks
• 7a002366 fix(v4): don't let format checks overwrite tighter min/max bounds (#​6553) by @​colinhacks
• 5489a532 test(v4): pin the check-chain case that keeps compiled validate's definite guard (#​6551) by @​colinhacks
• e7604717 docs: attribute the compiled failure cost to the fallback, not the double pass by @​colinhacks
• 764ac59f perf(v4): settle z.validate on the first failure in parse order (#​6544) by @​colinhacks
• 07917f4c test(v4): pin the lazy safeParse error's stack behavior (#​6548) by @​colinhacks
• 62e6624b feat(v4): add .validate() and .validateAsync() to Zod Classic (#​6547) by @​colinhacks
• cafbee47 fix(v4): parse recursive schemas built by a factory (#​6530) by @​colinhacks
• 4d730882 Release the parsed input once a failing safeParse builds its error (#​6543) by @​colinhacks
• 90269c60 Keep a numeric TS enum's reverse-mapping keys out of .options (#​6542) by @​colinhacks
• 18e71c71 Rename the JSON Schema process helper so bundler polyfills cannot collide (#​6541) by @​colinhacks
• 68aca3dc docs: cover the 4.5 API surface that never made it into the reference by @​colinhacks
• eca96871 fix(v4): enforce the six JSON Schema keywords fromJSONSchema silently dropped (#​6535) by @​colinhacks
• 81ded991 perf: answer z.validate from the compiled fast path on invalid input (#​6538) by @​colinhacks
• 51caf010 refactor: collapse cachedInternal back into cached (#​6540) by @​colinhacks
• abfb3897 feat(v4): make z.properties() a schema, and give z.instanceof() a .properties() method (#​6536) by @​colinhacks
• 69f2a7ff Collapse toZod's normalizer and move its docs to the API reference (#​6539) by @​colinhacks
• bf990216 perf: move util.cached's accessor to a prototype (#​6537) by @​colinhacks
• bec73bea perf(v4): build the safeParse error on first read (#​6519) by @​colinhacks
• 07c43e2a Keep the runtime base64 regexes linear so composed parse paths cannot overflow (#​6534) by @​colinhacks
• bc1157e7 docs: use a Response example for z.properties() by @​colinhacks
• 2ec972ec refactor: collapse toZod's enum leaf normalizer to a dummy union (#​6533) by @​colinhacks
• 68a609ac Widen literal inputs in property check types (#​6520) by @​colinhacks
• 0227e53d docs: bump the star pill's GitHub mark to 20px by @​colinhacks
• 84dd3b0f perf: build literal and enum pattern regexes lazily (#​6531) by @​colinhacks
• f83ab511 fix(v4): reject component-only strings from z.emoji() (#​6532) by @​colinhacks
• 74f9a6d3 docs: drop the toZod enum block from basics and pin the page's curation rule in a comment by @​colinhacks
• a2a019a5 Accept enum-typed targets in z.toZod (#​6528) by @​colinhacks
• 319f47f4 Emit a length-aware base64url pattern in toJSONSchema (#​6527) by @​colinhacks
• 08ba069e perf(v4): read Luhn digits with charCodeAt instead of string indexing (#​6529) by @​colinhacks
• 1ec6b7c5 docs: add an RSS feed to the blog at /blog/rss.xml by @​colinhacks
• b801439b bench: add typebox (compiled and dynamic) to the moltar cross-library harness by @​colinhacks
• 7ae49d64 docs: drop the circle around the star pill's GitHub mark and center it on the pill's arc by @​colinhacks
• 93f3ab32 docs: replace the blog navbar's GitHub icon with a star-count pill by @​colinhacks
• fb2fedfd docs: tighten the memory chart callout, pad the canvas, say "less memory" by @​colinhacks
• ff56a551 docs: center the memory chart callout labels and pad them off the number by @​colinhacks
• 8cd1250f docs: center the memory chart callout labels by @​colinhacks
• 3195ed01 docs: label the memory chart like the compile chart by @​colinhacks
• a6b49390 Mark the compile internals @​internal instead of hiding them (#​6518) by @​colinhacks
• 40b4d0b3 fix(ci): read zod's latest version with npm view when picking the backfill dist-tag by @​colinhacks
• 5ff95665 Stop re-exporting the compile internals from zod/v4/core (#​6511) by @​colinhacks
• f412178d ci: publish @​zod/mini to JSR in lockstep with npm (#​6510) by @​colinhacks
• f3e7c72e fix(docs): render the docs 404 page inside the (doc) layout once by @​colinhacks
• f3cb3644 docs: surface the blog on the home page and in the sidebar by @​colinhacks
• cd4f9a67 perf(v4): report Standard Schema issues without constructing a ZodError (#​6509) by @​colinhacks
• 43b9bfc5 docs: drop the bound-methods section from the Zod package page by @​colinhacks
• 70eb2c07 docs: drop the traits section and the compilation feature bullet by @​colinhacks
• 1c0bce0c docs: bring the 4.5 charts and worked examples into the docs pages by @​colinhacks
• a0898b4b ci: wait hours for npm to serve a publish, not ten minutes (#​6502) by @​colinhacks
• c46eeff0 chore: narrow blanket biome-ignore comments (#​6504) by @​pullfrog[bot]
• c7ec94d3 ci: check zod and @​zod/mini lockstep on npm after every publish (#​6507) by @​colinhacks
• 81065739 chore(docs): build with Turbopack by @​colinhacks
• abd41adb docs(wiki): move plans and comparisons into a gitignored internal/ (#​6506) by @​colinhacks
• 2956c4c2 chore(mini): sync @​zod/mini to 4.5.4 by @​colinhacks
• 8ce9e8d5 feat(mini): publish Zod Mini as the standalone @​zod/mini package (#​6491) by @​colinhacks
• 93186cab docs(wiki): drop the zod-compiler benchmark (#​6505) by @​colinhacks
• 908c9e17 fix(docs): retry the GitHub stars fetch and log the real status by @​colinhacks

v4.5.4

Compare Source

Commits:

• 84e416f fix(v4): stop the cycle walk from firing a default factory (#​6500)
• e8e206f 4.5.4

v4.5.3

Compare Source

Commits:

• e6b6ab3 docs(blog): widen the z.compile example to a 20-property schema
• 87d6464 fix(docs): drop the OG description when the title wraps past two lines
• 99fce39 bench(v4): z.compile() against zod-compiler (#​6499)
• e3a695b docs(v4): record the email regex and container output-shape findings under Open
• 7e24a24 docs(blog): drop the reading time and put a GitHub link in the navbar
• eab51ff fix(v4): emit record numeric keys as strings in toJSONSchema (#​6497)

v4.5.2

Compare Source

Commits:

• a354314 fix(docs): keep blog posts out of the docs collection (#​6484)
• d378c42 ci: drop canary publishing from the release workflow (#​6487)
• 212b941 fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#​6488)
• e7576f5 docs(blog): let the page show through the navbar in dark mode (#​6489)
• fedb06f fix(docs): match the blog TOC hover bar to the 2px active indicator
• 6c932fc chore: bump devcontainer image to Node 24 (#​6470)
• 6635d9d docs(blog): soften the "method memoization" attribution
• 019ae29 fix(docs): drop ISR on the docs route so the home page hydrates
• 652bb43 chore(docs): drop the scroll log from the route-change scroller
• 571c8e8 fix(docs): render blog tabs with the stock fumadocs tab card
• 9a193aa 4.5.2

v4.5.1

Compare Source

Commits:

• 2e862db ci: gate the GitHub release and JSR publish on the version being live on npm
• 8e03380 4.5.1

v4.5.0

Compare Source

Zod 4.5 is now available.

npm install zod@latest

At a glance:

• z.compile() — the flagship feature of Zod 4.5
• z.creditCard() — 12–19 digits plus Luhn checksum
• z.properties() — the multi-property counterpart to z.property()
• z.deepPartial()/.exactPartial()
• z.validate(): boolean — a fast-path to verify input validity without a full parse (up to 16x faster on invalid data)
• 9x reduction in memory footprint
• New locales: Bengali (bn), Central Kurdish (ckb), Hindi (hi), Kannada (kn), Norwegian Nynorsk (nn), Brazilian Portuguese (pt-BR), Slovak (sk), Turkmen (tk)

z.compile()

You can now pre-compile any Zod schema using z.compile(schema). This dramatically speeds up parsing performance.

import * as z from "zod";

const Player = z.object({
  username: z.string(),
  bio: z.string(),
  xp: z.number(),
  // ...20 more properties...
});

const CompiledPlayer = z.compile(Player);

A compiled schema can be used exactly like an uncompiled one. There are no special rules around compiled schemas. They're just faster.

Player.parse({ ... });
CompiledPlayer.parse({ ... }); // ~9x faster

On objects, arrays, and unions, this speeds up parsing by a factor of ~3–9. More complex schemas stand to benefit more than simpler ones.

Time per parse by schema type, standard parser vs compiled — lower is better (benchmark)

Below are the Moltar benchmark results comparing Zod (compiled and uncompiled) against the Moltar ParseSafe bench.

Throughput on the moltar benchmark fixture (parseSafe: returns a new object with unknown keys stripped) — higher is better (benchmark)

And the equivalent results for the Moltar AssertLoose bench. Tested against the new z.validate(schema, input) function (detailed later in the post).

Throughput on the moltar benchmark fixture (assertLoose: returns a boolean, unknown keys allowed) — higher is better (benchmark)

Zod's entire test suite runs twice—once normally and again with auto-compilation enabled globally—to ensure perfect fidelity.

How it works

Under the hood, z.compile() walks the entire schema once and produces a hyperoptimized snippet of flat, loop-free JavaScript that can validate inputs far faster than a standard runtime validator. This snippet can be executed via new Function() (effectively a more powerful eval) to serve as a fast-path validator. Schemas use this to "fast check" validity, falling back to the regular runtime logic on validation failure to provide granular error information.

Take this simple Point schema:

const Point = z.object({
  x: z.number(),
  y: z.number()
});

Here is the generated snippet for it:

const isPoint = new Function("input", `
  if (typeof input !== "object" || input === null) return false;
  if (typeof input.x !== "number") return false;
  if (typeof input.y !== "number") return false;
  return true;
`);

isPoint({ x: 1, y: 2 }); // true
isPoint({ x: "1" });     // false

For the large majority of inputs, the generated function validates the data with the fastest logic JavaScript can express: straight-line typeof checks and property reads, with no interpreter in between. When it can't handle an input, Zod falls back to the standard parser.

This is the function Zod generates for the Player schema above:

if (typeof input !== "object" || input === null || Array.isArray(input)) return INVALID;
const v0 = input["username"];
if (typeof v0 !== "string") return INVALID;
const v1 = input["bio"];
if (typeof v1 !== "string") return INVALID;
const v2 = input["xp"];
if (typeof v2 !== "number" || !Number.isFinite(v2)) return INVALID;
const v3 = { "username": v0, "bio": v1, "xp": v2 };
return v3;

Armed with the power of new Function(), this happens in-process at runtime. There is no need to integrate with your build system.

The compiled schema is purely additive on top of the existing schema. It tacks on the pre-compiled fast path for checking valid inputs. When invalid data is detected, it returns the INVALID symbol to signal that parsing should fall back to the uncompiled parser. This structurally prevents subtle deviations in error reporting between compiled and uncompiled variants.

import "zod/compile"

To compile every schema in an application, import zod/compile once at the top of your entry point. Every schema constructed after that import is automatically compiled the first time it's used to parse data.

import "zod/compile"; // must come before modules that define schemas
import * as z from "zod";

const schema = z.object({ name: z.string() });
schema.parse({ name: "ok" }); // compiled on first parse

It also works as a Node.js CLI flag, which guarantees it runs before any module defines a schema:

node --import zod/compile app.js

Or set preload in bunfig.toml or nub.jsonc.

{
  "preload": ["zod/compile"]
}

All schemas benefit to varying degrees, though complex object/tuple/array schemas benefit more than simple scalar validators.

Read the docs, or the full technical writeup: Introducing z.compile()

z.creditCard()

A new string format: 12–19 digits, optionally separated by single spaces or hyphens, with a valid Luhn checksum. (#​5931)

z.creditCard().parse("4111 1111 1111 1111"); // ✅
z.creditCard().parse("4111 1111 1111 1112"); // ❌ bad checksum

z.properties()

The multi-property counterpart to z.property(). (#​5912)

const httpsUrl = z.instanceof(URL).check(
  ...z.properties({
    protocol: z.literal("https:" as string),
    hostname: z.string().regex(z.regexes.domain),
  })
);

httpsUrl.parse(new URL("https://example.com")); // ✅
httpsUrl.parse(new URL("http://localhost")); // ❌ protocol

z.deepPartial()

Back in functional form after being removed as a method in Zod 4. (#​5928)

const Post = z.object({
  title: z.string(),
  author: z.object({ name: z.string(), email: z.string() }),
});

const PartialPost = z.deepPartial(Post);
type PartialPost = z.output<typeof PartialPost>;
// => { title?: string; author?: { name?: string; email?: string } }

PartialPost.parse({ author: {} }); // ✅

The result is still a ZodObject, so .shape and .extend() keep working.

.exactPartial()

Like .partial(), but wraps each field in z.exactOptional() instead of z.optional(): keys may be omitted, but an explicit undefined is rejected. This matches TypeScript's Partial<> under exactOptionalPropertyTypes. (#​6065)

const Recipe = z.object({ title: z.string(), servings: z.number() });

const PartialRecipe = Recipe.exactPartial();
PartialRecipe.parse({});                    // ✅
PartialRecipe.parse({ title: undefined });  // ❌

In Zod Mini it's a top-level function: z.exactPartial(Recipe).

z.validate()

Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a ZodError, which makes rejection cheap: on invalid input it is up to 16x faster than .safeParse().success. The return type is a guard on the schema's input type, and z.validateAsync() covers schemas with async refinements. (#​6471)

z.validate(z.string(), "hi"); // true
z.validate(z.string(), 42);   // false

z.input() / z.output()

Project a schema onto its input or output side. Useful for validating the two halves of a codec independently. (#​5928)

const isoDate = z.codec(z.iso.datetime(), z.date(), {
  decode: (s) => new Date(s),
  encode: (d) => d.toISOString(),
});

const Event = z.object({ name: z.string(), at: isoDate });

z.input(Event).parse({ name: "launch", at: "2024-01-01T00:00:00Z" }); // ✅
z.output(Event).parse({ name: "launch", at: new Date() });            // ✅

This is a no-op on schemas not containing codecs/pipes.

z.toZod<T>()

A utility to define a Zod schema that agrees exactly with a static type, often one that is handwritten or externally defined. (#​5913)

type Player = { username: string; xp: number };

const Player = z.toZod<Player>()(
  z.object({
    username: z.string(),
    xp: z.number(),
  })
);

Player.shape.username; // ZodString — the schema is returned unchanged

z.getDiscriminatedOption()

Extract a discriminated union member by discriminator value. (#​5947)

const Fruit = z.object({ type: z.literal("fruit"), seeds: z.boolean() });
const Veg = z.object({ type: z.literal("vegetable"), leafy: z.boolean() });
const Produce = z.discriminatedUnion("type", [Fruit, Veg]);

z.getDiscriminatedOption(Produce, "fruit"); // typeof Fruit
z.getDiscriminatedOption(Produce, "meat");  // ❌ TypeScript error

Cyclical inputs

Zod recursive schemas now support cyclical data. For bundle size reasons, Zod Mini requires you to register a memoizer explicitly. (#​6387, #​6482)

Zod

const Category = z.object({
  name: z.string(),
  get subcategories() {
    return z.array(Category);
  },
});

const input: any = { name: "root", subcategories: [] };
input.subcategories.push(input);

const result = Category.parse(input);
result.subcategories[0] === result; // true

Zod Mini

// register a memoizer before defining any schemas
z.config({ memoizer: z.memoizer() });

const result = Category.parse(input);
result.subcategories[0] === result; // true

9x reduction in schema memory footprint

In Zod 4.4 a bare z.string() retained 7.5kb of heap. In Zod 4.5 it retains 784 bytes.

Retained heap per schema instance, Zod 4.4.3 vs 4.5 (benchmark)

In Zod 4.4 and earlier, all schema methods were automatically bound to the instance itself. This allowed users to pluck methods from schemas without causing issues due to this-binding.

const { parse } = z.string();

parse("some data");

A consequence of this is that each bound method allocates space on the heap; method implementations are not shared across all instances via prototype, as you'd expect. Zod 4.5 implements a method memoization pattern that avoids allocating bound methods until they are actually accessed.

Read the deep dive: Reducing Zod's memory footprint by an order of magnitude

Faster failures

Zod .parse()/.safeParse() instantiates a JavaScript Error, which captures a stack trace. In the case of validation failures, this is often much slower than the parsing logic itself. When using .safeParse(), Zod no longer captures this stack trace, speeding up failure-path parses by a factor of ~7.5x. (#​6316, #​6450)

const result = Player.safeParse({ username: 42, bio: "hello", xp: 12 });
result.success; // false — ~7.5x faster than Zod 4.4

Player schema (benchmark)

Symbol keys in z.object()

A shape can now declare a symbol key. TypeScript tracks it: a const symbol infers as unique symbol, so z.infer makes the key required and checks its value type. Undeclared symbol keys are still ignored. (#​6448)

const TAG = Symbol("tag");
const schema = z.object({ name: z.string(), [TAG]: z.number() });

schema.parse({ name: "alice", [TAG]: 42 }); // ✅ { name: "alice", [TAG]: 42 }
schema.safeParse({ name: "alice" });        // ❌ the symbol key is required

Bug fixes

All of these fix soundness issues, so a schema that relied on the old behavior may now reject input it used to accept.

⚠️ z.iso.datetime() requires seconds

RFC 3339 mandates seconds. z.iso.datetime() and z.iso.datetime({ offset: true }) no longer accept minute-precision input like 2020-01-01T06:15Z. local: true still admits 2020-01-01T06:15, since an unqualified datetime is outside RFC 3339 either way. (#​6457)

z.iso.datetime().parse("2020-01-01T06:15:00Z"); // ✅
z.iso.datetime().parse("2020-01-01T06:15Z");    // ❌ was accepted in 4.4

To accept both forms, union the two precisions:

z.union([z.iso.datetime(), z.iso.datetime({ precision: -1 })]);

⚠️ String length counts code points

.min(), .max(), and .length() counted UTF-16 code units, so z.string().max(5) rejected five emoji. They now count Unicode code points, which is what every non-JS consumer of a length bound does (Postgres, MySQL, Go, Python, and the maxLength that z.toJSONSchema() emits). .max() only loosens; .min() and .length() tighten for astral input. Graphemes are unchanged — a ZWJ sequence is still several code points. (#​6441)

z.string().max(5).parse("😀😀😀😀😀"); // was too_big, now passes
z.string().min(5).parse("😀😀😀");     // was fine, now too_small

Closes #​3355.

⚠️ Record keys and intersections match TypeScript

A record's key schema now governs only the keys that match it, the way TypeScript treats an index signature. Intersecting an object with a pattern-keyed record no longer rejects the object's own keys. (#​6412)

z.object({ name: z.string() })
  .and(z.record(z.string().regex(/^S_/), z.string()))
  .parse({ name: "a", S_a: "s" });
// 4.4: throws invalid_key on "name"
// 4.5: { name: "a", S_a: "s" }

Separately, an unrecognized_keys issue no longer aborts the schema it came from, so a strict object with an extra key and a bad value now reports both issues instead of just the first. Closes #​2200, #​2573, #​4017, #​5663.

⚠️ __proto__ is always stripped

Object and record parsers now drop a __proto__ key whether it comes from the input, is declared by the schema, or is produced by a record key transform. A key that a record's key schema normalizes to __proto__ is dropped too. .strict() reports an own __proto__ input key as unrecognized_keys instead of silently swallowing it. Error formatters and both JSON Schema converters use own-property writes so a toString or constructor path segment can't walk onto Object.prototype (#​6213, #​6367, #​6346). (#​6386, #​6354, #​6355, #​6221)

⚠️ Stricter string formats

• z.ipv6() validated by handing the string to new URL(), which let ::@1\ and ::1\n through. It now checks the address alphabet directly (#​6442).
• z.ulid() restricts the first character to 0–7; anything higher overflows the 48-bit timestamp. A fixture that doesn't start with a real timestamp, such as one with a leading letter, is now rejected (#​6095).
• z.httpUrl() enforces the RFC 1035 length limits on the host, matching z.hostname() (#​6035).
• z.emoji() no longer backtracks exponentially on a failed match (#​6347).
• z.string().includes(sub, { position: N }) emits a JSON Schema pattern that allows at least N leading characters, matching String.prototype.includes (#​6024).

Commits

Zod 4.5 rolls up 155 commits. Thanks to everyone who contributed: @​dokson, @​deepshekhardas, @​zirkelc, @​francisjohnjohnston-web, @​MerlijnW70, @​codinsonn, @​oimo23, @​JSap0914, @​zelinewang, @​abhishek-chaudhary2003, @​spokodev, @​Mohammad-Faiz-Cloud-Engineer, @​hamed-bavar, @​MGPOCKY, @​ChiChuRita, @​dinwwwh, @​thristhart, @​tsmartin9, @​vedanshshetti, @​belicam, @​frastefanini, @​andersk, @​musaddiq-rafi, @​tachmyratsaparmyradov, @​arvindfroi, @​KUMachine, @​spidersouris, @​catdalfonso, @​mneetika, @​gwagjiug, @​MahinAnowar, @​MaksZhukov, @​emmayusufu, @​agcty, @​devareddy05, @​Vish05, @​yamcodes, @​mattiasahlsen, @​samchungy, @​ozzyfromspace, @​udohjeremiah, @​patrickwehbe, @​gajus, @​Harm-Nullix, @​thwbh, @​IdanGonen, @​irfanfandi, @​JuerGenie, @​marcalexiei, @​itsahmedbilal, @​DucMinhNe, @​meliharik.

