fix(deps): update dependency zod to v4 - #431
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
|
renovate
Bot
force-pushed
the
renovate/zod-4.x
branch
from
July 10, 2025 23:42
4027ba9 to
b10ac76
Compare
renovate
Bot
force-pushed
the
renovate/zod-4.x
branch
5 times, most recently
from
July 25, 2025 06:42
73aee8d to
d980216
Compare
renovate
Bot
force-pushed
the
renovate/zod-4.x
branch
3 times, most recently
from
July 30, 2025 11:45
7ae564a to
ea237d2
Compare
renovate
Bot
force-pushed
the
renovate/zod-4.x
branch
4 times, most recently
from
August 9, 2025 21:33
12b04f1 to
c3c0ced
Compare
renovate
Bot
force-pushed
the
renovate/zod-4.x
branch
5 times, most recently
from
August 27, 2025 23:07
5b79816 to
2915909
Compare
renovate
Bot
force-pushed
the
renovate/zod-4.x
branch
from
August 31, 2025 10:06
2915909 to
6480aba
Compare
renovate
Bot
force-pushed
the
renovate/zod-4.x
branch
3 times, most recently
from
September 17, 2025 02:27
b25958f to
b628c89
Compare
renovate
Bot
force-pushed
the
renovate/zod-4.x
branch
2 times, most recently
from
September 20, 2025 21:39
b65772b to
8973b0d
Compare
renovate
Bot
force-pushed
the
renovate/zod-4.x
branch
from
October 6, 2025 16:45
8973b0d to
d88ea56
Compare
renovate
Bot
force-pushed
the
renovate/zod-4.x
branch
from
November 11, 2025 00:15
d88ea56 to
144c0f7
Compare
renovate
Bot
force-pushed
the
renovate/zod-4.x
branch
from
November 24, 2025 04:58
144c0f7 to
6d53881
Compare
renovate
Bot
force-pushed
the
renovate/zod-4.x
branch
from
December 15, 2025 10:28
6d53881 to
76d29b9
Compare
renovate
Bot
force-pushed
the
renovate/zod-4.x
branch
from
December 16, 2025 03:12
76d29b9 to
3872d14
Compare
renovate
Bot
force-pushed
the
renovate/zod-4.x
branch
4 times, most recently
from
January 4, 2026 10:38
258bf31 to
efc8c0f
Compare
renovate
Bot
force-pushed
the
renovate/zod-4.x
branch
from
January 22, 2026 20:44
efc8c0f to
950c43d
Compare
renovate
Bot
force-pushed
the
renovate/zod-4.x
branch
3 times, most recently
from
March 14, 2026 00:53
4bd7eb6 to
e9a1602
Compare
renovate
Bot
force-pushed
the
renovate/zod-4.x
branch
from
March 26, 2026 18:05
e9a1602 to
c89b6b0
Compare
renovate
Bot
force-pushed
the
renovate/zod-4.x
branch
3 times, most recently
from
May 4, 2026 10:06
31cf97b to
4c68742
Compare
renovate
Bot
force-pushed
the
renovate/zod-4.x
branch
4 times, most recently
from
August 29, 2026 21:30
7ad8dba to
454e1ba
Compare
renovate
Bot
force-pushed
the
renovate/zod-4.x
branch
from
September 10, 2026 01:15
454e1ba to
d51d493
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.25.76→4.6.1Release Notes
colinhacks/zod (zod)
v4.6.1Compare Source
A patch on top of 4.6.0.