• 9782f87c perf(v4): validate without building the output, and keep schemas out of dictionary mode (#​6480) by @​colinhacks
• 773a4867 refactor(v4): declare a trait's members on $constructor (#​6478) by @​colinhacks
• 68fb3f13 feat(v4): make z.compile() fall back instead of throwing (#​6479) by @​colinhacks
• 37b01501 feat(v4): add z.isValid and z.isValidAsync (#​6471) by @​colinhacks
• 749f5452 docs: add fullproduct.dev to v4 ecosystem page (#​6001) by @​codinsonn
• 24cdb7fd perf(v4): close the fastpass bindings into the compiled parser (#​6464) by @​colinhacks
• 8d896186 fix(v4): stop emitting a multipleOf that JSON Schema rejects (#​6468) by @​colinhacks
• 43f729db feat(v4): make a tuple's items optional with .partial() (#​6465) by @​colinhacks
• 97edaf7d fix(v4): don't throw from safeParse on bigint multipleOf(0n) (#​6466) by @​colinhacks
• 21a6f0cb feat(v4): let z.nanoid() take a custom length (#​4004) by @​oimo23
• 9d5b20ef fix(v4): restrict the first ULID character to [0-7] (#​6095) by @​JSap0914
• 1cf9cd09 docs: record that error maps run per parse, and how to translate at render by @​colinhacks
• 7ce3e77d fix(v4): run a wrapper's inner schema on its own payload (#​6462) by @​colinhacks
• 7b612b53 fix(v4): fold an intersection of object schemas into one object (#​6461) by @​colinhacks
• 1c43b774 docs(v4): record why the failure path is not worth compiling by @​colinhacks
• badf0b78 fix(v4): build the catch context from the input that failed (#​6192) by @​zelinewang
• a87ac366 fix(v4)!: distinguish number and bigint formats at the type level (#​6052) by @​abhishek-chaudhary2003
• 6726c1dd docs: record what z.input and z.output do with transforms and wrappers by @​colinhacks
• 7cfc0122 fix(v4): keep a wrapper's stored value only on the side it belongs to by @​colinhacks
• a825c1b0 fix(v4): empty enums and literals match nothing (#​6459) by @​colinhacks
• 7c070db9 feat(v4): expose the function schema on .implement() results (#​6267) by @​deepshekhardas
• 3a496968 fix(v4): make record input keys optional when the value can fill them (#​6460) by @​colinhacks
• 53cec2a0 fix(v4): resolve z.input past a preprocess transform by @​colinhacks
• 2125d30c fix(v4): accept exact decimal multiples in multipleOf (#​6223) by @​spokodev
• 168122fc fix(v4): carry a pipe's own checks through z.output by @​colinhacks
• 51a1368a fix(v4): let the includes(position) pattern match at or after the offset (#​6024) by @​francisjohnjohnston-web
• 72a05c4f feat(v4): expose stringbool truthy/falsy/case via _zod.bag (#​6357) by @​hamed-bavar
• 036b39f4 fix(v4)!: require seconds once a datetime carries a Z or an offset (#​6457) by @​colinhacks
• 5825605e perf(v4): skip the eager stack capture when building a ZodError (#​6450) by @​colinhacks
• d85472c4 feat(v4): support declared symbol keys in z.object() (#​6448) by @​colinhacks
• d4108872 fix(v4): correct the date/time format keywords in both JSON Schema directions (#​6452) by @​colinhacks
• 555e5f46 Add z.toZod helper (#​5913) by @​colinhacks
• e0e51a55 docs(v4): cut the compile comments down to what they explain (#​6449) by @​colinhacks
• 6574e784 fix(v4): stop catch resurrecting issues an optional already resolved (#​6440) by @​colinhacks
• 937b5d01 perf(v4): prefix issue paths in place in the object JIT failure path (#​6445) by @​colinhacks
• b63db248 fix(v4): keep a memoized node's cached issues private to the cache (#​6443) by @​colinhacks
• 6ec3d043 fix(resolution): keep pnpm's own warnings out of the attw snapshot (#​6446) by @​colinhacks
• 830ba314 fix(v4): validate the address, and return the string that was validated (#​6442) by @​colinhacks
• f101d8ca Preserve callsites in parse stack traces (#​5910) by @​colinhacks
• 6c77d028 feat: compact simple anyOf unions to type array in toJSONSchema (#​6339) by @​deepshekhardas
• 28e1ebd8 fix(v4): measure string length in Unicode code points (#​6441) by @​colinhacks
• 060bc9f3 refactor: share default when-clauses for size/length checks (#​6394) by @​zirkelc
• 2848177d docs: point the flattened/formatted error deprecations at a symbol that exists by @​colinhacks
• 3c2dee9e Add properties checks for instanceof schemas (#​5912) by @​colinhacks
• 87ffeb0f fix(v4): an absent key on the middle rung supplies nothing (#​6434) by @​colinhacks
• 7785fc82 feat(v4): add z.getDiscriminatedOption (#​5947) by @​dokson
• 0135c85a feat(v4): allow passing extra args to apply() (#​6337) by @​deepshekhardas
• ca246d26 fix(v4): drop empty alternation branch from datetime pattern (#​6439) by @​colinhacks
• e073d55b docs: z.iso.datetime() accepts a subset of ISO 8601, not all of it by @​colinhacks
• d6ca12ae fix(v4): infer recursive getter options in discriminatedUnion (#​6422) by @​colinhacks
• dc51404b Add shorn to Zod Utilities (#​6398) by @​ChiChuRita
• 580111da docs: mark AOT compilation as canary-only by @​colinhacks
• 6b0dae79 docs: note that a catch callback is not islanded by @​colinhacks
• 898c4461 refactor(v4): give the runtime and compiled code one URL implementation by @​colinhacks
• 260e5d4b fix(v4): stop islanding a catch callback, which diverged silently by @​colinhacks
• 11c9268b revert(core): drop the exactOptional parse prototype from #​6432 (#​6438) by @​colinhacks
• a38ab4a8 fix(core): an omittable discriminator claims undefined (#​6432) by @​colinhacks
• c9ec89e0 perf(core): drop the seal and the per-key WeakSet from the lazy internals (#​6435) by @​colinhacks
• 3c9ca1d9 feat(json-schema): emit a root $ref when the root schema has an id (#​6029) by @​dinwwwh
• fa77a4d7 feat(v4): z.compile — ahead-of-time schema compilation (#​6085) by @​colinhacks
• f300476d fix(v4): let a schema's error map cover its own checks' issues (#​6426) by @​colinhacks
• 9f0a3d81 fix(core): restore defineLazy semantics lost in the internals move (#​6429) by @​colinhacks
• 604464c3 fix(locales): da/nn/no/sv called an IP address a range (#​6430) by @​colinhacks
• 7378e7cd fix(locales): backfill the mac and Sizable.map gaps, and pin dictionary parity (#​6427) by @​colinhacks
• b1077f05 perf(memory): install derived internals on a per-constructor prototype (#​6415) by @​colinhacks
• ccc15144 fix(locales): add the credit_card key to the seven locales missing it (#​6424) by @​colinhacks
• 73bacbbb fix(from-json-schema): drop redundant inclusive bound for draft-04 exclusive ranges (#​6022) by @​francisjohnjohnston-web
• 86b2e6da docs: list el and hr in the supported locales (#​6423) by @​colinhacks
• 45fdeda5 fix(v4): refine optin into a three-rung ladder, retire the fallback payload flag (#​6419) by @​colinhacks
• 5b34c0ce Improve Portuguese localization and add Brazilian Portuguese (pt-BR) (#​6076) by @​thristhart
• dc1a40a5 fix(locales): improve french translation (#​6120) by @​tsmartin9
• 0175a043 feat(locales): add Hindi and Kannada locale support (#​6315) by @​vedanshshetti
• 536ee3b0 Locales: added Slovak (sk) language (#​6041) by @​belicam
• 07b0c3d8 fix: preserve explicit superRefine issue input (#​6053) by @​frastefanini
• ba98071c feat: add .exactPartial() to ZodObject (#​6065) by @​andersk
• 234c407d feat(lang): Added Bengali locale (#​5974) by @​musaddiq-rafi
• 377cd9d7 feat(locales): add turkmen (tk) locale (#​6168) by @​tachmyratsaparmyradov
• 69b6bb08 feat(locales): add Norwegian Nynorsk (nn) locale (#​6092) by @​arvindfroi
• 33d82e6b Add Central Kurdish (ckb) locale (#​6078) by @​KUMachine
• 06666fe2 fix(fr): remove hyphen in "non-optionnel" (#​5999) by @​spidersouris
• 79cfedea feat(v4): expose the owning schema on check-originated issues (#​6420) by @​colinhacks
• 436b5da8 docs: propose compiled constructor graph by @​colinhacks
• eb4682c9 fix(json-schema): resolve tuple minItems past transform and catch in input mode (#​6418) by @​colinhacks
• 4d6b5cd3 fix(json-schema): route unrepresentable default values through unrepresentable by @​colinhacks
• 2abc9e05 docs: note that the JSON Schema emitter reads static optin (#​6417) by @​colinhacks
• 578e1cd0 feat(v4): support format: "hostname" in fromJSONSchema (#​6305) by @​catdalfonso
• 942bf8cb feat(v4): parse input containing reference cycles (#​6387) by @​colinhacks
• 78b523f0 fix(json-schema): keep preprocess object properties required in input mode (#​6133) by @​MerlijnW70
• 973b1b44 fix(v4): strip output-typed catch values from the input JSON Schema (#​6409) by @​colinhacks
• 5e608851 feat(v4): add z.deepPartial and runtime z.input / z.output (#​5928) by @​dokson
• 4e1720c8 fix(v4): align record keys and intersection strictness with TypeScript (#​6412) by @​colinhacks
• 4cc4053d fix: honor loose mode for closed record key schemas (#​6157) by @​pullfrog[bot]
• 69be843f fix(v4): stop the object JIT fastpass keeping a swallowed issue's value (#​6407) by @​colinhacks
• b899cd17 perf(json-schema): make toJSONSchema(registry) linear in registry size (#​6408) by @​colinhacks
• 6074828e fix(v4): make fromJSONSchema propertyNames compose with the other object keywords (#​6411) by @​colinhacks
• d7b209f3 docs: point the Web URLs callout at z.httpUrl() (#​6410) by @​colinhacks
• 611bd762 fix(mini): make merge() take an object schema, matching classic (#​6404) by @​colinhacks
• b53e53cc fix(v4): use exact flag in English locale too_small/too_big messages (#​6177) by @​pullfrog[bot]
• 421cc9a5 fix(json-schema): unescape JSON Pointer tokens when resolving $ref (#​6402) by @​colinhacks
• 4c27fe87 fix(v4): give z.xor() a distinct error when multiple options match (#​6376) by @​colinhacks
• a106fbe7 fix(v4): make fromJSONSchema tuples open-ended by default (#​6020) by @​mneetika
• e8034eba fix(v4): make prefixItems/draft-7 items respect minItems in fromJSONSchema (#​6201) by @​pullfrog[bot]
• 784e5c26 fix(v4): let bundlers tree-shake locales out of the default import (#​6384) by @​colinhacks
• 97edd70a fix(toJSONSchema): constrain closed tuple length (#​6194) by @​pullfrog[bot]
• f150020d fix(v4): escape non-string enum values in template literal patterns (#​5934) by @​gwagjiug
• faf33a28 fix: surface @​deprecated on re-exported compat aliases (#​6072) by @​MahinAnowar
• 3956224a docs: state that metadata wins over generated JSON Schema keywords (#​6401) by @​colinhacks
• a1904fc2 fix(v4): report date origin for numeric min/max bounds (#​6129) by @​MerlijnW70
• bd18314c fix: escape JSON Pointer reserved characters in toJSONSchema $ref (closes #​6027) (#​6144) by @​MaksZhukov
• 2a5164f5 fix(v4): enforce RFC 1035 length limits in regexes.domain (#​6035) by @​emmayusufu
• 0e5bc4b1 fix(v4): respect additionalProperties:false with patternProperties in fromJSONSchema (#​6199) by @​pullfrog[bot]
• c8f06d36 fix(v4): clarify infinite number errors (#​5906) by @​colinhacks
• 9a7ecc35 fix(json-schema): accept RFC 3339 numeric offsets in date-time format (#​6298) by @​agcty
• 0a76f3d7 feat(v4): add z.creditCard() string format (#​5931) by @​dokson
• bd6619c0 feat(json-schema): accept a function for unrepresentable (#​6380) by @​colinhacks
• 9d20fdc3 fix(v4): preserve z.preprocess input narrowing (#​5967) by @​devareddy05
• 3063993a perf(v4): cut per-schema memory ~90% by moving methods to the prototype (#​6318) by @​zirkelc
• fd074106 feat(json-schema): run override before the unrepresentable error (#​6391) by @​colinhacks
• 2715c12e fix(v4): preserve default English locale across tree-shaken bundles (#​5959) by @​colinhacks
• 81d9fc6c docs: add zod-form-action to ecosystem (#​6314) by @​Vish05
• d86df5e0 docs: add ArkEnv to ecosystem page (#​6203) by @​yamcodes
• 18b4ff99 docs(ecosystem): add zodql to API Libraries (#​6227) by @​mattiasahlsen
• 479d6f51 shill oxlint (#​6196) by @​samchungy
• 85dba7e1 docs: document that any/unknown object keys are required (#​6388) by @​colinhacks
• d24fb4c3 fix: consistently strip proto from parsed objects (#​6386) by @​colinhacks
• 7708d447 perf(v4): lazy ZodError construction (#​6316) by @​zirkelc
• 8ac9ae51 fix(docs-v3): serve the docsify SPA fallback on Vercel (#​6378) by @​colinhacks
• 31384464 fix(v4): complete reserved-key hardening (#​6371) by @​colinhacks
• 600c6909 docs: add Attaform to ecosystem (#​6188) by @​ozzyfromspace
• 37c05fa5 docs(ecosystem): rename zod-to-mongo-schema to zod-mongo-schema (#​6178) by @​udohjeremiah
• badfdf08 docs: update keyof() ZodEnum type to the v4 form (#​6124) by @​patrickwehbe
• e25b68e1 perf(v4): let three dead declarations tree-shake under esbuild (#​6381) by @​colinhacks
• 53397351 docs(ecosystem): Add zod-mongoose list item in Zod To X (#​6062) by @​Harm-Nullix
• dfa0deb1 docs: add tauri-typegen to ecosystem (#​6032) by @​thwbh
• 9c914ee8 docs: add dynamic error message and combined refinement examples for refine() (#​6002) by @​IdanGonen
• 921649de fix(v4): formatError and treeifyError handle inherited-name path elements (#​6367) by @​deepshekhardas
• e7029aa4 fix(v4): report own proto key under .strict() (#​6221) by @​pullfrog[bot]
• 9c540db8 fix(v4): re-check the record key after the key schema runs (#​6355) by @​colinhacks
• 8bb89ea4 docs: add .nonempty() to Strings, Arrays, Sets, and Maps sections (#​6056) by @​pullfrog[bot]
• 599c0e41 docs(ecosystem): Add @chrock-studio/overload and @chrock-studio/zod-utils (#​6040) by @​JuerGenie
• 27a9036a docs(ecosystem): eslint-plugin-zod is eslint-zod now (#​5975) by @​marcalexiei
• e177a0ee docs(v4): document coerce missing-key breaking change (#​5957) (#​5964) by @​dokson
• 66fba964 docs: show z.instanceof with built-in classes (#​6059) by @​itsahmedbilal
• 2d90846a fix(docs): make the prefault example runnable (#​6063) by @​DucMinhNe
• ead9fcb3 fix(v4): write a declared proto key as an own property (#​6354) by @​colinhacks
• c58764c5 docs: fix UUID helper list in v4 introduction (#​6214) by @​meliharik
• f238fbd2 fix: remove exponential backtracking from the emoji regex (#​6347) by @​colinhacks
• e6c213ec fix(json-schema): keep proto keys as own properties in schema conversion (#​6346) by @​colinhacks
• 573fcb75 fix(errors): use own-property semantics in every error-tree walker (#​6213) by @​pullfrog[bot]
• 6f5e99fd fix(docs-v3): rename README.md to home.md so Vercel serves it by @​colinhacks
• bbc68f99 docs: soften Zod 3 EOL callouts to informational tone by @​colinhacks
• 3fc9b25f docs: reframe library-authors page Zod-4-first; note Zod 3 EOL by @​colinhacks
• f29f2a6d fix(v4): cidrv6 JSON schema pattern matches runtime (#​5945) by @​dokson
• dfd8766b fix(v4): break circular import between classic schemas and iso (#​5275) (#​5926) by @​dokson
• fbe8ad1b fix(v4): allow dynamic .catch() under unrepresentable: "any" (#​5273) (#​5925) by @​dokson

v4.4.3

Compare Source

Commits:

• 4c2fa95 docs: use Zernio primary wordmark for gold sponsor logo
• 2aeec83 docs: prune lapsed gold sponsors and rebalance logo sizing
• 7391be8 docs: prune lapsed silver/bronze sponsors and add active ones
• 2c70332 docs: normalize bronze sponsor logos to github avatar pattern
• 9195250 docs: remove Mintlify from bronze sponsors (churned)
• b8dffe9 docs: remove Numeric and Speakeasy (2+ missed monthly cycles)
• 1cab693 fix(v4): restore catch handling for absent object keys (#​5937) (#​5939)
• c2be4f8 fix(v4): generalize optin/fallback to transform; restore preprocess on absent keys (#​5941)
• f3c9ec0 4.4.3
• 1fb56a5 docs: document release procedure in AGENTS.md

v4.4.2

Compare Source

Commits:

• 0c62df0 Clean up docs navigation and stale labels (#​5901)
• 20cc794 chore: add security policy and refresh tooling deps
• 6fbe07b fix(docs): heading anchor links now include the hash so it doesnt scoll all the way up, follows navbar logic (#​5791)
• 4bbed1b Tighten discriminated union option typing
• bbac3e5 Update PR guidance for agents
• cf0dc94 Merge remote-tracking branch 'origin/main' into fix-discriminated-union-key-constraint
• 292c894 docs: add Zernio gold sponsor
• 1fc9f31 docs: document codec inversion
• 1373c85 docs: remove AI disclosure guidance
• e20d02b chore: ignore triage notes
• e58ea4d docs: test Zod Mini tab code heights
• 905761a docs: document preprocess input type narrowing
• bf64bac chore: tighten test guidance in AGENTS.md
• 8ec4e73 chore: update play.ts scratch
• 02c2baf Make z.preprocess defer optionality to inner schema (#​5929)
• 88015df fix(docs): drop deprecated baseUrl from tsconfig
• c59d447 4.4.2

v4.4.1

Compare Source

Commits:

• 481f7be ci: gate release publishing on full test workflow
• 95ccab4 test(v3): restore optional undefined expectations
• cede2c6 fix(v4): reject tuple holes before required defaults (#​5900)
• edd0bf0 release: 4.4.1
• 180d83d docs: remove Jazz featured sponsor

v4.4.0

Compare Source

4.4.0

This is a minor release with a wide set of correctness and soundness fixes. Some fixes intentionally make Zod stricter, so code that depended on previously accepted invalid or ambiguous inputs may need small updates.

Potentially breaking bug fixes

Tuple defaults now materialize output values correctly

Fixed in #​5661. Tuple parsing now more accurately reflects defaults, optional tails, explicit undefined, and under-filled inputs. The headline behavior is that defaults in tuple positions now properly appear in parsed output.

const schema = z.tuple([
  z.string(),
  z.string().default("fallback"),
]);

schema.parse(["a"]);
// ["a", "fallback"]

Trailing optional elements that are absent still stay absent; they are not filled with undefined.

const schema = z.tuple([
  z.string(),
  z.string().optional(),
]);

schema.parse(["a"]);
// ["a"]

But explicit undefined values supplied by the caller are preserved.

schema.parse(["a", undefined]);
// ["a", undefined]

When optional elements appear before later defaults, the parsed tuple is now dense so array operations behave predictably.

const schema = z.tuple([
  z.string(),
  z.string().optional(),
  z.string().default("fallback"),
]);

schema.parse(["a"]);
// ["a", undefined, "fallback"]

Tuple length errors are also more consistent now. Since z.function() arguments are tuple-shaped, function input errors may look different.

Required object properties with z.undefined()

Fixed in #​5661, with follow-up coverage in 57d80a82. A property whose schema is z.undefined() is now treated as required. The key must be present, but its value may be undefined.

const schema = z.object({
  value: z.undefined(),
});

schema.safeParse({}).success;
// false

schema.safeParse({ value: undefined }).success;
// true

Use .optional() when the key itself may be absent.

const schema = z.object({
  value: z.undefined().optional(),
});

schema.safeParse({}).success;
// true

This also affects related .catch(), .partial(), .default(), and .prefault() combinations that previously relied on missing z.undefined() keys being treated as optional.

Safer .merge() behavior with refinements

Fixed in #​5856. The .merge() method now throws when the receiver has refinements, rather than silently producing ambiguous refinement behavior. Refinements from the second schema are preserved.

const a = z.object({ a: z.string() }).refine((val) => val.a.length > 0);
const b = z.object({ b: z.string() });

a.merge(b);
// throws

Prefer .extend() or .safeExtend() for object composition. The .merge() method is still supported for compatibility, but it is discouraged for new code because its semantics around overlapping keys and refinements are easier to misread.

JSON Schema $defs entries no longer include redundant id

Fixed in #​5759. JSON Schema conversion through z.toJSONSchema() now strips redundant id fields from $defs entries. This is required for correctness in older JSON Schema dialects from before $id was introduced: in those dialects, id changes the resolution scope, so leaving it inside an extracted definition can make references resolve incorrectly. The removed value was redundant because the schema had already been extracted into $defs, so the definition key itself is the identifier. This may affect consumers that were reading those internal id fields directly.

Other JSON Schema fixes in this release:

• Draft-04/OpenAPI 3.0 min/max intersections: #​5700
• Recursive lazy schemas with .describe(): #​5797
• Falsy prefault values emitted as defaults: #​5893
• CUID pattern output tightened: #​5880

String validators are stricter

Base64 validation now rejects whitespace instead of allowing atob()-style whitespace stripping. Fixed in #​5888.

z.base64().safeParse("Zm9v").success;
// true

z.base64().safeParse("Zm 9v").success;
// false

Other string validator changes:

• CUID validation through z.cuid() has been tightened, and CUID v1 is now deprecated. Fixed in #​5880.
• HTTP URL validation through z.httpUrl() now rejects malformed HTTP(S) URLs with a missing slash after the protocol. The underlying URL constructor normalizes inputs like https:/example.com, but Zod now rejects them instead of accepting the repaired URL. Fixed in #​5672, related to #​5284.

z.httpUrl().safeParse("https://example.com").success;
// true

z.httpUrl().safeParse("https:/example.com").success;
// false

z.httpUrl().safeParse("http:/www.apple.com").success;
// false

Union paths are fixed in formatted errors

Two union-related error fixes landed:

• Nested union paths are now preserved correctly in the output of z.treeifyError() and z.formatError(). Fixed in #​5708 and 60ff3987.
• Invalid discriminated union errors now include discriminator options and improved messages. Fixed in #​5723. This may affect users snapshotting ZodError output.

Other fixes

Record key transforms now run

Fixed in #​5891. Record schemas now run transforms on record keys.

const schema = z.record(
  z.string().transform((key) => key.toUpperCase()),
  z.number()
);

schema.parse({ foo: 1 });
// { FOO: 1 }

Related record fixes:

• Key refinement failures now surface as structured invalid_key issues. Fixed in #​5719.
• Non-enumerable properties are skipped more consistently. Fixed in #​5719.
• The v3-style single-argument z.record(valueType) form works again. Fixed in 0e960108.

Metadata and input handling in fromJSONSchema()

Schema generation from JSON Schema now applies metadata more consistently across enum, const, not, anyOf, and multi-type schemas. Fixed in #​5758. It also rejects or normalizes more non-JSON-like inputs, including cyclic objects and BigInt. Fixed in 87cf0f93.

Codecs

Codec changes:

• Encoding through z.discriminatedUnion().encode() now works when the discriminator uses a codec. Fixed in #​5769.
• Codec inversion was added in #​5770.

const stringToNumber = z.codec(
  z.string(),
  z.number(),
  {
    decode: Number,
    encode: String,
  }
);

const numberToString = z.invertCodec(stringToNumber);

Transform context

Transform callbacks now support ctx.addIssue(). Fixed in #​5699.

Conditional .superRefine() with when

The when option was added for .superRefine(). Added in #​5741, with related abort behavior fixed in #​5681.

Defaults for Map and Set

Defaults for Map and Set are now cloned instead of shared across parses. Fixed in #​5855.

const schema = z.map(z.string(), z.number()).default(new Map());

const a = schema.parse(undefined);
const b = schema.parse(undefined);

a === b;
// false

Empty unions

Empty z.union([]), z.xor([]), and discriminated unions no longer crash at construction time. They construct and fail at parse time. Fixed in #​5869.

Floating-point multiples

Number multipleOf() / step() validation is more accurate for decimal and exponent edge cases. Fixed in #​5687 and #​5793.

Global config and jitless

Configuration fixes:

• Global configuration is now shared through globalThis, improving behavior across mixed CJS/ESM module instances. Fixed in #​5889.
• Jitless mode now avoids eval probing when set before first access. Fixed in #​5864.

Prototype pollution hardening

Object catchall paths now skip __proto__ keys. Fixed in #​5898.

Performance improvements

Reduced memory usage from lazy-bound methods

Fixed in #​5897. Classic builder methods are now lazy-bound through a shared internal prototype instead of eagerly attached per schema instance. This significantly reduces per-schema method allocation overhead, especially in codebases that construct many schemas. Detached methods continue to work:

const schema = z.string();
const optional = schema.optional;

optional.call(schema);
// still works

Improved tree-shaking

Implemented in 195e8696 and #​5689. Top-level factory calls are annotated as pure, and generated stub package manifests now include sideEffects: false. This gives bundlers more room to remove unused Zod code.

This is intended as the conclusive fix for a long-standing class of tree-shaking and bundle-size issues, especially in Next.js and Turbopack projects. The most visible symptom was that unused validators and locales could survive bundling even when importing from zod/mini or from a narrow subpath.

Related reports include:

• Next.js and Turbopack tree-shaking reports: #​4433, #​5641, #​5095, #​4810
• Locale and zod/mini bundle-size reports: #​5561, #​5665, #​4369, #​4572
• Broader v4 bundle-size reports: #​2596, #​4637, #​4798, #​5206

{
  "sideEffects": false
}

Locales

Added or updated locale support:

• Croatian: #​5610
• Greek: #​5840
• Romanian: #​5657
• Uzbek map support: #​5599
• Georgian translation fix: #​5655
• French issue origin translations: #​5845
• Italian validation message updates: #​5852

Locale message text changed in some cases, which may affect snapshots.

Closed issues

The following issues were closed by PRs included in this release:

• Closed #​5466 via #​5632: preserve context immutability in parse functions.
• Closed #​5617 via #​5655: correct Georgian translation for string.
• Closed #​5619 via #​5657: add Romanian locale.
• Closed #​5229 via #​5661: align object and tuple optionality handling.
• Closed #​5680 via #​5681: respect abort: true in .refine() checks with when.
• Closed #​5678 via #​5699: add missing addIssue to transform context.
• Closed #​5717 via #​5718: avoid delete in finalizeIssue.
• Closed #​5714 via #​5719: skip non-enumerable properties in record validation.
• Closed #​5670 via #​5723: add discriminator options to invalid discriminator errors.
• Closed #​5743 via #​5744: increase timeout for the datetime ReDoS checker test.
• Closed #​5732 via #​5758: apply description and default metadata in fromJSONSchema().
• Closed #​5731 via #​5759: strip redundant id from $defs entries in JSON Schema output.
• Closed #​5605 via #​5763: update z.custom() docs for v4 compatibility.
• Closed #​5593 via #​5769: support discriminatedUnion().encode() with codec discriminators.
• Closed #​5625 via #​5770: add codec inversion.
• Closed #​5778 via #​5779: add custom docs 404 page.
• Closed #​5792 via #​5793: correct floating-point multipleOf() validation.
• Closed #​5777 via #​5797: resolve recursive lazy JSON Schema stack overflow.
• Closed #​5805 via #​5812: fix self-referencing schema docs.
• Closed #​5826 via #​5855: clone Map and Set defaults.
• Closed #​5842 via #​5856: align .merge() refinement semantics with .extend().
• Closed #​4461 and #​5414 via #​5864: honor jitless config in the eval probe.
• Closed #​5868 via #​5869: handle empty z.union([]) and z.xor([]).
• Closed #​5296 via #​5891: apply key schema transforms in z.record().
• Closed #​5824 via #​5893: emit falsy prefault values in JSON Schema output.

Commits

• Commit 44f6a03e fix(locales): correct Georgian translation for 'string' to 'ველი' (#​5655) by @​tushargr0ver
• Commit 7b43bc64 docs(ecosystem): add Hono Takibi (#​5651) by @​nakita628
• Commit 119376b9 feat: add map support to Uzbek locale (#​5599) by @​uchkunr
• Commit 8fbf701e test: add edge case tests for boundary values (#​5601) by @​uchkunr
• Commit f1f93c2b Fix order of brand method examples in api.mdx (#​5604) by @​onurtemiz
• Commit 10105ee4 docs: Fix typos in json-schema documentation (#​5608) by @​SaKaNa-Y
• Commit 2d367139 feat: add hr translation (#​5610) by @​vuki656
• Commit 54902cb7 chore: update pullfrog.yml workflow
• Commit 89ba70f2 chore: add sideEffects false to stub package.json for tree-shaking (#​5689) by @​jesse-holden
• Commit eaa3c2c3 Update positive checks to use alias .gt(0) in the docs (#​5671) by @​Fredkiss3
• Commit 65f1f404 fix typo (#​5676) by @​Nikita0x
• Commit 5b574501 fix: respect abort: true in .refine() for checks with when function (#​5681)
• Commit 539de140 docs: fix README links for async refinements/transforms (#​5682) by @​pavan-sh
• Commit 46cd10e7 docs: fix README anchor links for async APIs (#​5683) by @​pavan-sh
• Commit 55747b3c Remove deprecated downlevelIteration option (#​5684) by @​RyanCavanaugh
• Commit 3a818de1 fix(v4): handle multi-digit exponents in floatSafeRemainder (#​5687) by @​shakecodeslikecray
• Commit 3cd45ebc fix(v4): add strict validation to httpUrl() (#​5672) by @​LuckySilver0021
• Commit 7d98c909 add Sanity as silver sponsor and Mintlify as bronze sponsor
• Commit c7805073 move Sanity and Mintlify to top of sponsor lists
• Commit bee2dc8d docs: move z.iso.time() from format to pattern section (#​5696)
• Commit 2f8414bc fix: add missing addIssue to transform context (#​5699) by @​F-A-N-D-E
• Commit d3c0ec87 docs: add note about removed .errors alias in v4 changelog (#​5705) by @​togami2864
• Commit fa338a3b fix(v4): JSON schema min/max intersection for draft-04 and openapi-3.0 (#​5700) by @​ebroder
• Commit 3473b288 chore: bump zshy to ^0.7.1
• Commit cc8f9b7c docs: improve README wording and fix typos (#​5736) by @​vedanshshetti
• Commit f5336717 feat: add json-up to ecosystem (#​5740) by @​mrspence
• Commit 60ff3987 fix(v4): preserve parent path when treeifying nested union/key/element issues
• Commit 08b14b51 perf: avoid delete in finalizeIssue to keep V8 fast mode (#​5718)
• Commit 9cf868d2 fix(v4): treeify error nested union bug (#​5708) by @​dstashevskyi
• Commit 28f39a6d Add JSONType export (#​5709) by @​RobinVdBroeck
• Commit 65fab33e feat: allow when parameter in .superRefine() (#​5741) by @​vilvai
• Commit 7f87df1e refactor(v4): remove unnecessary type assertions (#​5720) by @​chisaki66
• Commit 518f15dd Preprocess is not deprecated (#​5721) by @​mxdvl
• Commit 2e5b23dc fix: add options to invalid discriminator errors (#​5723) by @​Danielchinasa
• Commit 7f789def fix: skip non-enumerable properties in record validation (#​5719) by @​veeceey
• Commit ee15fa19 docs: add AGENTS notes for JSDoc, PR comments, and PR worktree workflow
• Commit f52b4d28 Revert "docs: improve README wording and fix typos (#​5736)"
• Commit ddb41391 test: increase timeout for redos checker in datetime.test.ts (#​5744) by @​rishadaufa
• Commit bc07e459 docs: fix doc (#​5745) by @​xgaia
• Commit e06af5de Update Hey API description (#​5748) by @​mrlubos
• Commit 28c156e2 fix: apply description and default metadata to enum, const, and not schemas in fromJSONSchema (#​5758) by @​mibragimov
• Commit f457edf1 Fix grammar in CONTRIBUTING.md (#​5765) by @​siekmang
• Commit 411f6c64 fix(v4): resolve stack overflow in toJSONSchema for recursive lazy with describe (#​5797) by @​Hassad674
• Commit 45dd421e docs: add tone guidelines for issue and PR comments to AGENTS.md
• Commit ddd20a30 test: align optional property assertions with actual inferred types
• Commit a1cf8a93 docs: update z.custom example for v4 compatibility (#​5763) by @​andrewdamelio
• Commit b6a3b336 fix: strip redundant id from $defs entries in toJSONSchema (#​5759) by @​mibragimov
• Commit c7a8ccc0 fix: discriminatedUnion encode() with codec discriminator (#​5769) by @​mahmoodhamdi
• Commit 87cf0f93 fix(fromJSONSchema): normalize input via JSON round-trip
• Commit 7163e6f2 feat: add .invert() method to ZodCodec (#​5770) by @​mahmoodhamdi
• Commit b59b9b13 fix: replace .default with .prefault (#​5776) by @​alanskovrlj
• Commit 93bba686 docs: add Zod AOT to ecosystem page (#​5806) by @​wakita181009
• Commit 2564caa4 fix(docs): add custom 404 page with proper theme support (#​5779) by @​WolfieLeader
• Commit 5b7ed214 fix: correct multipleOf float validation using tolerance-based comparison (#​5793) by @​cyphercodes
• Commit cc9139d2 docs: fix self-referencing schema in refine when() example (#​5812) by @​claygeo
• Commit 0e960108 fix(v4): support v3-style single-arg z.record(valueType)
• Commit 41b25af9 docs(agents): refine PR comment tone guidance
• Commit 4c03c20d Update Italian locale error messages for validation (#​5852) by @​pastorello
• Commit 37ac1ba0 fix(fr): translate issue.origin in too_big/too_small errors (#​5845) by @​Ouaziz-chedli
• Commit 345be203 docs: add validex to ecosystem (#​5848) by @​chiptoma
• Commit 3c1f32bd feat(locales/en): handle instanceof and add comprehensive locale tests
• Commit 888e52bb feat(locales): add Greek (el) locale (#​5840) by @​saileshbro
• Commit bf6d99ed Revert "feat(locales/en): handle instanceof and add comprehensive locale tests"
• Commit e8196a8d fix(resolution): align expected fr message with translated locale
• Commit b6b12882 correct logic for validating length (#​5843) by @​nameearly
• Commit 34f60159 fix(v4): clone Map and Set in shallowClone to prevent shared state across .default() parses (#​5855) by @​artur-seppa
• Commit 91a7d0d1 fix(v4): reject whitespace in z.base64() to close atob bypass
• Commit 23edf484 Revert "fix(v4): reject whitespace in z.base64() to close atob bypass"
• Commit 15cafa13 fix(v4): throw on .merge() receiver with refinements; preserve refinements from second schema (#​5856) by @​solssak
• Commit 584b1089 fix(v4): reject whitespace in z.base64() to close atob bypass (#​5888) by @​colinhacks
• Commit b9b62c65 fix(core): honour jitless config in allowsEval probe (#​5864) by @​dokson
• Commit fffe99bd fix(v4): construct empty unions instead of crashing (#​5869) by @​tjenkinson
• Commit 285bde7f feat(core): share globalConfig across module systems via globalThis (#​5889) by @​colinhacks
• Commit 195e8696 perf(v4): mark top-level factory calls as /*@__PURE__*/ for tree-shaking
• Commit 61d7bedb fix(v4): apply key schema transforms in z.record() (#​5891) by @​colinhacks
• Commit 45acd2ad ci(release): switch to npm trusted publishing via OIDC (#​5890) by @​colinhacks
• Commit 476ae243 Tighten cuid() regex and deprecate CUID v1 (#​5880) by @​colinhacks
• Commit 6217527e docs(agents): document push-to-main footgun and version-bump rule (#​5883) by @​colinhacks
• Commit 757f0b0f fix(v4): apply util.Writeable in strictObject/looseObject for shape display parity (#​5882) by @​colinhacks
• Commit fa4a3740 fix(v4): apply util.Writeable in mini object constructors and extend/safeExtend/partial/required (#​5895) by @​colinhacks
• Commit ebc8287c fix(v4): emit falsy prefault values in toJSONSchema (#​5893) by @​mixelburg
• Commit 8fcb71a5 perf(v4): lazy-bind builder methods to shared internal prototype (#​5897) by @​colinhacks
• Commit 76e8f706 fix(v4): skip __proto__ key in object catchall (#​5898) by @​colinhacks
• Commit f0b0608e ecosystem: eslint-plugin-zod-x is eslint-plugin-zod now (#​5637) by @​marcalexiei
• Commit 0b5c3bc2 docs: fix refinements examples in api.mdx (#​5649) by @​playoffthecuff
• Commit 327e152e docs(agents): refine PR comment tone guidance further
• Commit 57d80a82 test(v4): pin object/tuple key optionality through optout propagation
• Commit f19860f1 fix: preserve context immutability in parse functions (#​5632) by @​bgk614
• Commit ec979ad7 feat: add Romanian (ro) locale (#​5657) by @​tushargr0ver
• Commit b6066b3e fix(v4): align object and tuple optionality handling (#​5661) by @​Cyjin-jani
• Commit ad0b8271 ci: update release workflow for trusted publishing
• Commit 6db607be fix(release): keep JSR manifest publishable
• Commit f778e02a build: bump zshy for JSR wildcard exports

v4.3.6

Compare Source

Commits:

• 9977fb0 Add brand.dev to sponsors
• f4b7bae Update pullfrog.yml (#​5634)
• 251d716 Clean up workflow_call
• edd4132 fix: add missing User-agent to robots.txt and allow all (#​5646)
• 85db85e fix: typo in codec.test.ts file (#​5628)
• cbf77bb Avoid non null assertion (#​5638)
• dfbbf1c Avoid re-exported star modules (#​5656)
• 762e911 Generalize numeric key handling
• ca3c862 v4.3.6

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 8am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [zod](https://zod.dev) ([source](https://github.com/colinhacks/zod)) | [`4.3.5` → `4.6.5`](https://renovatebot.com/diffs/npm/zod/4.3.5/4.6.5) |  |  | --- ### Release Notes <details> <summary>colinhacks/zod (zod)</summary> ### [`v4.6.5`](https://github.com/colinhacks/zod/releases/tag/v4.6.5) [Compare Source](https://github.com/colinhacks/zod/compare/v4.6.4...v4.6.5) #### Commits: - [`d2b135c`](https://github.com/colinhacks/zod/commit/d2b135cfb7a3582b9eb515756b9166bcb9521f4a) docs: add the 4.6.x patch highlights to the 4.6 post - [`f1448f7`](https://github.com/colinhacks/zod/commit/f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1) docs: fold the 4.6.x patch highlights into the 4.6 post's own sections - [`de65a5c`](https://github.com/colinhacks/zod/commit/de65a5cb39ed22a507fac935788f718fa88d104f) docs: lead the properties section with the check and add a Zod Mini tab ([#&#8203;6598](https://github.com/colinhacks/zod/issues/6598)) - [`56222cd`](https://github.com/colinhacks/zod/commit/56222cd1532c07bcb91b67df529cab4c0a215330) feat(instanceof): key the .properties() shape off the instance type ([#&#8203;6600](https://github.com/colinhacks/zod/issues/6600)) - [`ca0229a`](https://github.com/colinhacks/zod/commit/ca0229a404818290e6cdcfefcd7eb2d04bcbb543) Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI ([#&#8203;6595](https://github.com/colinhacks/zod/issues/6595))" - [`cc4cd4e`](https://github.com/colinhacks/zod/commit/cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9) Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI ([#&#8203;6595](https://github.com/colinhacks/zod/issues/6595))"" - [`0f3f5ee`](https://github.com/colinhacks/zod/commit/0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee) 4.6.5 - [`59bbc03`](https://github.com/colinhacks/zod/commit/59bbc03e10c636b9eb3c393dfeb552819774ec21) chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump ### [`v4.6.4`](https://github.com/colinhacks/zod/releases/tag/v4.6.4) [Compare Source](https://github.com/colinhacks/zod/compare/v4.6.3...v4.6.4) A patch on top of [4.6.3](https://github.com/colinhacks/zod/releases/tag/v4.6.3). - [`d6bc1e30`](https://github.com/colinhacks/zod/commit/d6bc1e30) feat: add `z.currencyCode()` over a vendored ISO 4217 list, refreshed weekly by CI ([#&#8203;6595](https://github.com/colinhacks/zod/pull/6595)) - [`ad32d751`](https://github.com/colinhacks/zod/commit/ad32d751) perf: `z.url()` rejects an invalid URL with `URL.canParse()` instead of a throwing constructor, about 50x faster; fewer allocations on the validation path ([#&#8203;6588](https://github.com/colinhacks/zod/pull/6588)) - [`2bb08717`](https://github.com/colinhacks/zod/commit/2bb08717) chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump - [`f6e1701a`](https://github.com/colinhacks/zod/commit/f6e1701a) chore(deps): bump next to 15.5.25 and vite to 7.3.6 ([#&#8203;6153](https://github.com/colinhacks/zod/pull/6153)) ### [`v4.6.3`](https://github.com/colinhacks/zod/releases/tag/v4.6.3) [Compare Source](https://github.com/colinhacks/zod/compare/v4.6.2...v4.6.3) A patch on top of [4.6.2](https://github.com/colinhacks/zod/releases/tag/v4.6.2). - [`413cce9a`](https://github.com/colinhacks/zod/commit/413cce9a) fix(v4): make z.properties() a check again ([#&#8203;6594](https://github.com/colinhacks/zod/pull/6594)) — removes the standalone `z.properties()` schema from 4.6.0; `z.instanceof().properties()` and `.check(...z.properties())` are unchanged - [`75d63ee1`](https://github.com/colinhacks/zod/commit/75d63ee1) docs: show only the `.properties()` method form in the 4.6 post - [`46da9572`](https://github.com/colinhacks/zod/commit/46da9572) docs: match the error-message examples to what the parsers emit ### [`v4.6.2`](https://github.com/colinhacks/zod/releases/tag/v4.6.2) [Compare Source](https://github.com/colinhacks/zod/compare/v4.6.1...v4.6.2) A patch on top of [4.6.1](https://github.com/colinhacks/zod/releases/tag/v4.6.1). - [`9446b5cc`](https://github.com/colinhacks/zod/commit/9446b5cc) fix: preserve undefined prefault outputs and object keys ([#&#8203;6587](https://github.com/colinhacks/zod/pull/6587)) — closes [#&#8203;6585](https://github.com/colinhacks/zod/issues/6585) - [`0c483c58`](https://github.com/colinhacks/zod/commit/0c483c58) docs: the [Zod 4.6 announcement post](https://zod.dev/blog/zod-4-6) ([#&#8203;6546](https://github.com/colinhacks/zod/pull/6546)) - [`a00c3f34`](https://github.com/colinhacks/zod/commit/a00c3f34) docs: use Trigger.dev's brand-kit lockups for the platinum card ### [`v4.6.1`](https://github.com/colinhacks/zod/releases/tag/v4.6.1) [Compare Source](https://github.com/colinhacks/zod/compare/v4.6.0...v4.6.1) A patch on top of [4.6.0](https://github.com/colinhacks/zod/releases/tag/v4.6.0). - [`b12aa523`](https://github.com/colinhacks/zod/commit/b12aa523) fix: preserve unique tags with defaulted discriminators ([#&#8203;6582](https://github.com/colinhacks/zod/pull/6582)) — closes [#&#8203;6577](https://github.com/colinhacks/zod/issues/6577) - [`dd9c36fa`](https://github.com/colinhacks/zod/commit/dd9c36fa) fix(v4): defer recursive object index inference ([#&#8203;6580](https://github.com/colinhacks/zod/pull/6580)) - [`3b154992`](https://github.com/colinhacks/zod/commit/3b154992) feat(lang): add Tajik (`tg`) locale ([#&#8203;6581](https://github.com/colinhacks/zod/pull/6581)) by [@&#8203;ismoil77](https://github.com/ismoil77) - [`2efa8b80`](https://github.com/colinhacks/zod/commit/2efa8b80) ci: give the npm wait a real budget and drop the back-publish path ([#&#8203;6583](https://github.com/colinhacks/zod/pull/6583)) ### [`v4.6.0`](https://github.com/colinhacks/zod/releases/tag/v4.6.0) [Compare Source](https://github.com/colinhacks/zod/compare/v4.5.4...v4.6.0) Zod 4.6 is now available. ```sh npm install zod@latest ``` At a glance: - [`.validate()`](https://zod.dev/blog/zod-4-6#validate) — checks input validity without building a result (up to 35x faster than `.safeParse().success` on a compiled schema) - [`z.instanceof().properties()`](https://zod.dev/blog/zod-4-6#zproperties) — validates properties of an instance - [`fromJSONSchema()`](https://zod.dev/blog/zod-4-6#fromjsonschema) — enforces six validation keywords it used to ignore - [`z.iban()`](https://zod.dev/blog/zod-4-6#ziban) — electronic-format IBAN plus mod-97 checksum - [`z.withParser()`](https://zod.dev/blog/zod-4-6#zwithparser) — installs a parser generated elsewhere, for environments without `new Function` - [Faster CommonJS](https://zod.dev/blog/zod-4-6#faster-commonjs) — drops the getter on every export (\~3x faster `z.validate()` under `require`) - [Memory retention in recursive schemas](https://zod.dev/blog/zod-4-6#memory-retention-in-recursive-schemas) — releases the parsed input, fixing a 4.5 out-of-memory regression - [`@zod/mini`](https://zod.dev/packages/mini) — Zod Mini as a standalone package, versioned in lockstep with `zod` since 4.5 #### `.validate()` Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a `ZodError`, which makes rejection cheap. The return type is a guard on the schema's input type. ```ts z.validate(z.string(), "hi"); // true z.validate(z.string(), 42); // false ``` It is a method on Zod Classic schemas too. ([#&#8203;6547](https://github.com/colinhacks/zod/pull/6547)) ```ts const Player = z.object({ username: z.string(), xp: z.number(), }); if (Player.validate(data)) { data.username; // narrowed } ``` In conjunction with [`z.compile()`](https://zod.dev/compile), this can be up to 35x faster than `.safeParse().success` on invalid input.  *Time per call on invalid input, compiled with z.compile() — lower is better ([benchmark](https://github.com/colinhacks/zod/blob/main/packages/bench/validate-vs-safeparse.ts))* <details> <summary><b>Uncompiled schemas</b></summary> Without compilation it is up to 5.9x faster. The saving is the result object: `.safeParse()` allocates one with an accessor pair on every call, and `.validate()` allocates nothing.  *Time per call on invalid input, plain schemas — lower is better ([benchmark](https://github.com/colinhacks/zod/blob/main/packages/bench/validate-vs-safeparse.ts))* </details> Both charts measure the failure path. The key feature of `.validate()` is that it can *short-circuit* on the first issue it encounters, instead of aggregating a full `ZodIssue[]` array. > \[!NOTE] > Async refinements are covered by `.validateAsync()`. #### `z.properties()` A new API for validating specific properties of an object. Unlike `z.object()` it validates *in-place*, so it plays nice with class instances. ([#&#8203;6536](https://github.com/colinhacks/zod/pull/6536)) ```ts const responseLike = z.properties({ status: z.number().min(200).max(299) }); responseLike.parse(new Response("ok", { status: 200 })); // ✅ a real Response responseLike.parse({ status: 204 }); // ✅ a plain object ``` A corresponding `.properties()` method has been added to `ZodInstanceOf`. **Zod** ```ts const okResponse = z.instanceof(Response).properties({ ok: z.literal(true), status: z.number().min(200).max(299), }); ``` **Zod Mini** ```ts const okResponse = z.instanceof(Response).check(...z.properties({ ok: z.literal(true), status: z.number().check(z.minimum(200), z.maximum(299)), })); ``` The input comes back untouched, so the prototype survives and the methods still work. That is the part `z.object()` cannot do: it would hand back a plain object and the `Response` would be gone. ```ts const res = await fetch("/api/user"); okResponse.parse(res) === res; // ✅ true ``` #### `fromJSONSchema()` Six additional JSON Schema keywords are now supported in `z.fromJSONSchema()`. ([#&#8203;6535](https://github.com/colinhacks/zod/pull/6535)) - [`minProperties`](https://json-schema.org/understanding-json-schema/reference/object#size) / [`maxProperties`](https://json-schema.org/understanding-json-schema/reference/object#size) - [`uniqueItems`](https://json-schema.org/understanding-json-schema/reference/array#uniqueItems) - [`contains`](https://json-schema.org/understanding-json-schema/reference/array#contains) - [`minContains`](https://json-schema.org/understanding-json-schema/reference/array#mincontains-maxcontains) / [`maxContains`](https://json-schema.org/understanding-json-schema/reference/array#mincontains-maxcontains) ```ts const schema = z.fromJSONSchema({ type: "object", minProperties: 2, // also maxProperties }); schema.parse({ a: 1 }); // ❌ too few properties schema.parse({ a: 1, b: 2 }); // ✅ ``` Both property bounds count the input's own keys. Array uniqueness is structural, so `[{ a: 1 }, { a: 1 }]` is a duplicate. ```ts z.fromJSONSchema({ type: "array", uniqueItems: true }).parse([{ a: 1 }, { a: 1 }]); // ❌ z.fromJSONSchema({ type: "array", contains: { type: "number" }, // also minContains and maxContains minContains: 2, }).parse(["a", 2]); // ❌ only one number ``` #### `z.iban()` A new string format: an IBAN in electronic format, with a valid ISO 7064 MOD 97-10 checksum. ([#&#8203;6571](https://github.com/colinhacks/zod/pull/6571)) ```ts z.iban().parse("DE89370400440532013000"); // ✅ z.iban().parse("DE89370400440532013001"); // ❌ bad checksum ``` #### `z.withParser()` `z.compile()` builds its parser with `new Function`, which a strict Content Security Policy blocks. `z.withParser()` is that installer on its own: it takes a parser generated somewhere else, at build time or by a native compiler, and installs it under the same contract. ([#&#8203;6575](https://github.com/colinhacks/zod/pull/6575)) ```ts const Player = z.object({ username: z.string(), xp: z.number() }); // isPlayer is a type guard your build step generated const Fast = z.withParser(Player, (input) => isPlayer(input) ? { username: input.username, xp: input.xp } : z.INVALID ); ``` The supplied parser owns the whole result, so it has to return what the schema would have returned. This one rebuilds the object rather than handing back its input, because `z.object()` strips unknown keys. Returning `z.INVALID` hands the input to the runtime, which stays the only source of `ZodError`s. #### Faster CommonJS TypeScript compiles a re-export to a getter, and 252 of the 255 exports on Zod 4.5's CommonJS entrypoint were getters. V8 could not see a constant callee behind one, so it could not inline the call. The 4.6 build emits plain properties and freezes the exports object. On a compiled schema, `z.validate()` under `require` is about 3x faster than it was in Zod 4.5. ([#&#8203;6564](https://github.com/colinhacks/zod/pull/6564)) ```ts const { z } = require("zod"); const CompiledPlayer = z.compile(Player); z.validate(CompiledPlayer, data); // ~3x faster than Zod 4.5 ``` Only calls through the namespace were affected. A method call like `Player.safeParse(data)` never reads the exports object, and the ESM build is unchanged. #### Memory retention in recursive schemas A recursive schema held the input and output of its last parse until the next parse replaced it, so one long-lived schema pinned every object it had touched. Zod 4.4 released that input and Zod 4.5 did not, which surfaced as an out-of-memory failure on a repository-wide lint run. The parse state is weak throughout now: one parse of a 29k-node tree retains 2.2 MB where it used to retain 10.1 MB, and recursive parses give up about 6% for it. ([#&#8203;6572](https://github.com/colinhacks/zod/pull/6572)) ```ts const Category = z.object({ name: z.string(), get children() { return z.array(Category); }, }); ``` #### Bug fixes ##### ⚠️ Error maps run on the first read of `error` Because `safeParse()` now builds its error lazily, error maps — global, locale, and per-schema `error` — run when `result.error` is first read, not at parse time. Code that swaps `z.config()` between the parse and the read gets the newer configuration. ([#&#8203;6519](https://github.com/colinhacks/zod/pull/6519)) ```ts const result = schema.safeParse(12); z.config(z.locales.fr()); result.error.issues[0].message; // French in 4.6, English in 4.5 ``` An error map with a side effect never runs if nothing reads the error. Throwing parses are unaffected — `.parse()` builds and throws its error immediately, never takes the lazy path, and its stack still points at your call site. ##### ⚠️ `z.emoji()` rejects component-only strings Unicode's `Emoji_Component` property covers the pieces that attach to an emoji, so `z.emoji()` accepted `"123"`, `"#"`, `"*"`, and a lone zero-width joiner, variation selector, or skin tone modifier. The pattern now requires at least one pictograph, regional indicator, or keycap. ([#&#8203;6532](https://github.com/colinhacks/zod/pull/6532)) ```ts z.emoji().parse("😀"); // ✅ z.emoji().parse("1️⃣"); // ✅ the keycap is the anchor z.emoji().parse("123"); // ❌ was accepted in 4.5 ``` Flags, subdivision flags, skin-tone-modified emoji, and ZWJ sequences are unchanged. Closes [#&#8203;6515](https://github.com/colinhacks/zod/issues/6515). ##### ⚠️ Numeric enum options no longer include the reverse mappings A numeric TypeScript enum also carries its reverse mapping (`0` to `"UK"`) at runtime. The parser already ignored those keys, but `.options` was read straight off the enum object, so a three-member enum listed six values and three of them failed to parse. ([#&#8203;6542](https://github.com/colinhacks/zod/pull/6542)) ```ts enum Country { UK, Germany, France } z.enum(Country).options; // 4.5: ["UK", "Germany", "France", 0, 1, 2] — 4.6: [0, 1, 2] ``` ##### ⚠️ base64 patterns The runtime patterns for `z.base64()` and `z.base64url()` are the character sets, with length and padding enforced in code, so a multi-megabyte string can no longer overflow the regex stack through a composed schema. The JSON Schema output still emits the exact block forms, so `z.toJSONSchema()` is unchanged. ([#&#8203;6534](https://github.com/colinhacks/zod/pull/6534), [#&#8203;6527](https://github.com/colinhacks/zod/pull/6527)) Composing `z.base64()` into a template literal now checks the alphabet but not the length, which is how `z.creditCard()` already behaves there. The exported `z.regexes.base64url` is now the length-aware form, so it overflows on a multi-megabyte input the same way `z.regexes.base64` does. ##### ⚠️ The email pattern dropped its lookaheads `z.email()` opened with two lookaheads, and the second scanned the whole string before the match began. Both are gone, and the rule they enforced — no empty segment in the local part — is expressed structurally instead, so `z.email()` accepts and rejects exactly what it did before. Valid addresses validate roughly twice as fast. ([#&#8203;6573](https://github.com/colinhacks/zod/pull/6573)) The pattern string is user-visible, and every copy of it changes: `z.regexes.email`, which has no capture groups now — neither of the two it used to expose held a usable value; `issue.pattern` on a failed `z.email()`; and the `pattern` that `z.toJSONSchema()` emits, which no longer carries a lookahead, so validators outside ECMAScript can compile it. Composing an email into a template literal also stops applying its no-consecutive-dots rule to the rest of the string. ```ts z.templateLiteral([z.email(), "|", z.string()]).parse("a@b.cc|a..b"); // 4.5: ❌ — the lookahead reached past the email segment — 4.6: ✅ ``` ##### ⚠️ Chained checks no longer overwrite each other in JSON Schema Each check used to write its own bounds into the schema as it attached, in chain order, so a format check applied after `.min()` and `.max()` replaced the tighter values with its own range. The converter folds the checks as a conjunction now. The order they are chained in no longer changes the output. ([#&#8203;6554](https://github.com/colinhacks/zod/pull/6554), [#&#8203;6553](https://github.com/colinhacks/zod/pull/6553)) ```ts z.toJSONSchema(z.number().min(0).max(23).int()); // 4.5: { minimum: -9007199254740991, maximum: 9007199254740991 } // 4.6: { minimum: 0, maximum: 23 } ``` Runtime parsing enforced the bounds in every version. Only the emitted schema was wrong. The same fold fixes two more cases: a repeated `multipleOf` kept the first divisor and dropped the rest, so `z.number().multipleOf(2).multipleOf(3)` emitted a schema that accepts 4, and `z.string().min(8).length(5)` emitted `minLength: 5`, widening a bound the runtime still rejected. Closes [#&#8203;6550](https://github.com/colinhacks/zod/issues/6550). ##### ⚠️ Metadata members materialize on first read Eight members on a Zod Classic schema — `.format`, `.minLength`, `.maxLength`, `.minValue`, `.maxValue`, `.isInt`, `.minDate` and `.maxDate` — are computed from the checks now instead of being written onto every instance at construction. Each one is a prototype getter that becomes an own property on first read. ([#&#8203;6554](https://github.com/colinhacks/zod/pull/6554)) ```ts const s = z.string().min(3).max(9); Object.keys(s); // 4.5: ["def", "type", "format", "minLength", "maxLength"] — 4.6: ["def", "type"] s.minLength; // 3 in both Object.keys(s); // 4.6: ["def", "type", "minLength"] ``` A key is absent until something reads it, and `Object.assign({}, schema)` copies only the members that have been read. Deleting one restores the getter, and the next read recomputes it. The values can move too, because the getters read the same fold the JSON Schema converter does. An order-dependent chain reports the tighter bound now instead of whichever check wrote last. ```ts z.string().min(8).length(5).minLength; // 4.5: 5 — 4.6: 8 ``` #### Commits Zod 4.6 rolls up 72 commits. - [`661673ae`](https://github.com/colinhacks/zod/commit/661673ae) docs: make the 9thCO logo visible on the light theme by [@&#8203;colinhacks](https://github.com/colinhacks) - [`6de10dce`](https://github.com/colinhacks/zod/commit/6de10dce) docs: reconcile the sponsor listings against every active sponsorship ([#&#8203;6579](https://github.com/colinhacks/zod/pull/6579)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`213ee75d`](https://github.com/colinhacks/zod/commit/213ee75d) feat(compile): add z.withParser for externally generated parsers ([#&#8203;6575](https://github.com/colinhacks/zod/pull/6575)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`f9465d4e`](https://github.com/colinhacks/zod/commit/f9465d4e) docs: reconcile the sponsor listings with active sponsorships ([#&#8203;6576](https://github.com/colinhacks/zod/pull/6576)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`f7fd5548`](https://github.com/colinhacks/zod/commit/f7fd5548) perf(v4): drop the lookaheads from the email regex ([#&#8203;6573](https://github.com/colinhacks/zod/pull/6573)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`36f17960`](https://github.com/colinhacks/zod/commit/36f17960) fix(v4): stop the memoizer from pinning a finished parse ([#&#8203;6572](https://github.com/colinhacks/zod/pull/6572)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`22bed613`](https://github.com/colinhacks/zod/commit/22bed613) feat(v4): add z.iban() string format with mod-97 checksum ([#&#8203;6571](https://github.com/colinhacks/zod/pull/6571)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`c5b9bcb3`](https://github.com/colinhacks/zod/commit/c5b9bcb3) bench: measure what a runtime island's leaked indent cost the generated source by [@&#8203;colinhacks](https://github.com/colinhacks) - [`e54716cb`](https://github.com/colinhacks/zod/commit/e54716cb) docs(ecosystem): add [@&#8203;apical-ts/craft](https://github.com/apical-ts/craft) ([#&#8203;5946](https://github.com/colinhacks/zod/pull/5946)) by [@&#8203;gunzip](https://github.com/gunzip) - [`dcbcf052`](https://github.com/colinhacks/zod/commit/dcbcf052) fix(compile): unwind the doc indent when a child generator throws ([#&#8203;6570](https://github.com/colinhacks/zod/pull/6570)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`277613a6`](https://github.com/colinhacks/zod/commit/277613a6) docs: move the release procedure to the maintainer-local notes by [@&#8203;colinhacks](https://github.com/colinhacks) - [`eb1c1089`](https://github.com/colinhacks/zod/commit/eb1c1089) ci: release only on workflow_dispatch behind the npm environment ([#&#8203;6569](https://github.com/colinhacks/zod/pull/6569)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`741981ff`](https://github.com/colinhacks/zod/commit/741981ff) perf(compile): for-in record walk, cheaper issue finalization, and a generative compile differential ([#&#8203;6567](https://github.com/colinhacks/zod/pull/6567)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`804e0f52`](https://github.com/colinhacks/zod/commit/804e0f52) perf: seal the CommonJS exports so require("zod") stops reading through a getter ([#&#8203;6564](https://github.com/colinhacks/zod/pull/6564)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`6f048367`](https://github.com/colinhacks/zod/commit/6f048367) fix(v4): derive JSON Schema constraints by folding checks in the converter ([#&#8203;6554](https://github.com/colinhacks/zod/pull/6554)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`e4d67f3e`](https://github.com/colinhacks/zod/commit/e4d67f3e) Migrate development and CI to Nub ([#&#8203;6562](https://github.com/colinhacks/zod/pull/6562)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`7a002366`](https://github.com/colinhacks/zod/commit/7a002366) fix(v4): don't let format checks overwrite tighter min/max bounds ([#&#8203;6553](https://github.com/colinhacks/zod/pull/6553)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`5489a532`](https://github.com/colinhacks/zod/commit/5489a532) test(v4): pin the check-chain case that keeps compiled validate's definite guard ([#&#8203;6551](https://github.com/colinhacks/zod/pull/6551)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`e7604717`](https://github.com/colinhacks/zod/commit/e7604717) docs: attribute the compiled failure cost to the fallback, not the double pass by [@&#8203;colinhacks](https://github.com/colinhacks) - [`764ac59f`](https://github.com/colinhacks/zod/commit/764ac59f) perf(v4): settle z.validate on the first failure in parse order ([#&#8203;6544](https://github.com/colinhacks/zod/pull/6544)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`07917f4c`](https://github.com/colinhacks/zod/commit/07917f4c) test(v4): pin the lazy safeParse error's stack behavior ([#&#8203;6548](https://github.com/colinhacks/zod/pull/6548)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`62e6624b`](https://github.com/colinhacks/zod/commit/62e6624b) feat(v4): add .validate() and .validateAsync() to Zod Classic ([#&#8203;6547](https://github.com/colinhacks/zod/pull/6547)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`cafbee47`](https://github.com/colinhacks/zod/commit/cafbee47) fix(v4): parse recursive schemas built by a factory ([#&#8203;6530](https://github.com/colinhacks/zod/pull/6530)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`4d730882`](https://github.com/colinhacks/zod/commit/4d730882) Release the parsed input once a failing safeParse builds its error ([#&#8203;6543](https://github.com/colinhacks/zod/pull/6543)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`90269c60`](https://github.com/colinhacks/zod/commit/90269c60) Keep a numeric TS enum's reverse-mapping keys out of `.options` ([#&#8203;6542](https://github.com/colinhacks/zod/pull/6542)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`18e71c71`](https://github.com/colinhacks/zod/commit/18e71c71) Rename the JSON Schema `process` helper so bundler polyfills cannot collide ([#&#8203;6541](https://github.com/colinhacks/zod/pull/6541)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`68aca3dc`](https://github.com/colinhacks/zod/commit/68aca3dc) docs: cover the 4.5 API surface that never made it into the reference by [@&#8203;colinhacks](https://github.com/colinhacks) - [`eca96871`](https://github.com/colinhacks/zod/commit/eca96871) fix(v4): enforce the six JSON Schema keywords fromJSONSchema silently dropped ([#&#8203;6535](https://github.com/colinhacks/zod/pull/6535)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`81ded991`](https://github.com/colinhacks/zod/commit/81ded991) perf: answer z.validate from the compiled fast path on invalid input ([#&#8203;6538](https://github.com/colinhacks/zod/pull/6538)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`51caf010`](https://github.com/colinhacks/zod/commit/51caf010) refactor: collapse cachedInternal back into cached ([#&#8203;6540](https://github.com/colinhacks/zod/pull/6540)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`abfb3897`](https://github.com/colinhacks/zod/commit/abfb3897) feat(v4): make z.properties() a schema, and give z.instanceof() a .properties() method ([#&#8203;6536](https://github.com/colinhacks/zod/pull/6536)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`69f2a7ff`](https://github.com/colinhacks/zod/commit/69f2a7ff) Collapse toZod's normalizer and move its docs to the API reference ([#&#8203;6539](https://github.com/colinhacks/zod/pull/6539)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`bf990216`](https://github.com/colinhacks/zod/commit/bf990216) perf: move util.cached's accessor to a prototype ([#&#8203;6537](https://github.com/colinhacks/zod/pull/6537)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`bec73bea`](https://github.com/colinhacks/zod/commit/bec73bea) perf(v4): build the safeParse error on first read ([#&#8203;6519](https://github.com/colinhacks/zod/pull/6519)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`07c43e2a`](https://github.com/colinhacks/zod/commit/07c43e2a) Keep the runtime base64 regexes linear so composed parse paths cannot overflow ([#&#8203;6534](https://github.com/colinhacks/zod/pull/6534)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`bc1157e7`](https://github.com/colinhacks/zod/commit/bc1157e7) docs: use a Response example for z.properties() by [@&#8203;colinhacks](https://github.com/colinhacks) - [`2ec972ec`](https://github.com/colinhacks/zod/commit/2ec972ec) refactor: collapse toZod's enum leaf normalizer to a dummy union ([#&#8203;6533](https://github.com/colinhacks/zod/pull/6533)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`68a609ac`](https://github.com/colinhacks/zod/commit/68a609ac) Widen literal inputs in property check types ([#&#8203;6520](https://github.com/colinhacks/zod/pull/6520)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`0227e53d`](https://github.com/colinhacks/zod/commit/0227e53d) docs: bump the star pill's GitHub mark to 20px by [@&#8203;colinhacks](https://github.com/colinhacks) - [`84dd3b0f`](https://github.com/colinhacks/zod/commit/84dd3b0f) perf: build literal and enum pattern regexes lazily ([#&#8203;6531](https://github.com/colinhacks/zod/pull/6531)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`f83ab511`](https://github.com/colinhacks/zod/commit/f83ab511) fix(v4): reject component-only strings from z.emoji() ([#&#8203;6532](https://github.com/colinhacks/zod/pull/6532)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`74f9a6d3`](https://github.com/colinhacks/zod/commit/74f9a6d3) docs: drop the toZod enum block from basics and pin the page's curation rule in a comment by [@&#8203;colinhacks](https://github.com/colinhacks) - [`a2a019a5`](https://github.com/colinhacks/zod/commit/a2a019a5) Accept enum-typed targets in z.toZod ([#&#8203;6528](https://github.com/colinhacks/zod/pull/6528)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`319f47f4`](https://github.com/colinhacks/zod/commit/319f47f4) Emit a length-aware base64url pattern in toJSONSchema ([#&#8203;6527](https://github.com/colinhacks/zod/pull/6527)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`08ba069e`](https://github.com/colinhacks/zod/commit/08ba069e) perf(v4): read Luhn digits with charCodeAt instead of string indexing ([#&#8203;6529](https://github.com/colinhacks/zod/pull/6529)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`1ec6b7c5`](https://github.com/colinhacks/zod/commit/1ec6b7c5) docs: add an RSS feed to the blog at /blog/rss.xml by [@&#8203;colinhacks](https://github.com/colinhacks) - [`b801439b`](https://github.com/colinhacks/zod/commit/b801439b) bench: add typebox (compiled and dynamic) to the moltar cross-library harness by [@&#8203;colinhacks](https://github.com/colinhacks) - [`7ae49d64`](https://github.com/colinhacks/zod/commit/7ae49d64) docs: drop the circle around the star pill's GitHub mark and center it on the pill's arc by [@&#8203;colinhacks](https://github.com/colinhacks) - [`93f3ab32`](https://github.com/colinhacks/zod/commit/93f3ab32) docs: replace the blog navbar's GitHub icon with a star-count pill by [@&#8203;colinhacks](https://github.com/colinhacks) - [`fb2fedfd`](https://github.com/colinhacks/zod/commit/fb2fedfd) docs: tighten the memory chart callout, pad the canvas, say "less memory" by [@&#8203;colinhacks](https://github.com/colinhacks) - [`ff56a551`](https://github.com/colinhacks/zod/commit/ff56a551) docs: center the memory chart callout labels and pad them off the number by [@&#8203;colinhacks](https://github.com/colinhacks) - [`8cd1250f`](https://github.com/colinhacks/zod/commit/8cd1250f) docs: center the memory chart callout labels by [@&#8203;colinhacks](https://github.com/colinhacks) - [`3195ed01`](https://github.com/colinhacks/zod/commit/3195ed01) docs: label the memory chart like the compile chart by [@&#8203;colinhacks](https://github.com/colinhacks) - [`a6b49390`](https://github.com/colinhacks/zod/commit/a6b49390) Mark the compile internals [@&#8203;internal](https://github.com/internal) instead of hiding them ([#&#8203;6518](https://github.com/colinhacks/zod/pull/6518)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`40b4d0b3`](https://github.com/colinhacks/zod/commit/40b4d0b3) fix(ci): read zod's latest version with npm view when picking the backfill dist-tag by [@&#8203;colinhacks](https://github.com/colinhacks) - [`5ff95665`](https://github.com/colinhacks/zod/commit/5ff95665) Stop re-exporting the compile internals from zod/v4/core ([#&#8203;6511](https://github.com/colinhacks/zod/pull/6511)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`f412178d`](https://github.com/colinhacks/zod/commit/f412178d) ci: publish [@&#8203;zod/mini](https://github.com/zod/mini) to JSR in lockstep with npm ([#&#8203;6510](https://github.com/colinhacks/zod/pull/6510)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`f3e7c72e`](https://github.com/colinhacks/zod/commit/f3e7c72e) fix(docs): render the docs 404 page inside the (doc) layout once by [@&#8203;colinhacks](https://github.com/colinhacks) - [`f3cb3644`](https://github.com/colinhacks/zod/commit/f3cb3644) docs: surface the blog on the home page and in the sidebar by [@&#8203;colinhacks](https://github.com/colinhacks) - [`cd4f9a67`](https://github.com/colinhacks/zod/commit/cd4f9a67) perf(v4): report Standard Schema issues without constructing a ZodError ([#&#8203;6509](https://github.com/colinhacks/zod/pull/6509)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`43b9bfc5`](https://github.com/colinhacks/zod/commit/43b9bfc5) docs: drop the bound-methods section from the Zod package page by [@&#8203;colinhacks](https://github.com/colinhacks) - [`70eb2c07`](https://github.com/colinhacks/zod/commit/70eb2c07) docs: drop the traits section and the compilation feature bullet by [@&#8203;colinhacks](https://github.com/colinhacks) - [`1c0bce0c`](https://github.com/colinhacks/zod/commit/1c0bce0c) docs: bring the 4.5 charts and worked examples into the docs pages by [@&#8203;colinhacks](https://github.com/colinhacks) - [`a0898b4b`](https://github.com/colinhacks/zod/commit/a0898b4b) ci: wait hours for npm to serve a publish, not ten minutes ([#&#8203;6502](https://github.com/colinhacks/zod/pull/6502)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`c46eeff0`](https://github.com/colinhacks/zod/commit/c46eeff0) chore: narrow blanket biome-ignore comments ([#&#8203;6504](https://github.com/colinhacks/zod/pull/6504)) by [@&#8203;pullfrog\[bot\]](https://github.com/pullfrog\[bot]) - [`c7ec94d3`](https://github.com/colinhacks/zod/commit/c7ec94d3) ci: check zod and [@&#8203;zod/mini](https://github.com/zod/mini) lockstep on npm after every publish ([#&#8203;6507](https://github.com/colinhacks/zod/pull/6507)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`81065739`](https://github.com/colinhacks/zod/commit/81065739) chore(docs): build with Turbopack by [@&#8203;colinhacks](https://github.com/colinhacks) - [`abd41adb`](https://github.com/colinhacks/zod/commit/abd41adb) docs(wiki): move plans and comparisons into a gitignored internal/ ([#&#8203;6506](https://github.com/colinhacks/zod/pull/6506)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`2956c4c2`](https://github.com/colinhacks/zod/commit/2956c4c2) chore(mini): sync [@&#8203;zod/mini](https://github.com/zod/mini) to 4.5.4 by [@&#8203;colinhacks](https://github.com/colinhacks) - [`8ce9e8d5`](https://github.com/colinhacks/zod/commit/8ce9e8d5) feat(mini): publish Zod Mini as the standalone [@&#8203;zod/mini](https://github.com/zod/mini) package ([#&#8203;6491](https://github.com/colinhacks/zod/pull/6491)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`93186cab`](https://github.com/colinhacks/zod/commit/93186cab) docs(wiki): drop the zod-compiler benchmark ([#&#8203;6505](https://github.com/colinhacks/zod/pull/6505)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`908c9e17`](https://github.com/colinhacks/zod/commit/908c9e17) fix(docs): retry the GitHub stars fetch and log the real status by [@&#8203;colinhacks](https://github.com/colinhacks) ### [`v4.5.4`](https://github.com/colinhacks/zod/releases/tag/v4.5.4) [Compare Source](https://github.com/colinhacks/zod/compare/v4.5.3...v4.5.4) #### Commits: - [`84e416f`](https://github.com/colinhacks/zod/commit/84e416fbf4740527bbc8f319634f4e1b065bb42c) fix(v4): stop the cycle walk from firing a default factory ([#&#8203;6500](https://github.com/colinhacks/zod/issues/6500)) - [`e8e206f`](https://github.com/colinhacks/zod/commit/e8e206fa33ac5fe7ce20a2beb12d57b1cb3df653) 4.5.4 ### [`v4.5.3`](https://github.com/colinhacks/zod/releases/tag/v4.5.3) [Compare Source](https://github.com/colinhacks/zod/compare/v4.5.2...v4.5.3) #### Commits: - [`e6b6ab3`](https://github.com/colinhacks/zod/commit/e6b6ab347675cd2bd54b1bdbed16f98c59be82a9) docs(blog): widen the z.compile example to a 20-property schema - [`87d6464`](https://github.com/colinhacks/zod/commit/87d6464418582bb96fc665a01f852ca6da324ad0) fix(docs): drop the OG description when the title wraps past two lines - [`99fce39`](https://github.com/colinhacks/zod/commit/99fce394a026823e602b9c30d8d5d9f5f1932ce7) bench(v4): z.compile() against zod-compiler ([#&#8203;6499](https://github.com/colinhacks/zod/issues/6499)) - [`e3a695b`](https://github.com/colinhacks/zod/commit/e3a695b6bf3f0d591ea682816e3cdaea04b0f967) docs(v4): record the email regex and container output-shape findings under Open - [`7e24a24`](https://github.com/colinhacks/zod/commit/7e24a24288183ce02554f1ded7775d0650a7b7e6) docs(blog): drop the reading time and put a GitHub link in the navbar - [`eab51ff`](https://github.com/colinhacks/zod/commit/eab51ff3592b2d11d863f4ee4d5452f31a3de1b6) fix(v4): emit record numeric keys as strings in toJSONSchema ([#&#8203;6497](https://github.com/colinhacks/zod/issues/6497)) ### [`v4.5.2`](https://github.com/colinhacks/zod/releases/tag/v4.5.2) [Compare Source](https://github.com/colinhacks/zod/compare/v4.5.1...v4.5.2) #### Commits: - [`a354314`](https://github.com/colinhacks/zod/commit/a354314ac04fdd5484aa62dd5c3a4b553211a0e4) fix(docs): keep blog posts out of the docs collection ([#&#8203;6484](https://github.com/colinhacks/zod/issues/6484)) - [`d378c42`](https://github.com/colinhacks/zod/commit/d378c42aff6869f0929058a7923cd775880f5c4c) ci: drop canary publishing from the release workflow ([#&#8203;6487](https://github.com/colinhacks/zod/issues/6487)) - [`212b941`](https://github.com/colinhacks/zod/commit/212b941791e7faae078e17645eb612824fd8f79a) fix(v4): let a prototype method getter answer a bare call so vi.spyOn works ([#&#8203;6488](https://github.com/colinhacks/zod/issues/6488)) - [`e7576f5`](https://github.com/colinhacks/zod/commit/e7576f542a7bc7ef3cc5eeec237714fd0e6b6e98) docs(blog): let the page show through the navbar in dark mode ([#&#8203;6489](https://github.com/colinhacks/zod/issues/6489)) - [`fedb06f`](https://github.com/colinhacks/zod/commit/fedb06fafe33a66ce0b5c236ad2557e0a5a170fe) fix(docs): match the blog TOC hover bar to the 2px active indicator - [`6c932fc`](https://github.com/colinhacks/zod/commit/6c932fcb2eea6eb671710ea058ca9fdc382ada89) chore: bump devcontainer image to Node 24 ([#&#8203;6470](https://github.com/colinhacks/zod/issues/6470)) - [`6635d9d`](https://github.com/colinhacks/zod/commit/6635d9dd367a664109de83c021995821f48efa29) docs(blog): soften the "method memoization" attribution - [`019ae29`](https://github.com/colinhacks/zod/commit/019ae299cc75daa132bf1acf59086a520abf6b85) fix(docs): drop ISR on the docs route so the home page hydrates - [`652bb43`](https://github.com/colinhacks/zod/commit/652bb438aa4c626c1cd7948c6849c4691239fca7) chore(docs): drop the scroll log from the route-change scroller - [`571c8e8`](https://github.com/colinhacks/zod/commit/571c8e8a3d73b4305f4abfdd6977773cc12f2bf5) fix(docs): render blog tabs with the stock fumadocs tab card - [`9a193aa`](https://github.com/colinhacks/zod/commit/9a193aa24b4efa3b315b91d4c56c8bc385b8513f) 4.5.2 ### [`v4.5.1`](https://github.com/colinhacks/zod/releases/tag/v4.5.1) [Compare Source](https://github.com/colinhacks/zod/compare/v4.5.0...v4.5.1) #### Commits: - [`2e862db`](https://github.com/colinhacks/zod/commit/2e862dbf89da2835e5206a8fd3d3be61afe3cf7f) ci: gate the GitHub release and JSR publish on the version being live on npm - [`8e03380`](https://github.com/colinhacks/zod/commit/8e03380510db36fa6fda979fc78a375fdea8021c) 4.5.1 ### [`v4.5.0`](https://github.com/colinhacks/zod/releases/tag/v4.5.0) [Compare Source](https://github.com/colinhacks/zod/compare/v4.4.3...v4.5.0) Zod 4.5 is now available. ```sh npm install zod@latest ``` At a glance: - [`z.compile()`](#zcompile) — the flagship feature of Zod 4.5 - [`z.creditCard()`](#zcreditcard) — 12–19 digits plus Luhn checksum - [`z.properties()`](#zproperties) — the multi-property counterpart to `z.property()` - [`z.deepPartial()`](#zdeeppartial)/[`.exactPartial()`](#exactpartial) - [`z.validate(): boolean`](#zvalidate) — a fast-path to verify input validity without a full parse (up to 16x faster on invalid data) - [9x reduction in memory footprint](#&#8203;9x-reduction-in-schema-memory-footprint) - [New locales](https://zod.dev/error-customization#locales): Bengali (`bn`), Central Kurdish (`ckb`), Hindi (`hi`), Kannada (`kn`), Norwegian Nynorsk (`nn`), Brazilian Portuguese (`pt-BR`), Slovak (`sk`), Turkmen (`tk`) #### `z.compile()` You can now pre-compile any Zod schema using `z.compile(schema)`. This dramatically speeds up parsing performance. ```ts import * as z from "zod"; const Player = z.object({ username: z.string(), bio: z.string(), xp: z.number(), // ...20 more properties... }); const CompiledPlayer = z.compile(Player); ``` A compiled schema can be used *exactly* like an uncompiled one. There are no special rules around compiled schemas. They're just faster. ```ts Player.parse({ ... }); CompiledPlayer.parse({ ... }); // ~9x faster ``` On objects, arrays, and unions, this speeds up parsing by a factor of \~3–9. More complex schemas stand to benefit more than simpler ones. <picture> <source media="(prefers-color-scheme: dark)" srcset="https://zod.dev/blog/compile-speedup-dark.svg"> <img alt="Time per parse on a shared nanosecond axis, standard parser as a gray bar with the compiled time as a blue bar inside it: an array of 10 objects 377 ns to 68 ns (5.5x), a 20-key object 301 ns to 38 ns (7.8x), an array of 10 strings 241 ns to 33 ns (7.3x), a union of 3 objects 190 ns to 36 ns (5.3x), a 3-element tuple 119 ns to 33 ns (3.6x), a 5-key strict object 117 ns to 32 ns (3.7x), a discriminated union 92 ns to 27 ns (3.4x), a 5-key object 76 ns to 28 ns (2.8x); up to 7.8x faster when compiled" src="https://zod.dev/blog/compile-speedup-light.svg"> </picture> *Time per parse by schema type, standard parser vs compiled — lower is better ([benchmark](https://github.com/colinhacks/zod/blob/main/packages/bench/compile-matrix.ts))* Below are the Moltar benchmark results comparing Zod (compiled and uncompiled) against the [**Moltar ParseSafe**](https://github.com/moltar/typescript-runtime-type-benchmarks) bench. <picture> <source media="(prefers-color-scheme: dark)" srcset="https://zod.dev/blog/moltar-dark.svg"> <img alt="Bar chart of operations per second on the moltar benchmark fixture, parseSafe category: Zod 4 compiled 47.5M, typia 45.3M, Zod 4 11.6M, valibot 1.8M, effect 1.7M, Zod 3 1.2M, arktype 152k, yup 121k" src="https://zod.dev/blog/moltar-light.svg"> </picture> *Throughput on the moltar benchmark fixture (parseSafe: returns a new object with unknown keys stripped) — higher is better ([benchmark](https://github.com/moltar/typescript-runtime-type-benchmarks/pull/2329))* And the equivalent results for the Moltar AssertLoose bench. Tested against the new `z.validate(schema, input)` function (detailed later in the post). <picture> <source media="(prefers-color-scheme: dark)" srcset="https://zod.dev/blog/moltar-assertLoose-dark.svg"> <img alt="Bar chart of operations per second on the moltar benchmark fixture, assertLoose category: typia 74.9M, arktype 66.2M, Zod 4 compiled 60.6M, Zod 4 6.5M, valibot 1.9M, effect 1.7M, Zod 3 1.2M, yup 124k" src="https://zod.dev/blog/moltar-assertLoose-light.svg"> </picture> *Throughput on the moltar benchmark fixture (assertLoose: returns a boolean, unknown keys allowed) — higher is better ([benchmark](https://github.com/moltar/typescript-runtime-type-benchmarks/pull/2329))* Zod's entire test suite runs twice—once normally and again with auto-compilation enabled globally—to ensure perfect fidelity. <details> <summary>How it works</summary> Under the hood, `z.compile()` walks the entire schema once and produces a hyperoptimized snippet of flat, loop-free JavaScript that can validate inputs far faster than a standard runtime validator. This snippet can be executed via `new Function()` (effectively a more powerful `eval`) to serve as a fast-path validator. Schemas use this to "fast check" validity, falling back to the regular runtime logic on validation failure to provide granular error information. Take this simple `Point` schema: ```ts const Point = z.object({ x: z.number(), y: z.number() }); ``` Here is the generated snippet for it: ```ts const isPoint = new Function("input", ` if (typeof input !== "object" || input === null) return false; if (typeof input.x !== "number") return false; if (typeof input.y !== "number") return false; return true; `); isPoint({ x: 1, y: 2 }); // true isPoint({ x: "1" }); // false ``` For the large majority of inputs, the generated function validates the data with the fastest logic JavaScript can express: straight-line `typeof` checks and property reads, with no interpreter in between. When it can't handle an input, Zod falls back to the standard parser. This is the function Zod generates for the `Player` schema above: ```js if (typeof input !== "object" || input === null || Array.isArray(input)) return INVALID; const v0 = input["username"]; if (typeof v0 !== "string") return INVALID; const v1 = input["bio"]; if (typeof v1 !== "string") return INVALID; const v2 = input["xp"]; if (typeof v2 !== "number" || !Number.isFinite(v2)) return INVALID; const v3 = { "username": v0, "bio": v1, "xp": v2 }; return v3; ``` Armed with the power of `new Function()`, this happens in-process at runtime. There is no need to integrate with your build system. > The compiled schema is purely additive on top of the existing schema. It tacks on the pre-compiled fast path for checking valid inputs. When invalid data is detected, it returns the `INVALID` symbol to signal that parsing should fall back to the uncompiled parser. This structurally prevents subtle deviations in error reporting between compiled and uncompiled variants. </details> ##### `import "zod/compile"` To compile every schema in an application, import `zod/compile` once at the top of your entry point. Every schema constructed after that import is *automatically compiled* the first time it's used to parse data. ```ts import "zod/compile"; // must come before modules that define schemas import * as z from "zod"; const schema = z.object({ name: z.string() }); schema.parse({ name: "ok" }); // compiled on first parse ``` It also works as a Node.js CLI flag, which guarantees it runs before any module defines a schema: ```sh node --import zod/compile app.js ``` Or set `preload` in [`bunfig.toml`](https://bun.com/docs/runtime/bunfig#preload) or [`nub.jsonc`](https://nubjs.com/docs/config#preload). ```jsonc { "preload": ["zod/compile"] } ``` All schemas benefit to varying degrees, though complex object/tuple/array schemas benefit more than simple scalar validators. > Read the [docs](https://zod.dev/compile), or the full technical writeup: [Introducing `z.compile()`](https://zod.dev/blog/introducing-z-compile) #### `z.creditCard()` A new string format: 12–19 digits, optionally separated by single spaces or hyphens, with a valid Luhn checksum. ([#&#8203;5931](https://github.com/colinhacks/zod/pull/5931)) ```ts z.creditCard().parse("4111 1111 1111 1111"); // ✅ z.creditCard().parse("4111 1111 1111 1112"); // ❌ bad checksum ``` #### `z.properties()` The multi-property counterpart to `z.property()`. ([#&#8203;5912](https://github.com/colinhacks/zod/pull/5912)) ```ts const httpsUrl = z.instanceof(URL).check( ...z.properties({ protocol: z.literal("https:" as string), hostname: z.string().regex(z.regexes.domain), }) ); httpsUrl.parse(new URL("https://example.com")); // ✅ httpsUrl.parse(new URL("http://localhost")); // ❌ protocol ``` #### `z.deepPartial()` Back in functional form after being removed as a method in Zod 4. ([#&#8203;5928](https://github.com/colinhacks/zod/pull/5928)) ```ts const Post = z.object({ title: z.string(), author: z.object({ name: z.string(), email: z.string() }), }); const PartialPost = z.deepPartial(Post); type PartialPost = z.output<typeof PartialPost>; // => { title?: string; author?: { name?: string; email?: string } } PartialPost.parse({ author: {} }); // ✅ ``` The result is still a `ZodObject`, so `.shape` and `.extend()` keep working. #### `.exactPartial()` Like `.partial()`, but wraps each field in `z.exactOptional()` instead of `z.optional()`: keys may be omitted, but an explicit `undefined` is rejected. This matches TypeScript's `Partial<>` under `exactOptionalPropertyTypes`. ([#&#8203;6065](https://github.com/colinhacks/zod/pull/6065)) ```ts const Recipe = z.object({ title: z.string(), servings: z.number() }); const PartialRecipe = Recipe.exactPartial(); PartialRecipe.parse({}); // ✅ PartialRecipe.parse({ title: undefined }); // ❌ ``` In Zod Mini it's a top-level function: `z.exactPartial(Recipe)`. #### `z.validate()` Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a `ZodError`, which makes rejection cheap: on invalid input it is up to 16x faster than `.safeParse().success`. The return type is a guard on the schema's input type, and `z.validateAsync()` covers schemas with async refinements. ([#&#8203;6471](https://github.com/colinhacks/zod/pull/6471)) ```ts z.validate(z.string(), "hi"); // true z.validate(z.string(), 42); // false ``` #### `z.input()` / `z.output()` Project a schema onto its input or output side. Useful for validating the two halves of a codec independently. ([#&#8203;5928](https://github.com/colinhacks/zod/pull/5928)) ```ts const isoDate = z.codec(z.iso.datetime(), z.date(), { decode: (s) => new Date(s), encode: (d) => d.toISOString(), }); const Event = z.object({ name: z.string(), at: isoDate }); z.input(Event).parse({ name: "launch", at: "2024-01-01T00:00:00Z" }); // ✅ z.output(Event).parse({ name: "launch", at: new Date() }); // ✅ ``` This is a no-op on schemas not containing codecs/pipes. #### `z.toZod<T>()` A utility to define a Zod schema that agrees exactly with a static type, often one that is handwritten or externally defined. ([#&#8203;5913](https://github.com/colinhacks/zod/pull/5913)) ```ts type Player = { username: string; xp: number }; const Player = z.toZod<Player>()( z.object({ username: z.string(), xp: z.number(), }) ); Player.shape.username; // ZodString — the schema is returned unchanged ``` #### `z.getDiscriminatedOption()` Extract a discriminated union member by discriminator value. ([#&#8203;5947](https://github.com/colinhacks/zod/pull/5947)) ```ts const Fruit = z.object({ type: z.literal("fruit"), seeds: z.boolean() }); const Veg = z.object({ type: z.literal("vegetable"), leafy: z.boolean() }); const Produce = z.discriminatedUnion("type", [Fruit, Veg]); z.getDiscriminatedOption(Produce, "fruit"); // typeof Fruit z.getDiscriminatedOption(Produce, "meat"); // ❌ TypeScript error ``` #### Cyclical inputs Zod recursive schemas now support cyclical data. For bundle size reasons, Zod Mini requires you to register a memoizer explicitly. ([#&#8203;6387](https://github.com/colinhacks/zod/pull/6387), [#&#8203;6482](https://github.com/colinhacks/zod/pull/6482)) **Zod** ```ts const Category = z.object({ name: z.string(), get subcategories() { return z.array(Category); }, }); const input: any = { name: "root", subcategories: [] }; input.subcategories.push(input); const result = Category.parse(input); result.subcategories[0] === result; // true ``` **Zod Mini** ```ts // register a memoizer before defining any schemas z.config({ memoizer: z.memoizer() }); const result = Category.parse(input); result.subcategories[0] === result; // true ``` #### 9x reduction in schema memory footprint In Zod 4.4 a bare `z.string()` retained 7.5kb of heap. In Zod 4.5 it retains 784 bytes. <picture> <source media="(prefers-color-scheme: dark)" srcset="https://zod.dev/blog/memory-dark.svg"> <img alt="Bar chart of heap retained by one schema instance, zod 4.4.3 versus 4.5: a 10-key object 82.0kb to 11.0kb, a union 17.5kb to 2.13kb, z.string().min(1) 16.7kb to 3.37kb, a record 16.4kb to 2.64kb, z.string().optional() 12.6kb to 1.50kb, an array of strings 11.2kb to 1.93kb, z.string() 7.53kb to 784b, z.number() 4.44kb to 706b. Up to 9.8x smaller than 4.4.3." src="https://zod.dev/blog/memory-light.svg"> </picture> *Retained heap per schema instance, Zod 4.4.3 vs 4.5 ([benchmark](https://github.com/colinhacks/zod/blob/main/packages/bench/memory/schema-footprint.ts))* In Zod 4.4 and earlier, all schema methods were automatically bound to the instance itself. This allowed users to pluck methods from schemas without causing issues due to `this`-binding. ```ts const { parse } = z.string(); parse("some data"); ``` A consequence of this is that each bound method allocates space on the heap; method implementations are not shared across all instances via `prototype`, as you'd expect. Zod 4.5 implements a method memoization pattern that avoids allocating bound methods until they are actually accessed. > Read the deep dive: [Reducing Zod's memory footprint by an order of magnitude](https://zod.dev/blog/reducing-memory-footprint) #### Faster failures Zod `.parse()`/`.safeParse()` instantiates a JavaScript `Error`, which captures a stack trace. In the case of validation failures, this is often much slower than the parsing logic itself. When using `.safeParse()`, Zod no longer captures this stack trace, speeding up failure-path parses by a factor of \~7.5x. ([#&#8203;6316](https://github.com/colinhacks/zod/pull/6316), [#&#8203;6450](https://github.com/colinhacks/zod/pull/6450)) ```ts const result = Player.safeParse({ username: 42, bio: "hello", xp: 12 }); result.success; // false — ~7.5x faster than Zod 4.4 ``` <picture> <source media="(prefers-color-scheme: dark)" srcset="https://zod.dev/blog/fail-dark.svg"> <img alt="Bar chart of time per failing safeParse: zod 4.4 at 6.3 microseconds, zod 4.5 at 840 nanoseconds — 7.6x faster" src="https://zod.dev/blog/fail-light.svg"> </picture> *Player schema ([benchmark](https://github.com/colinhacks/zod/blob/main/packages/bench/failing-safeparse.ts))* #### Symbol keys in `z.object()` A shape can now declare a symbol key. TypeScript tracks it: a `const` symbol infers as `unique symbol`, so `z.infer` makes the key required and checks its value type. Undeclared symbol keys are still ignored. ([#&#8203;6448](https://github.com/colinhacks/zod/pull/6448)) ```ts const TAG = Symbol("tag"); const schema = z.object({ name: z.string(), [TAG]: z.number() }); schema.parse({ name: "alice", [TAG]: 42 }); // ✅ { name: "alice", [TAG]: 42 } schema.safeParse({ name: "alice" }); // ❌ the symbol key is required ``` #### Bug fixes All of these fix soundness issues, so a schema that relied on the old behavior may now reject input it used to accept. ##### ⚠️ `z.iso.datetime()` requires seconds RFC 3339 mandates seconds. `z.iso.datetime()` and `z.iso.datetime({ offset: true })` no longer accept minute-precision input like `2020-01-01T06:15Z`. `local: true` still admits `2020-01-01T06:15`, since an unqualified datetime is outside RFC 3339 either way. ([#&#8203;6457](https://github.com/colinhacks/zod/pull/6457)) ```ts z.iso.datetime().parse("2020-01-01T06:15:00Z"); // ✅ z.iso.datetime().parse("2020-01-01T06:15Z"); // ❌ was accepted in 4.4 ``` To accept both forms, union the two precisions: ```ts z.union([z.iso.datetime(), z.iso.datetime({ precision: -1 })]); ``` ##### ⚠️ String length counts code points `.min()`, `.max()`, and `.length()` counted UTF-16 code units, so `z.string().max(5)` rejected five emoji. They now count Unicode code points, which is what every non-JS consumer of a length bound does (Postgres, MySQL, Go, Python, and the `maxLength` that `z.toJSONSchema()` emits). `.max()` only loosens; `.min()` and `.length()` tighten for astral input. Graphemes are unchanged — a ZWJ sequence is still several code points. ([#&#8203;6441](https://github.com/colinhacks/zod/pull/6441)) ```ts z.string().max(5).parse("😀😀😀😀😀"); // was too_big, now passes z.string().min(5).parse("😀😀😀"); // was fine, now too_small ``` Closes [#&#8203;3355](https://github.com/colinhacks/zod/issues/3355). ##### ⚠️ Record keys and intersections match TypeScript A record's key schema now governs only the keys that match it, the way TypeScript treats an index signature. Intersecting an object with a pattern-keyed record no longer rejects the object's own keys. ([#&#8203;6412](https://github.com/colinhacks/zod/pull/6412)) ```ts z.object({ name: z.string() }) .and(z.record(z.string().regex(/^S_/), z.string())) .parse({ name: "a", S_a: "s" }); // 4.4: throws invalid_key on "name" // 4.5: { name: "a", S_a: "s" } ``` Separately, an `unrecognized_keys` issue no longer aborts the schema it came from, so a strict object with an extra key *and* a bad value now reports both issues instead of just the first. Closes [#&#8203;2200](https://github.com/colinhacks/zod/issues/2200), [#&#8203;2573](https://github.com/colinhacks/zod/issues/2573), [#&#8203;4017](https://github.com/colinhacks/zod/issues/4017), [#&#8203;5663](https://github.com/colinhacks/zod/issues/5663). ##### ⚠️ `__proto__` is always stripped Object and record parsers now drop a `__proto__` key whether it comes from the input, is declared by the schema, or is produced by a record key transform. A key that a record's key schema *normalizes* to `__proto__` is dropped too. `.strict()` reports an own `__proto__` input key as `unrecognized_keys` instead of silently swallowing it. Error formatters and both JSON Schema converters use own-property writes so a `toString` or `constructor` path segment can't walk onto `Object.prototype` ([#&#8203;6213](https://github.com/colinhacks/zod/pull/6213), [#&#8203;6367](https://github.com/colinhacks/zod/pull/6367), [#&#8203;6346](https://github.com/colinhacks/zod/pull/6346)). ([#&#8203;6386](https://github.com/colinhacks/zod/pull/6386), [#&#8203;6354](https://github.com/colinhacks/zod/pull/6354), [#&#8203;6355](https://github.com/colinhacks/zod/pull/6355), [#&#8203;6221](https://github.com/colinhacks/zod/pull/6221)) ##### ⚠️ Stricter string formats - `z.ipv6()` validated by handing the string to `new URL()`, which let `::@1\` and `::1\n` through. It now checks the address alphabet directly ([#&#8203;6442](https://github.com/colinhacks/zod/pull/6442)). - `z.ulid()` restricts the first character to `0`–`7`; anything higher overflows the 48-bit timestamp. A fixture that doesn't start with a real timestamp, such as one with a leading letter, is now rejected ([#&#8203;6095](https://github.com/colinhacks/zod/pull/6095)). - `z.httpUrl()` enforces the RFC 1035 length limits on the host, matching `z.hostname()` ([#&#8203;6035](https://github.com/colinhacks/zod/pull/6035)). - `z.emoji()` no longer backtracks exponentially on a failed match ([#&#8203;6347](https://github.com/colinhacks/zod/pull/6347)). - `z.string().includes(sub, { position: N })` emits a JSON Schema pattern that allows *at least* N leading characters, matching `String.prototype.includes` ([#&#8203;6024](https://github.com/colinhacks/zod/pull/6024)). #### Commits Zod 4.5 rolls up 155 commits. Thanks to everyone who contributed: [@&#8203;dokson](https://github.com/dokson), [@&#8203;deepshekhardas](https://github.com/deepshekhardas), [@&#8203;zirkelc](https://github.com/zirkelc), [@&#8203;francisjohnjohnston-web](https://github.com/francisjohnjohnston-web), [@&#8203;MerlijnW70](https://github.com/MerlijnW70), [@&#8203;codinsonn](https://github.com/codinsonn), [@&#8203;oimo23](https://github.com/oimo23), [@&#8203;JSap0914](https://github.com/JSap0914), [@&#8203;zelinewang](https://github.com/zelinewang), [@&#8203;abhishek-chaudhary2003](https://github.com/abhishek-chaudhary2003), [@&#8203;spokodev](https://github.com/spokodev), [@&#8203;Mohammad-Faiz-Cloud-Engineer](https://github.com/Mohammad-Faiz-Cloud-Engineer), [@&#8203;hamed-bavar](https://github.com/hamed-bavar), [@&#8203;MGPOCKY](https://github.com/MGPOCKY), [@&#8203;ChiChuRita](https://github.com/ChiChuRita), [@&#8203;dinwwwh](https://github.com/dinwwwh), [@&#8203;thristhart](https://github.com/thristhart), [@&#8203;tsmartin9](https://github.com/tsmartin9), [@&#8203;vedanshshetti](https://github.com/vedanshshetti), [@&#8203;belicam](https://github.com/belicam), [@&#8203;frastefanini](https://github.com/frastefanini), [@&#8203;andersk](https://github.com/andersk), [@&#8203;musaddiq-rafi](https://github.com/musaddiq-rafi), [@&#8203;tachmyratsaparmyradov](https://github.com/tachmyratsaparmyradov), [@&#8203;arvindfroi](https://github.com/arvindfroi), [@&#8203;KUMachine](https://github.com/KUMachine), [@&#8203;spidersouris](https://github.com/spidersouris), [@&#8203;catdalfonso](https://github.com/catdalfonso), [@&#8203;mneetika](https://github.com/mneetika), [@&#8203;gwagjiug](https://github.com/gwagjiug), [@&#8203;MahinAnowar](https://github.com/MahinAnowar), [@&#8203;MaksZhukov](https://github.com/MaksZhukov), [@&#8203;emmayusufu](https://github.com/emmayusufu), [@&#8203;agcty](https://github.com/agcty), [@&#8203;devareddy05](https://github.com/devareddy05), [@&#8203;Vish05](https://github.com/Vish05), [@&#8203;yamcodes](https://github.com/yamcodes), [@&#8203;mattiasahlsen](https://github.com/mattiasahlsen), [@&#8203;samchungy](https://github.com/samchungy), [@&#8203;ozzyfromspace](https://github.com/ozzyfromspace), [@&#8203;udohjeremiah](https://github.com/udohjeremiah), [@&#8203;patrickwehbe](https://github.com/patrickwehbe), [@&#8203;gajus](https://github.com/gajus), [@&#8203;Harm-Nullix](https://github.com/Harm-Nullix), [@&#8203;thwbh](https://github.com/thwbh), [@&#8203;IdanGonen](https://github.com/IdanGonen), [@&#8203;irfanfandi](https://github.com/irfanfandi), [@&#8203;JuerGenie](https://github.com/JuerGenie), [@&#8203;marcalexiei](https://github.com/marcalexiei), [@&#8203;itsahmedbilal](https://github.com/itsahmedbilal), [@&#8203;DucMinhNe](https://github.com/DucMinhNe), [@&#8203;meliharik](https://github.com/meliharik). - [`9782f87c`](https://github.com/colinhacks/zod/commit/9782f87c) perf(v4): validate without building the output, and keep schemas out of dictionary mode ([#&#8203;6480](https://github.com/colinhacks/zod/pull/6480)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`773a4867`](https://github.com/colinhacks/zod/commit/773a4867) refactor(v4): declare a trait's members on $constructor ([#&#8203;6478](https://github.com/colinhacks/zod/pull/6478)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`68fb3f13`](https://github.com/colinhacks/zod/commit/68fb3f13) feat(v4): make z.compile() fall back instead of throwing ([#&#8203;6479](https://github.com/colinhacks/zod/pull/6479)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`37b01501`](https://github.com/colinhacks/zod/commit/37b01501) feat(v4): add z.isValid and z.isValidAsync ([#&#8203;6471](https://github.com/colinhacks/zod/pull/6471)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`749f5452`](https://github.com/colinhacks/zod/commit/749f5452) docs: add fullproduct.dev to v4 ecosystem page ([#&#8203;6001](https://github.com/colinhacks/zod/pull/6001)) by [@&#8203;codinsonn](https://github.com/codinsonn) - [`24cdb7fd`](https://github.com/colinhacks/zod/commit/24cdb7fd) perf(v4): close the fastpass bindings into the compiled parser ([#&#8203;6464](https://github.com/colinhacks/zod/pull/6464)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`8d896186`](https://github.com/colinhacks/zod/commit/8d896186) fix(v4): stop emitting a multipleOf that JSON Schema rejects ([#&#8203;6468](https://github.com/colinhacks/zod/pull/6468)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`43f729db`](https://github.com/colinhacks/zod/commit/43f729db) feat(v4): make a tuple's items optional with .partial() ([#&#8203;6465](https://github.com/colinhacks/zod/pull/6465)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`97edaf7d`](https://github.com/colinhacks/zod/commit/97edaf7d) fix(v4): don't throw from safeParse on bigint multipleOf(0n) ([#&#8203;6466](https://github.com/colinhacks/zod/pull/6466)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`21a6f0cb`](https://github.com/colinhacks/zod/commit/21a6f0cb) feat(v4): let z.nanoid() take a custom length ([#&#8203;4004](https://github.com/colinhacks/zod/pull/4004)) by [@&#8203;oimo23](https://github.com/oimo23) - [`9d5b20ef`](https://github.com/colinhacks/zod/commit/9d5b20ef) fix(v4): restrict the first ULID character to \[0-7] ([#&#8203;6095](https://github.com/colinhacks/zod/pull/6095)) by [@&#8203;JSap0914](https://github.com/JSap0914) - [`1cf9cd09`](https://github.com/colinhacks/zod/commit/1cf9cd09) docs: record that error maps run per parse, and how to translate at render by [@&#8203;colinhacks](https://github.com/colinhacks) - [`7ce3e77d`](https://github.com/colinhacks/zod/commit/7ce3e77d) fix(v4): run a wrapper's inner schema on its own payload ([#&#8203;6462](https://github.com/colinhacks/zod/pull/6462)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`7b612b53`](https://github.com/colinhacks/zod/commit/7b612b53) fix(v4): fold an intersection of object schemas into one object ([#&#8203;6461](https://github.com/colinhacks/zod/pull/6461)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`1c43b774`](https://github.com/colinhacks/zod/commit/1c43b774) docs(v4): record why the failure path is not worth compiling by [@&#8203;colinhacks](https://github.com/colinhacks) - [`badf0b78`](https://github.com/colinhacks/zod/commit/badf0b78) fix(v4): build the catch context from the input that failed ([#&#8203;6192](https://github.com/colinhacks/zod/pull/6192)) by [@&#8203;zelinewang](https://github.com/zelinewang) - [`a87ac366`](https://github.com/colinhacks/zod/commit/a87ac366) fix(v4)!: distinguish number and bigint formats at the type level ([#&#8203;6052](https://github.com/colinhacks/zod/pull/6052)) by [@&#8203;abhishek-chaudhary2003](https://github.com/abhishek-chaudhary2003) - [`6726c1dd`](https://github.com/colinhacks/zod/commit/6726c1dd) docs: record what z.input and z.output do with transforms and wrappers by [@&#8203;colinhacks](https://github.com/colinhacks) - [`7cfc0122`](https://github.com/colinhacks/zod/commit/7cfc0122) fix(v4): keep a wrapper's stored value only on the side it belongs to by [@&#8203;colinhacks](https://github.com/colinhacks) - [`a825c1b0`](https://github.com/colinhacks/zod/commit/a825c1b0) fix(v4): empty enums and literals match nothing ([#&#8203;6459](https://github.com/colinhacks/zod/pull/6459)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`7c070db9`](https://github.com/colinhacks/zod/commit/7c070db9) feat(v4): expose the function schema on .implement() results ([#&#8203;6267](https://github.com/colinhacks/zod/pull/6267)) by [@&#8203;deepshekhardas](https://github.com/deepshekhardas) - [`3a496968`](https://github.com/colinhacks/zod/commit/3a496968) fix(v4): make record input keys optional when the value can fill them ([#&#8203;6460](https://github.com/colinhacks/zod/pull/6460)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`53cec2a0`](https://github.com/colinhacks/zod/commit/53cec2a0) fix(v4): resolve z.input past a preprocess transform by [@&#8203;colinhacks](https://github.com/colinhacks) - [`2125d30c`](https://github.com/colinhacks/zod/commit/2125d30c) fix(v4): accept exact decimal multiples in multipleOf ([#&#8203;6223](https://github.com/colinhacks/zod/pull/6223)) by [@&#8203;spokodev](https://github.com/spokodev) - [`168122fc`](https://github.com/colinhacks/zod/commit/168122fc) fix(v4): carry a pipe's own checks through z.output by [@&#8203;colinhacks](https://github.com/colinhacks) - [`51a1368a`](https://github.com/colinhacks/zod/commit/51a1368a) fix(v4): let the includes(position) pattern match at or after the offset ([#&#8203;6024](https://github.com/colinhacks/zod/pull/6024)) by [@&#8203;francisjohnjohnston-web](https://github.com/francisjohnjohnston-web) - [`72a05c4f`](https://github.com/colinhacks/zod/commit/72a05c4f) feat(v4): expose stringbool truthy/falsy/case via \_zod.bag ([#&#8203;6357](https://github.com/colinhacks/zod/pull/6357)) by [@&#8203;hamed-bavar](https://github.com/hamed-bavar) - [`036b39f4`](https://github.com/colinhacks/zod/commit/036b39f4) fix(v4)!: require seconds once a datetime carries a Z or an offset ([#&#8203;6457](https://github.com/colinhacks/zod/pull/6457)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`5825605e`](https://github.com/colinhacks/zod/commit/5825605e) perf(v4): skip the eager stack capture when building a ZodError ([#&#8203;6450](https://github.com/colinhacks/zod/pull/6450)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`d85472c4`](https://github.com/colinhacks/zod/commit/d85472c4) feat(v4): support declared symbol keys in z.object() ([#&#8203;6448](https://github.com/colinhacks/zod/pull/6448)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`d4108872`](https://github.com/colinhacks/zod/commit/d4108872) fix(v4): correct the date/time format keywords in both JSON Schema directions ([#&#8203;6452](https://github.com/colinhacks/zod/pull/6452)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`555e5f46`](https://github.com/colinhacks/zod/commit/555e5f46) Add z.toZod helper ([#&#8203;5913](https://github.com/colinhacks/zod/pull/5913)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`e0e51a55`](https://github.com/colinhacks/zod/commit/e0e51a55) docs(v4): cut the compile comments down to what they explain ([#&#8203;6449](https://github.com/colinhacks/zod/pull/6449)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`6574e784`](https://github.com/colinhacks/zod/commit/6574e784) fix(v4): stop catch resurrecting issues an optional already resolved ([#&#8203;6440](https://github.com/colinhacks/zod/pull/6440)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`937b5d01`](https://github.com/colinhacks/zod/commit/937b5d01) perf(v4): prefix issue paths in place in the object JIT failure path ([#&#8203;6445](https://github.com/colinhacks/zod/pull/6445)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`b63db248`](https://github.com/colinhacks/zod/commit/b63db248) fix(v4): keep a memoized node's cached issues private to the cache ([#&#8203;6443](https://github.com/colinhacks/zod/pull/6443)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`6ec3d043`](https://github.com/colinhacks/zod/commit/6ec3d043) fix(resolution): keep pnpm's own warnings out of the attw snapshot ([#&#8203;6446](https://github.com/colinhacks/zod/pull/6446)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`830ba314`](https://github.com/colinhacks/zod/commit/830ba314) fix(v4): validate the address, and return the string that was validated ([#&#8203;6442](https://github.com/colinhacks/zod/pull/6442)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`f101d8ca`](https://github.com/colinhacks/zod/commit/f101d8ca) Preserve callsites in parse stack traces ([#&#8203;5910](https://github.com/colinhacks/zod/pull/5910)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`6c77d028`](https://github.com/colinhacks/zod/commit/6c77d028) feat: compact simple anyOf unions to type array in toJSONSchema ([#&#8203;6339](https://github.com/colinhacks/zod/pull/6339)) by [@&#8203;deepshekhardas](https://github.com/deepshekhardas) - [`28e1ebd8`](https://github.com/colinhacks/zod/commit/28e1ebd8) fix(v4): measure string length in Unicode code points ([#&#8203;6441](https://github.com/colinhacks/zod/pull/6441)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`060bc9f3`](https://github.com/colinhacks/zod/commit/060bc9f3) refactor: share default when-clauses for size/length checks ([#&#8203;6394](https://github.com/colinhacks/zod/pull/6394)) by [@&#8203;zirkelc](https://github.com/zirkelc) - [`2848177d`](https://github.com/colinhacks/zod/commit/2848177d) docs: point the flattened/formatted error deprecations at a symbol that exists by [@&#8203;colinhacks](https://github.com/colinhacks) - [`3c2dee9e`](https://github.com/colinhacks/zod/commit/3c2dee9e) Add properties checks for instanceof schemas ([#&#8203;5912](https://github.com/colinhacks/zod/pull/5912)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`87ffeb0f`](https://github.com/colinhacks/zod/commit/87ffeb0f) fix(v4): an absent key on the middle rung supplies nothing ([#&#8203;6434](https://github.com/colinhacks/zod/pull/6434)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`7785fc82`](https://github.com/colinhacks/zod/commit/7785fc82) feat(v4): add z.getDiscriminatedOption ([#&#8203;5947](https://github.com/colinhacks/zod/pull/5947)) by [@&#8203;dokson](https://github.com/dokson) - [`0135c85a`](https://github.com/colinhacks/zod/commit/0135c85a) feat(v4): allow passing extra args to apply() ([#&#8203;6337](https://github.com/colinhacks/zod/pull/6337)) by [@&#8203;deepshekhardas](https://github.com/deepshekhardas) - [`ca246d26`](https://github.com/colinhacks/zod/commit/ca246d26) fix(v4): drop empty alternation branch from datetime pattern ([#&#8203;6439](https://github.com/colinhacks/zod/pull/6439)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`e073d55b`](https://github.com/colinhacks/zod/commit/e073d55b) docs: z.iso.datetime() accepts a subset of ISO 8601, not all of it by [@&#8203;colinhacks](https://github.com/colinhacks) - [`d6ca12ae`](https://github.com/colinhacks/zod/commit/d6ca12ae) fix(v4): infer recursive getter options in discriminatedUnion ([#&#8203;6422](https://github.com/colinhacks/zod/pull/6422)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`dc51404b`](https://github.com/colinhacks/zod/commit/dc51404b) Add shorn to Zod Utilities ([#&#8203;6398](https://github.com/colinhacks/zod/pull/6398)) by [@&#8203;ChiChuRita](https://github.com/ChiChuRita) - [`580111da`](https://github.com/colinhacks/zod/commit/580111da) docs: mark AOT compilation as canary-only by [@&#8203;colinhacks](https://github.com/colinhacks) - [`6b0dae79`](https://github.com/colinhacks/zod/commit/6b0dae79) docs: note that a catch callback is not islanded by [@&#8203;colinhacks](https://github.com/colinhacks) - [`898c4461`](https://github.com/colinhacks/zod/commit/898c4461) refactor(v4): give the runtime and compiled code one URL implementation by [@&#8203;colinhacks](https://github.com/colinhacks) - [`260e5d4b`](https://github.com/colinhacks/zod/commit/260e5d4b) fix(v4): stop islanding a catch callback, which diverged silently by [@&#8203;colinhacks](https://github.com/colinhacks) - [`11c9268b`](https://github.com/colinhacks/zod/commit/11c9268b) revert(core): drop the exactOptional parse prototype from [#&#8203;6432](https://github.com/colinhacks/zod/issues/6432) ([#&#8203;6438](https://github.com/colinhacks/zod/pull/6438)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`a38ab4a8`](https://github.com/colinhacks/zod/commit/a38ab4a8) fix(core): an omittable discriminator claims undefined ([#&#8203;6432](https://github.com/colinhacks/zod/pull/6432)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`c9ec89e0`](https://github.com/colinhacks/zod/commit/c9ec89e0) perf(core): drop the seal and the per-key WeakSet from the lazy internals ([#&#8203;6435](https://github.com/colinhacks/zod/pull/6435)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`3c9ca1d9`](https://github.com/colinhacks/zod/commit/3c9ca1d9) feat(json-schema): emit a root $ref when the root schema has an id ([#&#8203;6029](https://github.com/colinhacks/zod/pull/6029)) by [@&#8203;dinwwwh](https://github.com/dinwwwh) - [`fa77a4d7`](https://github.com/colinhacks/zod/commit/fa77a4d7) feat(v4): z.compile — ahead-of-time schema compilation ([#&#8203;6085](https://github.com/colinhacks/zod/pull/6085)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`f300476d`](https://github.com/colinhacks/zod/commit/f300476d) fix(v4): let a schema's error map cover its own checks' issues ([#&#8203;6426](https://github.com/colinhacks/zod/pull/6426)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`9f0a3d81`](https://github.com/colinhacks/zod/commit/9f0a3d81) fix(core): restore defineLazy semantics lost in the internals move ([#&#8203;6429](https://github.com/colinhacks/zod/pull/6429)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`604464c3`](https://github.com/colinhacks/zod/commit/604464c3) fix(locales): da/nn/no/sv called an IP address a range ([#&#8203;6430](https://github.com/colinhacks/zod/pull/6430)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`7378e7cd`](https://github.com/colinhacks/zod/commit/7378e7cd) fix(locales): backfill the mac and Sizable.map gaps, and pin dictionary parity ([#&#8203;6427](https://github.com/colinhacks/zod/pull/6427)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`b1077f05`](https://github.com/colinhacks/zod/commit/b1077f05) perf(memory): install derived internals on a per-constructor prototype ([#&#8203;6415](https://github.com/colinhacks/zod/pull/6415)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`ccc15144`](https://github.com/colinhacks/zod/commit/ccc15144) fix(locales): add the credit_card key to the seven locales missing it ([#&#8203;6424](https://github.com/colinhacks/zod/pull/6424)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`73bacbbb`](https://github.com/colinhacks/zod/commit/73bacbbb) fix(from-json-schema): drop redundant inclusive bound for draft-04 exclusive ranges ([#&#8203;6022](https://github.com/colinhacks/zod/pull/6022)) by [@&#8203;francisjohnjohnston-web](https://github.com/francisjohnjohnston-web) - [`86b2e6da`](https://github.com/colinhacks/zod/commit/86b2e6da) docs: list el and hr in the supported locales ([#&#8203;6423](https://github.com/colinhacks/zod/pull/6423)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`45fdeda5`](https://github.com/colinhacks/zod/commit/45fdeda5) fix(v4): refine optin into a three-rung ladder, retire the fallback payload flag ([#&#8203;6419](https://github.com/colinhacks/zod/pull/6419)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`5b34c0ce`](https://github.com/colinhacks/zod/commit/5b34c0ce) Improve Portuguese localization and add Brazilian Portuguese (pt-BR) ([#&#8203;6076](https://github.com/colinhacks/zod/pull/6076)) by [@&#8203;thristhart](https://github.com/thristhart) - [`dc1a40a5`](https://github.com/colinhacks/zod/commit/dc1a40a5) fix(locales): improve french translation ([#&#8203;6120](https://github.com/colinhacks/zod/pull/6120)) by [@&#8203;tsmartin9](https://github.com/tsmartin9) - [`0175a043`](https://github.com/colinhacks/zod/commit/0175a043) feat(locales): add Hindi and Kannada locale support ([#&#8203;6315](https://github.com/colinhacks/zod/pull/6315)) by [@&#8203;vedanshshetti](https://github.com/vedanshshetti) - [`536ee3b0`](https://github.com/colinhacks/zod/commit/536ee3b0) Locales: added Slovak (sk) language ([#&#8203;6041](https://github.com/colinhacks/zod/pull/6041)) by [@&#8203;belicam](https://github.com/belicam) - [`07b0c3d8`](https://github.com/colinhacks/zod/commit/07b0c3d8) fix: preserve explicit superRefine issue input ([#&#8203;6053](https://github.com/colinhacks/zod/pull/6053)) by [@&#8203;frastefanini](https://github.com/frastefanini) - [`ba98071c`](https://github.com/colinhacks/zod/commit/ba98071c) feat: add .exactPartial() to ZodObject ([#&#8203;6065](https://github.com/colinhacks/zod/pull/6065)) by [@&#8203;andersk](https://github.com/andersk) - [`234c407d`](https://github.com/colinhacks/zod/commit/234c407d) feat(lang): Added Bengali locale ([#&#8203;5974](https://github.com/colinhacks/zod/pull/5974)) by [@&#8203;musaddiq-rafi](https://github.com/musaddiq-rafi) - [`377cd9d7`](https://github.com/colinhacks/zod/commit/377cd9d7) feat(locales): add turkmen (tk) locale ([#&#8203;6168](https://github.com/colinhacks/zod/pull/6168)) by [@&#8203;tachmyratsaparmyradov](https://github.com/tachmyratsaparmyradov) - [`69b6bb08`](https://github.com/colinhacks/zod/commit/69b6bb08) feat(locales): add Norwegian Nynorsk (nn) locale ([#&#8203;6092](https://github.com/colinhacks/zod/pull/6092)) by [@&#8203;arvindfroi](https://github.com/arvindfroi) - [`33d82e6b`](https://github.com/colinhacks/zod/commit/33d82e6b) Add Central Kurdish (ckb) locale ([#&#8203;6078](https://github.com/colinhacks/zod/pull/6078)) by [@&#8203;KUMachine](https://github.com/KUMachine) - [`06666fe2`](https://github.com/colinhacks/zod/commit/06666fe2) fix(fr): remove hyphen in "non-optionnel" ([#&#8203;5999](https://github.com/colinhacks/zod/pull/5999)) by [@&#8203;spidersouris](https://github.com/spidersouris) - [`79cfedea`](https://github.com/colinhacks/zod/commit/79cfedea) feat(v4): expose the owning schema on check-originated issues ([#&#8203;6420](https://github.com/colinhacks/zod/pull/6420)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`436b5da8`](https://github.com/colinhacks/zod/commit/436b5da8) docs: propose compiled constructor graph by [@&#8203;colinhacks](https://github.com/colinhacks) - [`eb4682c9`](https://github.com/colinhacks/zod/commit/eb4682c9) fix(json-schema): resolve tuple minItems past transform and catch in input mode ([#&#8203;6418](https://github.com/colinhacks/zod/pull/6418)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`4d6b5cd3`](https://github.com/colinhacks/zod/commit/4d6b5cd3) fix(json-schema): route unrepresentable default values through `unrepresentable` by [@&#8203;colinhacks](https://github.com/colinhacks) - [`2abc9e05`](https://github.com/colinhacks/zod/commit/2abc9e05) docs: note that the JSON Schema emitter reads static optin ([#&#8203;6417](https://github.com/colinhacks/zod/pull/6417)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`578e1cd0`](https://github.com/colinhacks/zod/commit/578e1cd0) feat(v4): support format: "hostname" in fromJSONSchema ([#&#8203;6305](https://github.com/colinhacks/zod/pull/6305)) by [@&#8203;catdalfonso](https://github.com/catdalfonso) - [`942bf8cb`](https://github.com/colinhacks/zod/commit/942bf8cb) feat(v4): parse input containing reference cycles ([#&#8203;6387](https://github.com/colinhacks/zod/pull/6387)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`78b523f0`](https://github.com/colinhacks/zod/commit/78b523f0) fix(json-schema): keep preprocess object properties required in input mode ([#&#8203;6133](https://github.com/colinhacks/zod/pull/6133)) by [@&#8203;MerlijnW70](https://github.com/MerlijnW70) - [`973b1b44`](https://github.com/colinhacks/zod/commit/973b1b44) fix(v4): strip output-typed catch values from the input JSON Schema ([#&#8203;6409](https://github.com/colinhacks/zod/pull/6409)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`5e608851`](https://github.com/colinhacks/zod/commit/5e608851) feat(v4): add z.deepPartial and runtime z.input / z.output ([#&#8203;5928](https://github.com/colinhacks/zod/pull/5928)) by [@&#8203;dokson](https://github.com/dokson) - [`4e1720c8`](https://github.com/colinhacks/zod/commit/4e1720c8) fix(v4): align record keys and intersection strictness with TypeScript ([#&#8203;6412](https://github.com/colinhacks/zod/pull/6412)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`4cc4053d`](https://github.com/colinhacks/zod/commit/4cc4053d) fix: honor loose mode for closed record key schemas ([#&#8203;6157](https://github.com/colinhacks/zod/pull/6157)) by [@&#8203;pullfrog\[bot\]](https://github.com/pullfrog\[bot]) - [`69be843f`](https://github.com/colinhacks/zod/commit/69be843f) fix(v4): stop the object JIT fastpass keeping a swallowed issue's value ([#&#8203;6407](https://github.com/colinhacks/zod/pull/6407)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`b899cd17`](https://github.com/colinhacks/zod/commit/b899cd17) perf(json-schema): make toJSONSchema(registry) linear in registry size ([#&#8203;6408](https://github.com/colinhacks/zod/pull/6408)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`6074828e`](https://github.com/colinhacks/zod/commit/6074828e) fix(v4): make fromJSONSchema propertyNames compose with the other object keywords ([#&#8203;6411](https://github.com/colinhacks/zod/pull/6411)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`d7b209f3`](https://github.com/colinhacks/zod/commit/d7b209f3) docs: point the Web URLs callout at z.httpUrl() ([#&#8203;6410](https://github.com/colinhacks/zod/pull/6410)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`611bd762`](https://github.com/colinhacks/zod/commit/611bd762) fix(mini): make merge() take an object schema, matching classic ([#&#8203;6404](https://github.com/colinhacks/zod/pull/6404)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`b53e53cc`](https://github.com/colinhacks/zod/commit/b53e53cc) fix(v4): use exact flag in English locale too_small/too_big messages ([#&#8203;6177](https://github.com/colinhacks/zod/pull/6177)) by [@&#8203;pullfrog\[bot\]](https://github.com/pullfrog\[bot]) - [`421cc9a5`](https://github.com/colinhacks/zod/commit/421cc9a5) fix(json-schema): unescape JSON Pointer tokens when resolving $ref ([#&#8203;6402](https://github.com/colinhacks/zod/pull/6402)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`4c27fe87`](https://github.com/colinhacks/zod/commit/4c27fe87) fix(v4): give z.xor() a distinct error when multiple options match ([#&#8203;6376](https://github.com/colinhacks/zod/pull/6376)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`a106fbe7`](https://github.com/colinhacks/zod/commit/a106fbe7) fix(v4): make fromJSONSchema tuples open-ended by default ([#&#8203;6020](https://github.com/colinhacks/zod/pull/6020)) by [@&#8203;mneetika](https://github.com/mneetika) - [`e8034eba`](https://github.com/colinhacks/zod/commit/e8034eba) fix(v4): make prefixItems/draft-7 items respect minItems in fromJSONSchema ([#&#8203;6201](https://github.com/colinhacks/zod/pull/6201)) by [@&#8203;pullfrog\[bot\]](https://github.com/pullfrog\[bot]) - [`784e5c26`](https://github.com/colinhacks/zod/commit/784e5c26) fix(v4): let bundlers tree-shake locales out of the default import ([#&#8203;6384](https://github.com/colinhacks/zod/pull/6384)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`97edd70a`](https://github.com/colinhacks/zod/commit/97edd70a) fix(toJSONSchema): constrain closed tuple length ([#&#8203;6194](https://github.com/colinhacks/zod/pull/6194)) by [@&#8203;pullfrog\[bot\]](https://github.com/pullfrog\[bot]) - [`f150020d`](https://github.com/colinhacks/zod/commit/f150020d) fix(v4): escape non-string enum values in template literal patterns ([#&#8203;5934](https://github.com/colinhacks/zod/pull/5934)) by [@&#8203;gwagjiug](https://github.com/gwagjiug) - [`faf33a28`](https://github.com/colinhacks/zod/commit/faf33a28) fix: surface [@&#8203;deprecated](https://github.com/deprecated) on re-exported compat aliases ([#&#8203;6072](https://github.com/colinhacks/zod/pull/6072)) by [@&#8203;MahinAnowar](https://github.com/MahinAnowar) - [`3956224a`](https://github.com/colinhacks/zod/commit/3956224a) docs: state that metadata wins over generated JSON Schema keywords ([#&#8203;6401](https://github.com/colinhacks/zod/pull/6401)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`a1904fc2`](https://github.com/colinhacks/zod/commit/a1904fc2) fix(v4): report date origin for numeric min/max bounds ([#&#8203;6129](https://github.com/colinhacks/zod/pull/6129)) by [@&#8203;MerlijnW70](https://github.com/MerlijnW70) - [`bd18314c`](https://github.com/colinhacks/zod/commit/bd18314c) fix: escape JSON Pointer reserved characters in toJSONSchema $ref (closes [#&#8203;6027](https://github.com/colinhacks/zod/issues/6027)) ([#&#8203;6144](https://github.com/colinhacks/zod/pull/6144)) by [@&#8203;MaksZhukov](https://github.com/MaksZhukov) - [`2a5164f5`](https://github.com/colinhacks/zod/commit/2a5164f5) fix(v4): enforce RFC 1035 length limits in regexes.domain ([#&#8203;6035](https://github.com/colinhacks/zod/pull/6035)) by [@&#8203;emmayusufu](https://github.com/emmayusufu) - [`0e5bc4b1`](https://github.com/colinhacks/zod/commit/0e5bc4b1) fix(v4): respect additionalProperties:false with patternProperties in fromJSONSchema ([#&#8203;6199](https://github.com/colinhacks/zod/pull/6199)) by [@&#8203;pullfrog\[bot\]](https://github.com/pullfrog\[bot]) - [`c8f06d36`](https://github.com/colinhacks/zod/commit/c8f06d36) fix(v4): clarify infinite number errors ([#&#8203;5906](https://github.com/colinhacks/zod/pull/5906)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`9a7ecc35`](https://github.com/colinhacks/zod/commit/9a7ecc35) fix(json-schema): accept RFC 3339 numeric offsets in date-time format ([#&#8203;6298](https://github.com/colinhacks/zod/pull/6298)) by [@&#8203;agcty](https://github.com/agcty) - [`0a76f3d7`](https://github.com/colinhacks/zod/commit/0a76f3d7) feat(v4): add z.creditCard() string format ([#&#8203;5931](https://github.com/colinhacks/zod/pull/5931)) by [@&#8203;dokson](https://github.com/dokson) - [`bd6619c0`](https://github.com/colinhacks/zod/commit/bd6619c0) feat(json-schema): accept a function for `unrepresentable` ([#&#8203;6380](https://github.com/colinhacks/zod/pull/6380)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`9d20fdc3`](https://github.com/colinhacks/zod/commit/9d20fdc3) fix(v4): preserve z.preprocess input narrowing ([#&#8203;5967](https://github.com/colinhacks/zod/pull/5967)) by [@&#8203;devareddy05](https://github.com/devareddy05) - [`3063993a`](https://github.com/colinhacks/zod/commit/3063993a) perf(v4): cut per-schema memory \~90% by moving methods to the prototype ([#&#8203;6318](https://github.com/colinhacks/zod/pull/6318)) by [@&#8203;zirkelc](https://github.com/zirkelc) - [`fd074106`](https://github.com/colinhacks/zod/commit/fd074106) feat(json-schema): run `override` before the unrepresentable error ([#&#8203;6391](https://github.com/colinhacks/zod/pull/6391)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`2715c12e`](https://github.com/colinhacks/zod/commit/2715c12e) fix(v4): preserve default English locale across tree-shaken bundles ([#&#8203;5959](https://github.com/colinhacks/zod/pull/5959)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`81d9fc6c`](https://github.com/colinhacks/zod/commit/81d9fc6c) docs: add zod-form-action to ecosystem ([#&#8203;6314](https://github.com/colinhacks/zod/pull/6314)) by [@&#8203;Vish05](https://github.com/Vish05) - [`d86df5e0`](https://github.com/colinhacks/zod/commit/d86df5e0) docs: add ArkEnv to ecosystem page ([#&#8203;6203](https://github.com/colinhacks/zod/pull/6203)) by [@&#8203;yamcodes](https://github.com/yamcodes) - [`18b4ff99`](https://github.com/colinhacks/zod/commit/18b4ff99) docs(ecosystem): add zodql to API Libraries ([#&#8203;6227](https://github.com/colinhacks/zod/pull/6227)) by [@&#8203;mattiasahlsen](https://github.com/mattiasahlsen) - [`479d6f51`](https://github.com/colinhacks/zod/commit/479d6f51) shill oxlint ([#&#8203;6196](https://github.com/colinhacks/zod/pull/6196)) by [@&#8203;samchungy](https://github.com/samchungy) - [`85dba7e1`](https://github.com/colinhacks/zod/commit/85dba7e1) docs: document that any/unknown object keys are required ([#&#8203;6388](https://github.com/colinhacks/zod/pull/6388)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`d24fb4c3`](https://github.com/colinhacks/zod/commit/d24fb4c3) fix: consistently strip **proto** from parsed objects ([#&#8203;6386](https://github.com/colinhacks/zod/pull/6386)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`7708d447`](https://github.com/colinhacks/zod/commit/7708d447) perf(v4): lazy ZodError construction ([#&#8203;6316](https://github.com/colinhacks/zod/pull/6316)) by [@&#8203;zirkelc](https://github.com/zirkelc) - [`8ac9ae51`](https://github.com/colinhacks/zod/commit/8ac9ae51) fix(docs-v3): serve the docsify SPA fallback on Vercel ([#&#8203;6378](https://github.com/colinhacks/zod/pull/6378)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`31384464`](https://github.com/colinhacks/zod/commit/31384464) fix(v4): complete reserved-key hardening ([#&#8203;6371](https://github.com/colinhacks/zod/pull/6371)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`600c6909`](https://github.com/colinhacks/zod/commit/600c6909) docs: add Attaform to ecosystem ([#&#8203;6188](https://github.com/colinhacks/zod/pull/6188)) by [@&#8203;ozzyfromspace](https://github.com/ozzyfromspace) - [`37c05fa5`](https://github.com/colinhacks/zod/commit/37c05fa5) docs(ecosystem): rename zod-to-mongo-schema to zod-mongo-schema ([#&#8203;6178](https://github.com/colinhacks/zod/pull/6178)) by [@&#8203;udohjeremiah](https://github.com/udohjeremiah) - [`badfdf08`](https://github.com/colinhacks/zod/commit/badfdf08) docs: update keyof() ZodEnum type to the v4 form ([#&#8203;6124](https://github.com/colinhacks/zod/pull/6124)) by [@&#8203;patrickwehbe](https://github.com/patrickwehbe) - [`e25b68e1`](https://github.com/colinhacks/zod/commit/e25b68e1) perf(v4): let three dead declarations tree-shake under esbuild ([#&#8203;6381](https://github.com/colinhacks/zod/pull/6381)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`53397351`](https://github.com/colinhacks/zod/commit/53397351) docs(ecosystem): Add zod-mongoose list item in Zod To X ([#&#8203;6062](https://github.com/colinhacks/zod/pull/6062)) by [@&#8203;Harm-Nullix](https://github.com/Harm-Nullix) - [`dfa0deb1`](https://github.com/colinhacks/zod/commit/dfa0deb1) docs: add tauri-typegen to ecosystem ([#&#8203;6032](https://github.com/colinhacks/zod/pull/6032)) by [@&#8203;thwbh](https://github.com/thwbh) - [`9c914ee8`](https://github.com/colinhacks/zod/commit/9c914ee8) docs: add dynamic error message and combined refinement examples for refine() ([#&#8203;6002](https://github.com/colinhacks/zod/pull/6002)) by [@&#8203;IdanGonen](https://github.com/IdanGonen) - [`921649de`](https://github.com/colinhacks/zod/commit/921649de) fix(v4): formatError and treeifyError handle inherited-name path elements ([#&#8203;6367](https://github.com/colinhacks/zod/pull/6367)) by [@&#8203;deepshekhardas](https://github.com/deepshekhardas) - [`e7029aa4`](https://github.com/colinhacks/zod/commit/e7029aa4) fix(v4): report own **proto** key under .strict() ([#&#8203;6221](https://github.com/colinhacks/zod/pull/6221)) by [@&#8203;pullfrog\[bot\]](https://github.com/pullfrog\[bot]) - [`9c540db8`](https://github.com/colinhacks/zod/commit/9c540db8) fix(v4): re-check the record key after the key schema runs ([#&#8203;6355](https://github.com/colinhacks/zod/pull/6355)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`8bb89ea4`](https://github.com/colinhacks/zod/commit/8bb89ea4) docs: add .nonempty() to Strings, Arrays, Sets, and Maps sections ([#&#8203;6056](https://github.com/colinhacks/zod/pull/6056)) by [@&#8203;pullfrog\[bot\]](https://github.com/pullfrog\[bot]) - [`599c0e41`](https://github.com/colinhacks/zod/commit/599c0e41) docs(ecosystem): Add `@chrock-studio/overload` and `@chrock-studio/zod-utils` ([#&#8203;6040](https://github.com/colinhacks/zod/pull/6040)) by [@&#8203;JuerGenie](https://github.com/JuerGenie) - [`27a9036a`](https://github.com/colinhacks/zod/commit/27a9036a) docs(ecosystem): `eslint-plugin-zod` is `eslint-zod` now ([#&#8203;5975](https://github.com/colinhacks/zod/pull/5975)) by [@&#8203;marcalexiei](https://github.com/marcalexiei) - [`e177a0ee`](https://github.com/colinhacks/zod/commit/e177a0ee) docs(v4): document coerce missing-key breaking change ([#&#8203;5957](https://github.com/colinhacks/zod/pull/5957)) ([#&#8203;5964](https://github.com/colinhacks/zod/pull/5964)) by [@&#8203;dokson](https://github.com/dokson) - [`66fba964`](https://github.com/colinhacks/zod/commit/66fba964) docs: show z.instanceof with built-in classes ([#&#8203;6059](https://github.com/colinhacks/zod/pull/6059)) by [@&#8203;itsahmedbilal](https://github.com/itsahmedbilal) - [`2d90846a`](https://github.com/colinhacks/zod/commit/2d90846a) fix(docs): make the prefault example runnable ([#&#8203;6063](https://github.com/colinhacks/zod/pull/6063)) by [@&#8203;DucMinhNe](https://github.com/DucMinhNe) - [`ead9fcb3`](https://github.com/colinhacks/zod/commit/ead9fcb3) fix(v4): write a declared **proto** key as an own property ([#&#8203;6354](https://github.com/colinhacks/zod/pull/6354)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`c58764c5`](https://github.com/colinhacks/zod/commit/c58764c5) docs: fix UUID helper list in v4 introduction ([#&#8203;6214](https://github.com/colinhacks/zod/pull/6214)) by [@&#8203;meliharik](https://github.com/meliharik) - [`f238fbd2`](https://github.com/colinhacks/zod/commit/f238fbd2) fix: remove exponential backtracking from the emoji regex ([#&#8203;6347](https://github.com/colinhacks/zod/pull/6347)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`e6c213ec`](https://github.com/colinhacks/zod/commit/e6c213ec) fix(json-schema): keep **proto** keys as own properties in schema conversion ([#&#8203;6346](https://github.com/colinhacks/zod/pull/6346)) by [@&#8203;colinhacks](https://github.com/colinhacks) - [`573fcb75`](https://github.com/colinhacks/zod/commit/573fcb75) fix(errors): use own-property semantics in every error-tree walker ([#&#8203;6213](https://github.com/colinhacks/zod/pull/6213)) by [@&#8203;pullfrog\[bot\]](https://github.com/pullfrog\[bot]) - [`6f5e99fd`](https://github.com/colinhacks/zod/commit/6f5e99fd) fix(docs-v3): rename README.md to home.md so Vercel serves it by [@&#8203;colinhacks](https://github.com/colinhacks) - [`bbc68f99`](https://github.com/colinhacks/zod/commit/bbc68f99) docs: soften Zod 3 EOL callouts to informational tone by [@&#8203;colinhacks](https://github.com/colinhacks) - [`3fc9b25f`](https://github.com/colinhacks/zod/commit/3fc9b25f) docs: reframe library-authors page Zod-4-first; note Zod 3 EOL by [@&#8203;colinhacks](https://github.com/colinhacks) - [`f29f2a6d`](https://github.com/colinhacks/zod/commit/f29f2a6d) fix(v4): cidrv6 JSON schema pattern matches runtime ([#&#8203;5945](https://github.com/colinhacks/zod/pull/5945)) by [@&#8203;dokson](https://github.com/dokson) - [`dfd8766b`](https://github.com/colinhacks/zod/commit/dfd8766b) fix(v4): break circular import between classic schemas and iso ([#&#8203;5275](https://github.com/colinhacks/zod/pull/5275)) ([#&#8203;5926](https://github.com/colinhacks/zod/pull/5926)) by [@&#8203;dokson](https://github.com/dokson) - [`fbe8ad1b`](https://github.com/colinhacks/zod/commit/fbe8ad1b) fix(v4): allow dynamic `.catch()` under `unrepresentable: "any"` ([#&#8203;5273](https://github.com/colinhacks/zod/pull/5273)) ([#&#8203;5925](https://github.com/colinhacks/zod/pull/5925)) by [@&#8203;dokson](https://github.com/dokson) ### [`v4.4.3`](https://github.com/colinhacks/zod/releases/tag/v4.4.3) [Compare Source](https://github.com/colinhacks/zod/compare/v4.4.2...v4.4.3) #### Commits: - [`4c2fa95`](https://github.com/colinhacks/zod/commit/4c2fa95ce3f3390fbc522324e406b4e9e89b88f9) docs: use Zernio primary wordmark for gold sponsor logo - [`2aeec83`](https://github.com/colinhacks/zod/commit/2aeec83eb135e3a83756e973ef44845fc5a455d2) docs: prune lapsed gold sponsors and rebalance logo sizing - [`7391be8`](https://github.com/colinhacks/zod/commit/7391be88ac1ee5cd02057f5ccc012a1f5df4efd0) docs: prune lapsed silver/bronze sponsors and add active ones - [`2c70332`](https://github.com/colinhacks/zod/commit/2c703322a21b4e2b12f33f49ea8430c451a68b4f) docs: normalize bronze sponsor logos to github avatar pattern - [`9195250`](https://github.com/colinhacks/zod/commit/9195250cab0e7950efe39c3926d6c203b4b0a170) docs: remove Mintlify from bronze sponsors (churned) - [`b8dffe9`](https://github.com/colinhacks/zod/commit/b8dffe9e62f17e6571e6249d05cc5102b54d94e4) docs: remove Numeric and Speakeasy (2+ missed monthly cycles) - [`1cab693`](https://github.com/colinhacks/zod/commit/1cab69383fcdeae2a366d5e2a2fc4d8fc765d168) fix(v4): restore catch handling for absent object keys ([#&#8203;5937](https://github.com/colinhacks/zod/issues/5937)) ([#&#8203;5939](https://github.com/colinhacks/zod/issues/5939)) - [`c2be4f8`](https://github.com/colinhacks/zod/commit/c2be4f819064eed62c7c350a2d399b5faecd15f8) fix(v4): generalize optin/fallback to transform; restore preprocess on absent keys ([#&#8203;5941](https://github.com/colinhacks/zod/issues/5941)) - [`f3c9ec0`](https://github.com/colinhacks/zod/commit/f3c9ec03ba7a28ae72d25cc295f38674bee0f559) 4.4.3 - [`1fb56a5`](https://github.com/colinhacks/zod/commit/1fb56a5c18c27102dbc92260a4007c7732a0ccca) docs: document release procedure in AGENTS.md ### [`v4.4.2`](https://github.com/colinhacks/zod/releases/tag/v4.4.2) [Compare Source](https://github.com/colinhacks/zod/compare/v4.4.1...v4.4.2) #### Commits: - [`0c62df0`](https://github.com/colinhacks/zod/commit/0c62df0ea19fd05abdf90473e9eef7eea530fab2) Clean up docs navigation and stale labels ([#&#8203;5901](https://github.com/colinhacks/zod/issues/5901)) - [`20cc794`](https://github.com/colinhacks/zod/commit/20cc794895cc8604fe0c87d83a5d1c3f89fad0ac) chore: add security policy and refresh tooling deps - [`6fbe07b`](https://github.com/colinhacks/zod/commit/6fbe07b0177efdd1bf1c0b05160e70d7a0702337) fix(docs): heading anchor links now include the hash so it doesnt scoll all the way up, follows navbar logic ([#&#8203;5791](https://github.com/colinhacks/zod/issues/5791)) - [`4bbed1b`](https://github.com/colinhacks/zod/commit/4bbed1b1c73eca4ce9e59b1189ed236aa6c8b5bd) Tighten discriminated union option typing - [`bbac3e5`](https://github.com/colinhacks/zod/commit/bbac3e567e7fccfaaf7cdc97f1ce30c295e2c908) Update PR guidance for agents - [`cf0dc94`](https://github.com/colinhacks/zod/commit/cf0dc942a32805c292fff59ade20a7ace980735a) Merge remote-tracking branch 'origin/main' into fix-discriminated-union-key-constraint - [`292c894`](https://github.com/colinhacks/zod/commit/292c894a5fd2aa42e527900b83d8d7a3009a709c) docs: add Zernio gold sponsor - [`1fc9f31`](https://github.com/colinhacks/zod/commit/1fc9f311c28dcf80d0bb5a36b177086cbc3d8eca) docs: document codec inversion - [`1373c85`](https://github.com/colinhacks/zod/commit/1373c85da9aeff704a9762d27bc58699618aefb7) docs: remove AI disclosure guidance - [`e20d02b`](https://github.com/colinhacks/zod/commit/e20d02b473c08e3a4e557bc610b1b5fac079b649) chore: ignore triage notes - [`e58ea4d`](https://github.com/colinhacks/zod/commit/e58ea4d91b1dfe8194b73508203213cbc7e9c936) docs: test Zod Mini tab code heights - [`905761a`](https://github.com/colinhacks/zod/commit/905761a5d127e8d5dd2ebb3bc88c75cb0b8149ff) docs: document preprocess input type narrowing - [`bf64bac`](https://github.com/colinhacks/zod/commit/bf64bac850d4dee2b7dde7e64909d5d796d32043) chore: tighten test guidance in AGENTS.md - [`8ec4e73`](https://github.com/colinhacks/zod/commit/8ec4e73f4c4693b6361ad591be40fb41eb8a9f95) chore: update play.ts scratch - [`02c2baf`](https://github.com/colinhacks/zod/commit/02c2baf7d0d615872fa4528a8020603b71211702) Make z.preprocess defer optionality to inner schema ([#&#8203;5929](https://github.com/colinhacks/zod/issues/5929)) - [`88015df`](https://github.com/colinhacks/zod/commit/88015df8e25c44fb5385eb3ef28935119cd5edea) fix(docs): drop deprecated `baseUrl` from tsconfig - [`c59d447`](https://github.com/colinhacks/zod/commit/c59d4474e3b4cad1b323462186cf607178ce8267) 4.4.2 ### [`v4.4.1`](https://github.com/colinhacks/zod/releases/tag/v4.4.1) [Compare Source](https://github.com/colinhacks/zod/compare/v4.4.0...v4.4.1) #### Commits: - [`481f7be`](https://github.com/colinhacks/zod/commit/481f7be4238c83ed58183f921b2646f340a91c6a) ci: gate release publishing on full test workflow - [`95ccab4`](https://github.com/colinhacks/zod/commit/95ccab423aec720b2523c3a64cdc7e3204537cc7) test(v3): restore optional undefined expectations - [`cede2c6`](https://github.com/colinhacks/zod/commit/cede2c63739a5823d6aa5093d291e9a111da943d) fix(v4): reject tuple holes before required defaults ([#&#8203;5900](https://github.com/colinhacks/zod/issues/5900)) - [`edd0bf0`](https://github.com/colinhacks/zod/commit/edd0bf0f5ada4a8dc581c259407d7bbad0a71ea7) release: 4.4.1 - [`180d83d`](https://github.com/colinhacks/zod/commit/180d83d1dbe6a59260710cc8637a3dea2281ee56) docs: remove Jazz featured sponsor ### [`v4.4.0`](https://github.com/colinhacks/zod/releases/tag/v4.4.0) [Compare Source](https://github.com/colinhacks/zod/compare/v4.3.6...v4.4.0) #### 4.4.0 This is a minor release with a wide set of correctness and soundness fixes. Some fixes intentionally make Zod stricter, so code that depended on previously accepted invalid or ambiguous inputs may need small updates. #### Potentially breaking bug fixes ##### Tuple defaults now materialize output values correctly Fixed in [#&#8203;5661](https://github.com/colinhacks/zod/pull/5661). Tuple parsing now more accurately reflects defaults, optional tails, explicit `undefined`, and under-filled inputs. The headline behavior is that defaults in tuple positions now properly appear in parsed output. ```ts const schema = z.tuple([ z.string(), z.string().default("fallback"), ]); schema.parse(["a"]); // ["a", "fallback"] ``` Trailing optional elements that are absent still stay absent; they are not filled with `undefined`. ```ts const schema = z.tuple([ z.string(), z.string().optional(), ]); schema.parse(["a"]); // ["a"] ``` But explicit `undefined` values supplied by the caller are preserved. ```ts schema.parse(["a", undefined]); // ["a", undefined] ``` When optional elements appear before later defaults, the parsed tuple is now dense so array operations behave predictably. ```ts const schema = z.tuple([ z.string(), z.string().optional(), z.string().default("fallback"), ]); schema.parse(["a"]); // ["a", undefined, "fallback"] ``` Tuple length errors are also more consistent now. Since `z.function()` arguments are tuple-shaped, function input errors may look different. ##### Required object properties with `z.undefined()` Fixed in [#&#8203;5661](https://github.com/colinhacks/zod/pull/5661), with follow-up coverage in [`57d80a82`](https://github.com/colinhacks/zod/commit/57d80a82bde8877f3eb79e5dad9786096c37490f). A property whose schema is `z.undefined()` is now treated as required. The key must be present, but its value may be `undefined`. ```ts const schema = z.object({ value: z.undefined(), }); schema.safeParse({}).success; // false schema.safeParse({ value: undefined }).success; // true ``` Use `.optional()` when the key itself may be absent. ```ts const schema = z.object({ value: z.undefined().optional(), }); schema.safeParse({}).success; // true ``` This also affects related `.catch()`, `.partial()`, `.default()`, and `.prefault()` combinations that previously relied on missing `z.undefined()` keys being treated as optional. ##### Safer `.merge()` behavior with refinements Fixed in [#&#8203;5856](https://github.com/colinhacks/zod/pull/5856). The `.merge()` method now throws when the receiver has refinements, rather than silently producing ambiguous refinement behavior. Refinements from the second schema are preserved. ```ts const a = z.object({ a: z.string() }).refine((val) => val.a.length > 0); const b = z.object({ b: z.string() }); a.merge(b); // throws ``` > Prefer `.extend()` or `.safeExtend()` for object composition. The `.merge()` method is still supported for compatibility, but it is discouraged for new code because its semantics around overlapping keys and refinements are easier to misread. ##### JSON Schema `$defs` entries no longer include redundant `id` Fixed in [#&#8203;5759](https://github.com/colinhacks/zod/pull/5759). JSON Schema conversion through `z.toJSONSchema()` now strips redundant `id` fields from `$defs` entries. This is required for correctness in older JSON Schema dialects from before `$id` was introduced: in those dialects, `id` changes the resolution scope, so leaving it inside an extracted definition can make references resolve incorrectly. The removed value was redundant because the schema had already been extracted into `$defs`, so the definition key itself is the identifier. This may affect consumers that were reading those internal `id` fields directly. Other JSON Schema fixes in this release: - Draft-04/OpenAPI 3.0 min/max intersections: [#&#8203;5700](https://github.com/colinhacks/zod/pull/5700) - Recursive lazy schemas with `.describe()`: [#&#8203;5797](https://github.com/colinhacks/zod/pull/5797) - Falsy prefault values emitted as defaults: [#&#8203;5893](https://github.com/colinhacks/zod/pull/5893) - CUID pattern output tightened: [#&#8203;5880](https://github.com/colinhacks/zod/pull/5880) ##### String validators are stricter Base64 validation now rejects whitespace instead of allowing `atob()`-style whitespace stripping. Fixed in [#&#8203;5888](https://github.com/colinhacks/zod/pull/5888). ```ts z.base64().safeParse("Zm9v").success; // true z.base64().safeParse("Zm 9v").success; // false ``` Other string validator changes: - CUID validation through `z.cuid()` has been tightened, and CUID v1 is now deprecated. Fixed in [#&#8203;5880](https://github.com/colinhacks/zod/pull/5880). - HTTP URL validation through `z.httpUrl()` now rejects malformed HTTP(S) URLs with a missing slash after the protocol. The underlying `URL` constructor normalizes inputs like `https:/example.com`, but Zod now rejects them instead of accepting the repaired URL. Fixed in [#&#8203;5672](https://github.com/colinhacks/zod/pull/5672), related to [#&#8203;5284](https://github.com/colinhacks/zod/issues/5284). ```ts z.httpUrl().safeParse("https://example.com").success; // true z.httpUrl().safeParse("https:/example.com").success; // false z.httpUrl().safeParse("http:/www.apple.com").success; // false ``` ##### Union paths are fixed in formatted errors Two union-related error fixes landed: - Nested union paths are now preserved correctly in the output of `z.treeifyError()` and `z.formatError()`. Fixed in [#&#8203;5708](https://github.com/colinhacks/zod/pull/5708) and [`60ff3987`](https://github.com/colinhacks/zod/commit/60ff398771bb4b6df04d96f00b9a10ee561ee7af). - Invalid discriminated union errors now include discriminator options and improved messages. Fixed in [#&#8203;5723](https://github.com/colinhacks/zod/pull/5723). This may affect users snapshotting `ZodError` output. #### Other fixes ##### Record key transforms now run Fixed in [#&#8203;5891](https://github.com/colinhacks/zod/pull/5891). Record schemas now run transforms on record keys. ```ts const schema = z.record( z.string().transform((key) => key.toUpperCase()), z.number() ); schema.parse({ foo: 1 }); // { FOO: 1 } ``` Related record fixes: - Key refinement failures now surface as structured `invalid_key` issues. Fixed in [#&#8203;5719](https://github.com/colinhacks/zod/pull/5719). - Non-enumerable properties are skipped more consistently. Fixed in [#&#8203;5719](https://github.com/colinhacks/zod/pull/5719). - The v3-style single-argument `z.record(valueType)` form works again. Fixed in [`0e960108`](https://github.com/colinhacks/zod/commit/0e960108f0d98dbea7844a8ff914f0980352f636). ##### Metadata and input handling in `fromJSONSchema()` Schema generation from JSON Schema now applies metadata more consistently across `enum`, `const`, `not`, `anyOf`, and multi-type schemas. Fixed in [#&#8203;5758](https://github.com/colinhacks/zod/pull/5758). It also rejects or normalizes more non-JSON-like inputs, including cyclic objects and `BigInt`. Fixed in [`87cf0f93`](https://github.com/colinhacks/zod/commit/87cf0f93cd0f34bdc69f11c9377568e6812841c4). ##### Codecs Codec changes: - Encoding through `z.discriminatedUnion().encode()` now works when the discriminator uses a codec. Fixed in [#&#8203;5769](https://github.com/colinhacks/zod/pull/5769). - Codec inversion was added in [#&#8203;5770](https://github.com/colinhacks/zod/pull/5770). ```ts const stringToNumber = z.codec( z.string(), z.number(), { decode: Number, encode: String, } ); const numberToString = z.invertCodec(stringToNumber); ``` ##### Transform context Transform callbacks now support `ctx.addIssue()`. Fixed in [#&#8203;5699](https://github.com/colinhacks/zod/pull/5699). ##### Conditional `.superRefine()` with `when` The `when` option was added for `.superRefine()`. Added in [#&#8203;5741](https://github.com/colinhacks/zod/pull/5741), with related abort behavior fixed in [#&#8203;5681](https://github.com/colinhacks/zod/pull/5681). ##### Defaults for `Map` and `Set` Defaults for `Map` and `Set` are now cloned instead of shared across parses. Fixed in [#&#8203;5855](https://github.com/colinhacks/zod/pull/5855). ```ts const schema = z.map(z.string(), z.number()).default(new Map()); const a = schema.parse(undefined); const b = schema.parse(undefined); a === b; // false ``` ##### Empty unions Empty `z.union([])`, `z.xor([])`, and discriminated unions no longer crash at construction time. They construct and fail at parse time. Fixed in [#&#8203;5869](https://github.com/colinhacks/zod/pull/5869). ##### Floating-point multiples Number `multipleOf()` / `step()` validation is more accurate for decimal and exponent edge cases. Fixed in [#&#8203;5687](https://github.com/colinhacks/zod/pull/5687) and [#&#8203;5793](https://github.com/colinhacks/zod/pull/5793). ##### Global config and `jitless` Configuration fixes: - Global configuration is now shared through `globalThis`, improving behavior across mixed CJS/ESM module instances. Fixed in [#&#8203;5889](https://github.com/colinhacks/zod/pull/5889). - Jitless mode now avoids eval probing when set before first access. Fixed in [#&#8203;5864](https://github.com/colinhacks/zod/pull/5864). ##### Prototype pollution hardening Object catchall paths now skip `__proto__` keys. Fixed in [#&#8203;5898](https://github.com/colinhacks/zod/pull/5898). #### Performance improvements ##### Reduced memory usage from lazy-bound methods Fixed in [#&#8203;5897](https://github.com/colinhacks/zod/pull/5897). Classic builder methods are now lazy-bound through a shared internal prototype instead of eagerly attached per schema instance. This significantly reduces per-schema method allocation overhead, especially in codebases that construct many schemas. Detached methods continue to work: ```ts const schema = z.string(); const optional = schema.optional; optional.call(schema); // still works ``` ##### Improved tree-shaking Implemented in [`195e8696`](https://github.com/colinhacks/zod/commit/195e86962b5156012a4cdcfbff87dffddce87b78) and [#&#8203;5689](https://github.com/colinhacks/zod/pull/5689). Top-level factory calls are annotated as pure, and generated stub package manifests now include `sideEffects: false`. This gives bundlers more room to remove unused Zod code. This is intended as the conclusive fix for a long-standing class of tree-shaking and bundle-size issues, especially in Next.js and Turbopack projects. The most visible symptom was that unused validators and locales could survive bundling even when importing from `zod/mini` or from a narrow subpath. Related reports include: - Next.js and Turbopack tree-shaking reports: [#&#8203;4433](https://github.com/colinhacks/zod/issues/4433), [#&#8203;5641](https://github.com/colinhacks/zod/issues/5641), [#&#8203;5095](https://github.com/colinhacks/zod/issues/5095), [#&#8203;4810](https://github.com/colinhacks/zod/issues/4810) - Locale and `zod/mini` bundle-size reports: [#&#8203;5561](https://github.com/colinhacks/zod/issues/5561), [#&#8203;5665](https://github.com/colinhacks/zod/issues/5665), [#&#8203;4369](https://github.com/colinhacks/zod/issues/4369), [#&#8203;4572](https://github.com/colinhacks/zod/issues/4572) - Broader v4 bundle-size reports: [#&#8203;2596](https://github.com/colinhacks/zod/issues/2596), [#&#8203;4637](https://github.com/colinhacks/zod/issues/4637), [#&#8203;4798](https://github.com/colinhacks/zod/issues/4798), [#&#8203;5206](https://github.com/colinhacks/zod/issues/5206) ```json { "sideEffects": false } ``` #### Locales Added or updated locale support: - Croatian: [#&#8203;5610](https://github.com/colinhacks/zod/pull/5610) - Greek: [#&#8203;5840](https://github.com/colinhacks/zod/pull/5840) - Romanian: [#&#8203;5657](https://github.com/colinhacks/zod/pull/5657) - Uzbek map support: [#&#8203;5599](https://github.com/colinhacks/zod/pull/5599) - Georgian translation fix: [#&#8203;5655](https://github.com/colinhacks/zod/pull/5655) - French issue origin translations: [#&#8203;5845](https://github.com/colinhacks/zod/pull/5845) - Italian validation message updates: [#&#8203;5852](https://github.com/colinhacks/zod/pull/5852) Locale message text changed in some cases, which may affect snapshots. #### Closed issues The following issues were closed by PRs included in this release: - Closed [#&#8203;5466](https://github.com/colinhacks/zod/issues/5466) via [#&#8203;5632](https://github.com/colinhacks/zod/pull/5632): preserve context immutability in parse functions. - Closed [#&#8203;5617](https://github.com/colinhacks/zod/issues/5617) via [#&#8203;5655](https://github.com/colinhacks/zod/pull/5655): correct Georgian translation for `string`. - Closed [#&#8203;5619](https://github.com/colinhacks/zod/issues/5619) via [#&#8203;5657](https://github.com/colinhacks/zod/pull/5657): add Romanian locale. - Closed [#&#8203;5229](https://github.com/colinhacks/zod/issues/5229) via [#&#8203;5661](https://github.com/colinhacks/zod/pull/5661): align object and tuple optionality handling. - Closed [#&#8203;5680](https://github.com/colinhacks/zod/issues/5680) via [#&#8203;5681](https://github.com/colinhacks/zod/pull/5681): respect `abort: true` in `.refine()` checks with `when`. - Closed [#&#8203;5678](https://github.com/colinhacks/zod/issues/5678) via [#&#8203;5699](https://github.com/colinhacks/zod/pull/5699): add missing `addIssue` to transform context. - Closed [#&#8203;5717](https://github.com/colinhacks/zod/issues/5717) via [#&#8203;5718](https://github.com/colinhacks/zod/pull/5718): avoid `delete` in `finalizeIssue`. - Closed [#&#8203;5714](https://github.com/colinhacks/zod/issues/5714) via [#&#8203;5719](https://github.com/colinhacks/zod/pull/5719): skip non-enumerable properties in record validation. - Closed [#&#8203;5670](https://github.com/colinhacks/zod/issues/5670) via [#&#8203;5723](https://github.com/colinhacks/zod/pull/5723): add discriminator `options` to invalid discriminator errors. - Closed [#&#8203;5743](https://github.com/colinhacks/zod/issues/5743) via [#&#8203;5744](https://github.com/colinhacks/zod/pull/5744): increase timeout for the datetime ReDoS checker test. - Closed [#&#8203;5732](https://github.com/colinhacks/zod/issues/5732) via [#&#8203;5758](https://github.com/colinhacks/zod/pull/5758): apply description and default metadata in `fromJSONSchema()`. - Closed [#&#8203;5731](https://github.com/colinhacks/zod/issues/5731) via [#&#8203;5759](https://github.com/colinhacks/zod/pull/5759): strip redundant `id` from `$defs` entries in JSON Schema output. - Closed [#&#8203;5605](https://github.com/colinhacks/zod/issues/5605) via [#&#8203;5763](https://github.com/colinhacks/zod/pull/5763): update `z.custom()` docs for v4 compatibility. - Closed [#&#8203;5593](https://github.com/colinhacks/zod/issues/5593) via [#&#8203;5769](https://github.com/colinhacks/zod/pull/5769): support `discriminatedUnion().encode()` with codec discriminators. - Closed [#&#8203;5625](https://github.com/colinhacks/zod/issues/5625) via [#&#8203;5770](https://github.com/colinhacks/zod/pull/5770): add codec inversion. - Closed [#&#8203;5778](https://github.com/colinhacks/zod/issues/5778) via [#&#8203;5779](https://github.com/colinhacks/zod/pull/5779): add custom docs 404 page. - Closed [#&#8203;5792](https://github.com/colinhacks/zod/issues/5792) via [#&#8203;5793](https://github.com/colinhacks/zod/pull/5793): correct floating-point `multipleOf()` validation. - Closed [#&#8203;5777](https://github.com/colinhacks/zod/issues/5777) via [#&#8203;5797](https://github.com/colinhacks/zod/pull/5797): resolve recursive lazy JSON Schema stack overflow. - Closed [#&#8203;5805](https://github.com/colinhacks/zod/issues/5805) via [#&#8203;5812](https://github.com/colinhacks/zod/pull/5812): fix self-referencing schema docs. - Closed [#&#8203;5826](https://github.com/colinhacks/zod/issues/5826) via [#&#8203;5855](https://github.com/colinhacks/zod/pull/5855): clone `Map` and `Set` defaults. - Closed [#&#8203;5842](https://github.com/colinhacks/zod/issues/5842) via [#&#8203;5856](https://github.com/colinhacks/zod/pull/5856): align `.merge()` refinement semantics with `.extend()`. - Closed [#&#8203;4461](https://github.com/colinhacks/zod/issues/4461) and [#&#8203;5414](https://github.com/colinhacks/zod/issues/5414) via [#&#8203;5864](https://github.com/colinhacks/zod/pull/5864): honor `jitless` config in the eval probe. - Closed [#&#8203;5868](https://github.com/colinhacks/zod/issues/5868) via [#&#8203;5869](https://github.com/colinhacks/zod/pull/5869): handle empty `z.union([])` and `z.xor([])`. - Closed [#&#8203;5296](https://github.com/colinhacks/zod/issues/5296) via [#&#8203;5891](https://github.com/colinhacks/zod/pull/5891): apply key schema transforms in `z.record()`. - Closed [#&#8203;5824](https://github.com/colinhacks/zod/issues/5824) via [#&#8203;5893](https://github.com/colinhacks/zod/pull/5893): emit falsy prefault values in JSON Schema output. #### Commits - Commit [`44f6a03e`](https://github.com/colinhacks/zod/commit/44f6a03e1d7cd918bfb9d9962d967deb6718335b) fix(locales): correct Georgian translation for 'string' to 'ველი' ([#&#8203;5655](https://github.com/colinhacks/zod/pull/5655)) by [@&#8203;tushargr0ver](https://github.com/tushargr0ver) - Commit [`7b43bc64`](https://github.com/colinhacks/zod/commit/7b43bc64e7a2720fe66d6e99239c2a00c782e06b) docs(ecosystem): add Hono Takibi ([#&#8203;5651](https://github.com/colinhacks/zod/pull/5651)) by [@&#8203;nakita628](https://github.com/nakita628) - Commit [`119376b9`](https://github.com/colinhacks/zod/commit/119376b9dc2e80f44bedd282702b46e18e2ee72c) feat: add map support to Uzbek locale ([#&#8203;5599](https://github.com/colinhacks/zod/pull/5599)) by [@&#8203;uchkunr](https://github.com/uchkunr) - Commit [`8fbf701e`](https://github.com/colinhacks/zod/commit/8fbf701e6c3770682803988bb20183f6628987da) test: add edge case tests for boundary values ([#&#8203;5601](https://github.com/colinhacks/zod/pull/5601)) by [@&#8203;uchkunr](https://github.com/uchkunr) - Commit [`f1f93c2b`](https://github.com/colinhacks/zod/commit/f1f93c2bca9984f844017c768183d2ea4b7c9cc4) Fix order of brand method examples in api.mdx ([#&#8203;5604](https://github.com/colinhacks/zod/pull/5604)) by [@&#8203;onurtemiz](https://github.com/onurtemiz) - Commit [`10105ee4`](https://github.com/colinhacks/zod/commit/10105ee40f6aba0d89454c42a49554296cabf992) docs: Fix typos in json-schema documentation ([#&#8203;5608](https://github.com/colinhacks/zod/pull/5608)) by [@&#8203;SaKaNa-Y](https://github.com/SaKaNa-Y) - Commit [`2d367139`](https://github.com/colinhacks/zod/commit/2d3671390f6cae4254642cf9ac7f16783eb6ff20) feat: add hr translation ([#&#8203;5610](https://github.com/colinhacks/zod/pull/5610)) by [@&#8203;vuki656](https://github.com/vuki656) - Commit [`54902cb7`](https://github.com/colinhacks/zod/commit/54902cb794f24f4ceb0cf8830e5a27b3490191f7) chore: update pullfrog.yml workflow - Commit [`89ba70f2`](https://github.com/colinhacks/zod/commit/89ba70f2d50d33a70549bedbd5c79785810ee21b) chore: add sideEffects false to stub package.json for tree-shaking ([#&#8203;5689](https://github.com/colinhacks/zod/pull/5689)) by [@&#8203;jesse-holden](https://github.com/jesse-holden) - Commit [`eaa3c2c3`](https://github.com/colinhacks/zod/commit/eaa3c2c3633a5e6494d8ac03c14365d181794e71) Update positive checks to use alias `.gt(0)` in the docs ([#&#8203;5671](https://github.com/colinhacks/zod/pull/5671)) by [@&#8203;Fredkiss3](https://github.com/Fredkiss3) - Commit [`65f1f404`](https://github.com/colinhacks/zod/commit/65f1f404f644cfc9b7f790d310500a05b9d30ca4) fix typo ([#&#8203;5676](https://github.com/colinhacks/zod/pull/5676)) by [@&#8203;Nikita0x](https://github.com/Nikita0x) - Commit [`5b574501`](https://github.com/colinhacks/zod/commit/5b5745014af2a3b0ea6339ccd7bbcbdf845f7181) fix: respect `abort: true` in `.refine()` for checks with `when` function ([#&#8203;5681](https://github.com/colinhacks/zod/pull/5681)) - Commit [`539de140`](https://github.com/colinhacks/zod/commit/539de140773587724723601720082a9231ba6d64) docs: fix README links for async refinements/transforms ([#&#8203;5682](https://github.com/colinhacks/zod/pull/5682)) by [@&#8203;pavan-sh](https://github.com/pavan-sh) - Commit [`46cd10e7`](https://github.com/colinhacks/zod/commit/46cd10e76339c2f9cf8ad99df49b808e58e69879) docs: fix README anchor links for async APIs ([#&#8203;5683](https://github.com/colinhacks/zod/pull/5683)) by [@&#8203;pavan-sh](https://github.com/pavan-sh) - Commit [`55747b3c`](https://github.com/colinhacks/zod/commit/55747b3cd05cd8b60b4f3d6a6348e2c508069c12) Remove deprecated downlevelIteration option ([#&#8203;5684](https://github.com/colinhacks/zod/pull/5684)) by [@&#8203;RyanCavanaugh](https://github.com/RyanCavanaugh) - Commit [`3a818de1`](https://github.com/colinhacks/zod/commit/3a818de145dc2fa9b5753bc8bf97b0b8484cfbaf) fix(v4): handle multi-digit exponents in floatSafeRemainder ([#&#8203;5687](https://github.com/colinhacks/zod/pull/5687)) by [@&#8203;shakecodeslikecray](https://github.com/shakecodeslikecray) - Commit [`3cd45ebc`](https://github.com/colinhacks/zod/commit/3cd45ebcbcf06a3f16e702a010074dfceca3ea50) fix(v4): add strict validation to `httpUrl()` ([#&#8203;5672](https://github.com/colinhacks/zod/pull/5672)) by [@&#8203;LuckySilver0021](https://github.com/LuckySilver0021) - Commit [`7d98c909`](https://github.com/colinhacks/zod/commit/7d98c909329713cb2f478620f8a67aaf3ef40ce2) add Sanity as silver sponsor and Mintlify as bronze sponsor - Commit [`c7805073`](https://github.com/colinhacks/zod/commit/c7805073fef5b6b8857307c3d4b3597a70613bc2) move Sanity and Mintlify to top of sponsor lists - Commit [`bee2dc8d`](https://github.com/colinhacks/zod/commit/bee2dc8d4971a5142d6197a01426837e2a57f69d) docs: move `z.iso.time()` from format to pattern section ([#&#8203;5696](https://github.com/colinhacks/zod/pull/5696)) - Commit [`2f8414bc`](https://github.com/colinhacks/zod/commit/2f8414bc90cebc76be87c3640617e300a5d9b060) fix: add missing addIssue to transform context ([#&#8203;5699](https://github.com/colinhacks/zod/pull/5699)) by [@&#8203;F-A-N-D-E](https://github.com/F-A-N-D-E) - Commit [`d3c0ec87`](https://github.com/colinhacks/zod/commit/d3c0ec8764ede3aa7f7c7d47cb5fa985db15be20) docs: add note about removed `.errors` alias in v4 changelog ([#&#8203;5705](https://github.com/colinhacks/zod/pull/5705)) by [@&#8203;togami2864](https://github.com/togami2864) - Commit [`fa338a3b`](https://github.com/colinhacks/zod/commit/fa338a3b885e6f8aeefc439b50982132ec0af1b5) fix(v4): JSON schema min/max intersection for draft-04 and openapi-3.0 ([#&#8203;5700](https://github.com/colinhacks/zod/pull/5700)) by [@&#8203;ebroder](https://github.com/ebroder) - Commit [`3473b288`](https://github.com/colinhacks/zod/commit/3473b288e02d536252db517a4c51b5adc23603b4) chore: bump zshy to ^0.7.1 - Commit [`cc8f9b7c`](https://github.com/colinhacks/zod/commit/cc8f9b7cb5674c0df03803d05b2a3a00569cdb07) docs: improve README wording and fix typos ([#&#8203;5736](https://github.com/colinhacks/zod/pull/5736)) by [@&#8203;vedanshshetti](https://github.com/vedanshshetti) - Commit [`f5336717`](https://github.com/colinhacks/zod/commit/f533671752ae7247bc25dca8f2dbfda80fa2fccc) feat: add json-up to ecosystem ([#&#8203;5740](https://github.com/colinhacks/zod/pull/5740)) by [@&#8203;mrspence](https://github.com/mrspence) - Commit [`60ff3987`](https://github.com/colinhacks/zod/commit/60ff398771bb4b6df04d96f00b9a10ee561ee7af) fix(v4): preserve parent path when treeifying nested union/key/element issues - Commit [`08b14b51`](https://github.com/colinhacks/zod/commit/08b14b51501335a3e0de3cb92c3b2fdeae00a0d6) perf: avoid `delete` in `finalizeIssue` to keep V8 fast mode ([#&#8203;5718](https://github.com/colinhacks/zod/pull/5718)) - Commit [`9cf868d2`](https://github.com/colinhacks/zod/commit/9cf868d20cdaf4cf80f6d33a6eaf31582f1cdeba) fix(v4): treeify error nested union bug ([#&#8203;5708](https://github.com/colinhacks/zod/pull/5708)) by [@&#8203;dstashevskyi](https://github.com/dstashevskyi) - Commit [`28f39a6d`](https://github.com/colinhacks/zod/commit/28f39a6d97ce903ed0d2f6cd99a60d390faa7adf) Add JSONType export ([#&#8203;5709](https://github.com/colinhacks/zod/pull/5709)) by [@&#8203;RobinVdBroeck](https://github.com/RobinVdBroeck) - Commit [`65fab33e`](https://github.com/colinhacks/zod/commit/65fab33e287bba2db5942c7f9ad905ac98f62fce) feat: allow `when` parameter in `.superRefine()` ([#&#8203;5741](https://github.com/colinhacks/zod/pull/5741)) by [@&#8203;vilvai](https://github.com/vilvai) - Commit [`7f87df1e`](https://github.com/colinhacks/zod/commit/7f87df1e8ae61679ed9dc3ba223572ce3d7bc716) refactor(v4): remove unnecessary type assertions ([#&#8203;5720](https://github.com/colinhacks/zod/pull/5720)) by [@&#8203;chisaki66](https://github.com/chisaki66) - Commit [`518f15dd`](https://github.com/colinhacks/zod/commit/518f15ddada3b5d959f4ff32b094789e2d85349a) Preprocess is not deprecated ([#&#8203;5721](https://github.com/colinhacks/zod/pull/5721)) by [@&#8203;mxdvl](https://github.com/mxdvl) - Commit [`2e5b23dc`](https://github.com/colinhacks/zod/commit/2e5b23dcd41eb257bda434b9997fd60a19cdf38f) fix: add options to invalid discriminator errors ([#&#8203;5723](https://github.com/colinhacks/zod/pull/5723)) by [@&#8203;Danielchinasa](https://github.com/Danielchinasa) - Commit [`7f789def`](https://github.com/colinhacks/zod/commit/7f789defd73ee35f3099ab5c2091cb19bd2b3578) fix: skip non-enumerable properties in record validation ([#&#8203;5719](https://github.com/colinhacks/zod/pull/5719)) by [@&#8203;veeceey](https://github.com/veeceey) - Commit [`ee15fa19`](https://github.com/colinhacks/zod/commit/ee15fa1905f7c6626dea5f8dc880e66cdb4700ad) docs: add AGENTS notes for JSDoc, PR comments, and PR worktree workflow - Commit [`f52b4d28`](https://github.com/colinhacks/zod/commit/f52b4d288fabb03b98ff3f893c58e285eb310e96) Revert "docs: improve README wording and fix typos ([#&#8203;5736](https://github.com/colinhacks/zod/issues/5736))" - Commit [`ddb41391`](https://github.com/colinhacks/zod/commit/ddb413916bc238e8d2d6ba67a2ce4b48ff2aa930) test: increase timeout for redos checker in datetime.test.ts ([#&#8203;5744](https://github.com/colinhacks/zod/pull/5744)) by [@&#8203;rishadaufa](https://github.com/rishadaufa) - Commit [`bc07e459`](https://github.com/colinhacks/zod/commit/bc07e459bab4f895bf1c99f182c6841d577c16b3) docs: fix doc ([#&#8203;5745](https://github.com/colinhacks/zod/pull/5745)) by [@&#8203;xgaia](https://github.com/xgaia) - Commit [`e06af5de`](https://github.com/colinhacks/zod/commit/e06af5de314f1cad8dfaa0a5f1909e21ffff9e49) Update Hey API description ([#&#8203;5748](https://github.com/colinhacks/zod/pull/5748)) by [@&#8203;mrlubos](https://github.com/mrlubos) - Commit [`28c156e2`](https://github.com/colinhacks/zod/commit/28c156e254ebdf65d9ed3de4caf1d4293f7e7a84) fix: apply description and default metadata to enum, const, and not schemas in fromJSONSchema ([#&#8203;5758](https://github.com/colinhacks/zod/pull/5758)) by [@&#8203;mibragimov](https://github.com/mibragimov) - Commit [`f457edf1`](https://github.com/colinhacks/zod/commit/f457edf1e504787eadfe2dffe51a77c64e3f0e17) Fix grammar in CONTRIBUTING.md ([#&#8203;5765](https://github.com/colinhacks/zod/pull/5765)) by [@&#8203;siekmang](https://github.com/siekmang) - Commit [`411f6c64`](https://github.com/colinhacks/zod/commit/411f6c64e910c5e18799d0a7a09bcd7a4e40f23e) fix(v4): resolve stack overflow in toJSONSchema for recursive lazy with describe ([#&#8203;5797](https://github.com/colinhacks/zod/pull/5797)) by [@&#8203;Hassad674](https://github.com/Hassad674) - Commit [`45dd421e`](https://github.com/colinhacks/zod/commit/45dd421e72e989752fa5f85529dfbf50bdbd3f61) docs: add tone guidelines for issue and PR comments to AGENTS.md - Commit [`ddd20a30`](https://github.com/colinhacks/zod/commit/ddd20a300441d7cffd59821461ed0c2fe9c96bbc) test: align optional property assertions with actual inferred types - Commit [`a1cf8a93`](https://github.com/colinhacks/zod/commit/a1cf8a9312582591d9cdccdd677ba1d90e706cc0) docs: update z.custom example for v4 compatibility ([#&#8203;5763](https://github.com/colinhacks/zod/pull/5763)) by [@&#8203;andrewdamelio](https://github.com/andrewdamelio) - Commit [`b6a3b336`](https://github.com/colinhacks/zod/commit/b6a3b3369a5b9fdde9adde8203b96b71c0634ad5) fix: strip redundant id from `$defs` entries in toJSONSchema ([#&#8203;5759](https://github.com/colinhacks/zod/pull/5759)) by [@&#8203;mibragimov](https://github.com/mibragimov) - Commit [`c7a8ccc0`](https://github.com/colinhacks/zod/commit/c7a8ccc0d0fb4f2bd1c938b8d79873a8ebd6573e) fix: discriminatedUnion encode() with codec discriminator ([#&#8203;5769](https://github.com/colinhacks/zod/pull/5769)) by [@&#8203;mahmoodhamdi](https://github.com/mahmoodhamdi) - Commit [`87cf0f93`](https://github.com/colinhacks/zod/commit/87cf0f93cd0f34bdc69f11c9377568e6812841c4) fix(fromJSONSchema): normalize input via JSON round-trip - Commit [`7163e6f2`](https://github.com/colinhacks/zod/commit/7163e6f25ae8c90be79bd588417440c047ee30b0) feat: add `.invert()` method to ZodCodec ([#&#8203;5770](https://github.com/colinhacks/zod/pull/5770)) by [@&#8203;mahmoodhamdi](https://github.com/mahmoodhamdi) - Commit [`b59b9b13`](https://github.com/colinhacks/zod/commit/b59b9b13c20397389c5d4dc3a2ecbcd5e9349395) fix: replace `.default` with `.prefault` ([#&#8203;5776](https://github.com/colinhacks/zod/pull/5776)) by [@&#8203;alanskovrlj](https://github.com/alanskovrlj) - Commit [`93bba686`](https://github.com/colinhacks/zod/commit/93bba686325e09dced20da8d7bc18c7e61b71562) docs: add Zod AOT to ecosystem page ([#&#8203;5806](https://github.com/colinhacks/zod/pull/5806)) by [@&#8203;wakita181009](https://github.com/wakita181009) - Commit [`2564caa4`](https://github.com/colinhacks/zod/commit/2564caa440e690fd3ad58ce55fdff0fe073d6cc0) fix(docs): add custom 404 page with proper theme support ([#&#8203;5779](https://github.com/colinhacks/zod/pull/5779)) by [@&#8203;WolfieLeader](https://github.com/WolfieLeader) - Commit [`5b7ed214`](https://github.com/colinhacks/zod/commit/5b7ed214526cb5a7cc508aec236603ff79ae9579) fix: correct multipleOf float validation using tolerance-based comparison ([#&#8203;5793](https://github.com/colinhacks/zod/pull/5793)) by [@&#8203;cyphercodes](https://github.com/cyphercodes) - Commit [`cc9139d2`](https://github.com/colinhacks/zod/commit/cc9139d209001bfdeb23dfe2d5b0262c02c950cf) docs: fix self-referencing schema in refine when() example ([#&#8203;5812](https://github.com/colinhacks/zod/pull/5812)) by [@&#8203;claygeo](https://github.com/claygeo) - Commit [`0e960108`](https://github.com/colinhacks/zod/commit/0e960108f0d98dbea7844a8ff914f0980352f636) fix(v4): support v3-style single-arg z.record(valueType) - Commit [`41b25af9`](https://github.com/colinhacks/zod/commit/41b25af98f108d7b6f695576d4e0330b97252bfd) docs(agents): refine PR comment tone guidance - Commit [`4c03c20d`](https://github.com/colinhacks/zod/commit/4c03c20d2bc7e013e8b80ce55380cd4b82bfe352) Update Italian locale error messages for validation ([#&#8203;5852](https://github.com/colinhacks/zod/pull/5852)) by [@&#8203;pastorello](https://github.com/pastorello) - Commit [`37ac1ba0`](https://github.com/colinhacks/zod/commit/37ac1ba0d694b3b80e22c006dc6e2b78b0c956dc) fix(fr): translate issue.origin in too_big/too_small errors ([#&#8203;5845](https://github.com/colinhacks/zod/pull/5845)) by [@&#8203;Ouaziz-chedli](https://github.com/Ouaziz-chedli) - Commit [`345be203`](https://github.com/colinhacks/zod/commit/345be2039463516aaac90640c14de1b697e775b6) docs: add validex to ecosystem ([#&#8203;5848](https://github.com/colinhacks/zod/pull/5848)) by [@&#8203;chiptoma](https://github.com/chiptoma) - Commit [`3c1f32bd`](https://github.com/colinhacks/zod/commit/3c1f32bd280c01b836d4790981fd769cf9041d29) feat(locales/en): handle instanceof and add comprehensive locale tests - Commit [`888e52bb`](https://github.com/colinhacks/zod/commit/888e52bb1762f8a8b881af48d9f1bdc353372af8) feat(locales): add Greek (el) locale ([#&#8203;5840](https://github.com/colinhacks/zod/pull/5840)) by [@&#8203;saileshbro](https://github.com/saileshbro) - Commit [`bf6d99ed`](https://github.com/colinhacks/zod/commit/bf6d99ed76be86e4871d2381ecd9832293c13406) Revert "feat(locales/en): handle instanceof and add comprehensive locale tests" - Commit [`e8196a8d`](https://github.com/colinhacks/zod/commit/e8196a8d98e3bc3cc6714ef5ff34b5abf33eff4a) fix(resolution): align expected fr message with translated locale - Commit [`b6b12882`](https://github.com/colinhacks/zod/commit/b6b1288277e6ca87dab0ad1c7251b92612b7445c) correct logic for validating length ([#&#8203;5843](https://github.com/colinhacks/zod/pull/5843)) by [@&#8203;nameearly](https://github.com/nameearly) - Commit [`34f60159`](https://github.com/colinhacks/zod/commit/34f601590351e5d3a57fe20c001155940ba65324) fix(v4): clone Map and Set in shallowClone to prevent shared state across `.default()` parses ([#&#8203;5855](https://github.com/colinhacks/zod/pull/5855)) by [@&#8203;artur-seppa](https://github.com/artur-seppa) - Commit [`91a7d0d1`](https://github.com/colinhacks/zod/commit/91a7d0d1e0d3c8338e9fd92cf819cded87e8973f) fix(v4): reject whitespace in z.base64() to close atob bypass - Commit [`23edf484`](https://github.com/colinhacks/zod/commit/23edf4844bcd89fa37c549dab187ce7f86728540) Revert "fix(v4): reject whitespace in z.base64() to close atob bypass" - Commit [`15cafa13`](https://github.com/colinhacks/zod/commit/15cafa13940b7055cc21e4ef440a6a0c6b7af72b) fix(v4): throw on `.merge()` receiver with refinements; preserve refinements from second schema ([#&#8203;5856](https://github.com/colinhacks/zod/pull/5856)) by [@&#8203;solssak](https://github.com/solssak) - Commit [`584b1089`](https://github.com/colinhacks/zod/commit/584b1089e1fc7bfcc97797576eff8da85bcdf031) fix(v4): reject whitespace in z.base64() to close atob bypass ([#&#8203;5888](https://github.com/colinhacks/zod/pull/5888)) by [@&#8203;colinhacks](https://github.com/colinhacks) - Commit [`b9b62c65`](https://github.com/colinhacks/zod/commit/b9b62c65357c2b0fed4ae046a30c8e84e4094202) fix(core): honour `jitless` config in `allowsEval` probe ([#&#8203;5864](https://github.com/colinhacks/zod/pull/5864)) by [@&#8203;dokson](https://github.com/dokson) - Commit [`fffe99bd`](https://github.com/colinhacks/zod/commit/fffe99bdd7445cc072b5ed2d74b2a6204bdbc86c) fix(v4): construct empty unions instead of crashing ([#&#8203;5869](https://github.com/colinhacks/zod/pull/5869)) by [@&#8203;tjenkinson](https://github.com/tjenkinson) - Commit [`285bde7f`](https://github.com/colinhacks/zod/commit/285bde7f43ca66938eeac38dea852256d4757336) feat(core): share `globalConfig` across module systems via `globalThis` ([#&#8203;5889](https://github.com/colinhacks/zod/pull/5889)) by [@&#8203;colinhacks](https://github.com/colinhacks) - Commit [`195e8696`](https://github.com/colinhacks/zod/commit/195e86962b5156012a4cdcfbff87dffddce87b78) perf(v4): mark top-level factory calls as `/*@__PURE__*/` for tree-shaking - Commit [`61d7bedb`](https://github.com/colinhacks/zod/commit/61d7bedb873bf8185162bb51d027fd8acf2710ee) fix(v4): apply key schema transforms in z.record() ([#&#8203;5891](https://github.com/colinhacks/zod/pull/5891)) by [@&#8203;colinhacks](https://github.com/colinhacks) - Commit [`45acd2ad`](https://github.com/colinhacks/zod/commit/45acd2ad78fb34ef61c5b72e9c03dfeaa432bef9) ci(release): switch to npm trusted publishing via OIDC ([#&#8203;5890](https://github.com/colinhacks/zod/pull/5890)) by [@&#8203;colinhacks](https://github.com/colinhacks) - Commit [`476ae243`](https://github.com/colinhacks/zod/commit/476ae243e86344af08d6c396deed082e83d7d7e1) Tighten cuid() regex and deprecate CUID v1 ([#&#8203;5880](https://github.com/colinhacks/zod/pull/5880)) by [@&#8203;colinhacks](https://github.com/colinhacks) - Commit [`6217527e`](https://github.com/colinhacks/zod/commit/6217527e4880054dda5e4d33aa12192a36a35062) docs(agents): document push-to-main footgun and version-bump rule ([#&#8203;5883](https://github.com/colinhacks/zod/pull/5883)) by [@&#8203;colinhacks](https://github.com/colinhacks) - Commit [`757f0b0f`](https://github.com/colinhacks/zod/commit/757f0b0f5217e0e7125478cd91af1e2c0cd21aa9) fix(v4): apply util.Writeable<T> in strictObject/looseObject for shape display parity ([#&#8203;5882](https://github.com/colinhacks/zod/pull/5882)) by [@&#8203;colinhacks](https://github.com/colinhacks) - Commit [`fa4a3740`](https://github.com/colinhacks/zod/commit/fa4a37404966d7ada0f5bb02ceeb592f1d4d9c52) fix(v4): apply util.Writeable in mini object constructors and extend/safeExtend/partial/required ([#&#8203;5895](https://github.com/colinhacks/zod/pull/5895)) by [@&#8203;colinhacks](https://github.com/colinhacks) - Commit [`ebc8287c`](https://github.com/colinhacks/zod/commit/ebc8287ca206402cf3a9aceb745b204493cbadfb) fix(v4): emit falsy prefault values in toJSONSchema ([#&#8203;5893](https://github.com/colinhacks/zod/pull/5893)) by [@&#8203;mixelburg](https://github.com/mixelburg) - Commit [`8fcb71a5`](https://github.com/colinhacks/zod/commit/8fcb71a5ffa5b32a508ac8bb38b7e1e13c387bf5) perf(v4): lazy-bind builder methods to shared internal prototype ([#&#8203;5897](https://github.com/colinhacks/zod/pull/5897)) by [@&#8203;colinhacks](https://github.com/colinhacks) - Commit [`76e8f706`](https://github.com/colinhacks/zod/commit/76e8f706bb554de82234106de8299d0139cb3b8e) fix(v4): skip `__proto__` key in object catchall ([#&#8203;5898](https://github.com/colinhacks/zod/pull/5898)) by [@&#8203;colinhacks](https://github.com/colinhacks) - Commit [`f0b0608e`](https://github.com/colinhacks/zod/commit/f0b0608ee300e609772405501ab4b219f0e19680) ecosystem: `eslint-plugin-zod-x` is `eslint-plugin-zod` now ([#&#8203;5637](https://github.com/colinhacks/zod/pull/5637)) by [@&#8203;marcalexiei](https://github.com/marcalexiei) - Commit [`0b5c3bc2`](https://github.com/colinhacks/zod/commit/0b5c3bc2b9e095e06687d2381bdd741185fbfee9) docs: fix refinements examples in api.mdx ([#&#8203;5649](https://github.com/colinhacks/zod/pull/5649)) by [@&#8203;playoffthecuff](https://github.com/playoffthecuff) - Commit [`327e152e`](https://github.com/colinhacks/zod/commit/327e152e463c85e6404388738d397ed92e5f3999) docs(agents): refine PR comment tone guidance further - Commit [`57d80a82`](https://github.com/colinhacks/zod/commit/57d80a82bde8877f3eb79e5dad9786096c37490f) test(v4): pin object/tuple key optionality through optout propagation - Commit [`f19860f1`](https://github.com/colinhacks/zod/commit/f19860f1f17e3bdc3e696ee5290441bba093d7a4) fix: preserve context immutability in parse functions ([#&#8203;5632](https://github.com/colinhacks/zod/pull/5632)) by [@&#8203;bgk614](https://github.com/bgk614) - Commit [`ec979ad7`](https://github.com/colinhacks/zod/commit/ec979ad783a9e9c992d3c9bd4e5f3b56110b1ef8) feat: add Romanian (ro) locale ([#&#8203;5657](https://github.com/colinhacks/zod/pull/5657)) by [@&#8203;tushargr0ver](https://github.com/tushargr0ver) - Commit [`b6066b3e`](https://github.com/colinhacks/zod/commit/b6066b3e4730fc8b966d13974b4abae8dce25df4) fix(v4): align object and tuple optionality handling ([#&#8203;5661](https://github.com/colinhacks/zod/pull/5661)) by [@&#8203;Cyjin-jani](https://github.com/Cyjin-jani) - Commit [`ad0b8271`](https://github.com/colinhacks/zod/commit/ad0b82713e70e53707dd5e6497c9d922fcba3721) ci: update release workflow for trusted publishing - Commit [`6db607be`](https://github.com/colinhacks/zod/commit/6db607be3c218ad9f23fef8975de1f37469680e7) fix(release): keep JSR manifest publishable - Commit [`f778e02a`](https://github.com/colinhacks/zod/commit/f778e02a81842cbc40b1a448a85b29747227c49d) build: bump zshy for JSR wildcard exports ### [`v4.3.6`](https://github.com/colinhacks/zod/releases/tag/v4.3.6) [Compare Source](https://github.com/colinhacks/zod/compare/v4.3.5...v4.3.6) #### Commits: - [`9977fb0`](https://github.com/colinhacks/zod/commit/9977fb0868432461de265a773319e80a90ba3e37) Add brand.dev to sponsors - [`f4b7bae`](https://github.com/colinhacks/zod/commit/f4b7bae3468f6188b8f004e007d722148fc91d77) Update pullfrog.yml ([#&#8203;5634](https://github.com/colinhacks/zod/issues/5634)) - [`251d716`](https://github.com/colinhacks/zod/commit/251d7163a0ac7740fee741428d913e3c55702ace) Clean up workflow_call - [`edd4132`](https://github.com/colinhacks/zod/commit/edd4132466da0f5065a8e051b599d01fdd1081d8) fix: add missing User-agent to robots.txt and allow all ([#&#8203;5646](https://github.com/colinhacks/zod/issues/5646)) - [`85db85e`](https://github.com/colinhacks/zod/commit/85db85e9091d0706910d60c7eb2e9c181edd87bd) fix: typo in codec.test.ts file ([#&#8203;5628](https://github.com/colinhacks/zod/issues/5628)) - [`cbf77bb`](https://github.com/colinhacks/zod/commit/cbf77bb12bdfda2e054818e79001f5cb3798ce76) Avoid non null assertion ([#&#8203;5638](https://github.com/colinhacks/zod/issues/5638)) - [`dfbbf1c`](https://github.com/colinhacks/zod/commit/dfbbf1c1ae0c224b8131d80ddf0a264262144086) Avoid re-exported star modules ([#&#8203;5656](https://github.com/colinhacks/zod/issues/5656)) - [`762e911`](https://github.com/colinhacks/zod/commit/762e911e5773f949452fd6dd4e360f2362110e8e) Generalize numeric key handling - [`ca3c862`](https://github.com/colinhacks/zod/commit/ca3c8629c0c2715571f70b44c2433cad3db7fe4e) v4.3.6 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "before 8am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTUuMTMiLCJ1cGRhdGVkSW5WZXIiOiI0NC4xMTUuMTMiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyJdfQ==-->

EgorEast added 1 commit 2026-09-28 06:09:45 +00:00

chore(deps): update dependency zod to v4.6.5 dedffcef37

EgorEast commented 2026-09-28 06:09:45 +00:00

Author

Owner

Copy link

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: .opencode/bun.lock

spawn bun ENOENT

### ⚠️ Artifact update problem Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is. ♻ Renovate will retry this branch, including artifacts, only when one of the following happens: - any of the package files in this branch needs updating, or - the branch becomes conflicted, or - you click the rebase/retry checkbox if found above, or - you rename this PR's title to start with "rebase!" to trigger it manually The artifact failure details are included below: ##### File name: .opencode/bun.lock ``` spawn bun ENOENT ```

EgorEast merged commit 80424093db into main 2026-10-06 08:49:15 +00:00

EgorEast referenced this pull request from a commit 2026-10-06 08:49:16 +00:00

Merge pull request 'chore(deps): update dependency zod to v4.6.5' (#4) from renovate/devdependencies-(non-major) into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

  

Compat/Breaking

Breaking change that won't be backward compatible

  

Kind/Bug

Something is not working

  

Kind/Documentation

Documentation changes

  

Kind/Enhancement

Improve existing functionality

  

Kind/Feature

New functionality

  

Kind/Security

This is security issue

  

Kind/Testing

Issue or pull request related to testing

  

Priority

Critical

The priority is critical

  

Priority

High

The priority is high

  

Priority

Low

The priority is low

  

Priority

Medium

The priority is medium

  

Reviewed

Confirmed

Issue has been confirmed

  

Reviewed

Duplicate

This issue or pull request already exists

  

Reviewed

Invalid

Invalid issue

  

Reviewed

Won't Fix

This issue won't be fixed

  

Status

Abandoned

Somebody has started to work on this but abandoned work

  

Status

Blocked

Something is blocking this issue or pull request

  

Status

Need More Info

Feedback is required to reproduce issue or to continue work

No labels

Compat/Breaking

Kind/Bug

Kind/Documentation

Kind/Enhancement

Kind/Feature

Kind/Security

Kind/Testing

Priority

Critical

Priority

High

Priority

Low

Priority

Medium

Reviewed

Confirmed

Reviewed

Duplicate

Reviewed

Invalid

Reviewed

Won't Fix

Status

Abandoned

Status

Blocked

Status

Need More Info

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Slovo_Propovedi/slovo-propovedi-landing!4

No description provided.