b12aa523fix: preserve unique tags with defaulted discriminators (#6582) — closes #6577dd9c36fafix(v4): defer recursive object index inference (#6580)3b154992feat(lang): add Tajik (tg) locale (#6581) by @ismoil772efa8b80ci: give the npm wait a real budget and drop the back-publish path (#6583)v4.6.0Compare Source
Commits:
908c9e1fix(docs): retry the GitHub stars fetch and log the real status93186cadocs(wiki): drop the zod-compiler benchmark (#6505)8ce9e8dfeat(mini): publish Zod Mini as the standalone @zod/mini package (#6491)2956c4cchore(mini): sync @zod/mini to 4.5.4abd41addocs(wiki): move plans and comparisons into a gitignored internal/ (#6506)8106573chore(docs): build with Turbopackc7ec94dci: check zod and @zod/mini lockstep on npm after every publish (#6507)c46eeffchore: narrow blanket biome-ignore comments (#6504)a0898b4ci: wait hours for npm to serve a publish, not ten minutes (#6502)1c0bce0docs: bring the 4.5 charts and worked examples into the docs pages70eb2c0docs: drop the traits section and the compilation feature bullet43b9bfcdocs: drop the bound-methods section from the Zod package pagecd4f9a6perf(v4): report Standard Schema issues without constructing a ZodError (#6509)f3cb364docs: surface the blog on the home page and in the sidebarf3e7c72fix(docs): render the docs 404 page inside the (doc) layout oncef412178ci: publish @zod/mini to JSR in lockstep with npm (#6510)5ff9566Stop re-exporting the compile internals from zod/v4/core (#6511)40b4d0bfix(ci): read zod's latest version with npm view when picking the backfill dist-taga6b4939Mark the compile internals @internal instead of hiding them (#6518)3195ed0docs: label the memory chart like the compile chart8cd1250docs: center the memory chart callout labelsff56a55docs: center the memory chart callout labels and pad them off the numberfb2fedfdocs: tighten the memory chart callout, pad the canvas, say "less memory"93f3ab3docs: replace the blog navbar's GitHub icon with a star-count pill7ae49d6docs: drop the circle around the star pill's GitHub mark and center it on the pill's arcb801439bench: add typebox (compiled and dynamic) to the moltar cross-library harness1ec6b7cdocs: add an RSS feed to the blog at /blog/rss.xml08ba069perf(v4): read Luhn digits with charCodeAt instead of string indexing (#6529)319f47fEmit a length-aware base64url pattern in toJSONSchema (#6527)a2a019aAccept enum-typed targets in z.toZod (#6528)74f9a6ddocs: drop the toZod enum block from basics and pin the page's curation rule in a commentf83ab51fix(v4): reject component-only strings from z.emoji() (#6532)84dd3b0perf: build literal and enum pattern regexes lazily (#6531)0227e53docs: bump the star pill's GitHub mark to 20px68a609aWiden literal inputs in property check types (#6520)2ec972erefactor: collapse toZod's enum leaf normalizer to a dummy union (#6533)bc1157edocs: use a Response example for z.properties()07c43e2Keep the runtime base64 regexes linear so composed parse paths cannot overflow (#6534)bec73beperf(v4): build the safeParse error on first read (#6519)bf99021perf: move util.cached's accessor to a prototype (#6537)69f2a7fCollapse toZod's normalizer and move its docs to the API reference (#6539)abfb389feat(v4): make z.properties() a schema, and give z.instanceof() a .properties() method (#6536)51caf01refactor: collapse cachedInternal back into cached (#6540)81ded99perf: answer z.validate from the compiled fast path on invalid input (#6538)eca9687fix(v4): enforce the six JSON Schema keywords fromJSONSchema silently dropped (#6535)68aca3ddocs: cover the 4.5 API surface that never made it into the reference18e71c7Rename the JSON Schemaprocesshelper so bundler polyfills cannot collide (#6541)90269c6Keep a numeric TS enum's reverse-mapping keys out of.options(#6542)4d73088Release the parsed input once a failing safeParse builds its error (#6543)cafbee4fix(v4): parse recursive schemas built by a factory (#6530)62e6624feat(v4): add .validate() and .validateAsync() to Zod Classic (#6547)07917f4test(v4): pin the lazy safeParse error's stack behavior (#6548)764ac59perf(v4): settle z.validate on the first failure in parse order (#6544)e760471docs: attribute the compiled failure cost to the fallback, not the double pass5489a53test(v4): pin the check-chain case that keeps compiled validate's definite guard (#6551)7a00236fix(v4): don't let format checks overwrite tighter min/max bounds (#6553)e4d67f3Migrate development and CI to Nub (#6562)6f04836fix(v4): derive JSON Schema constraints by folding checks in the converter (#6554)804e0f5perf: seal the CommonJS exports so require("zod") stops reading through a getter (#6564)741981fperf(compile): for-in record walk, cheaper issue finalization, and a generative compile differential (#6567)eb1c108ci: release only on workflow_dispatch behind the npm environment (#6569)277613adocs: move the release procedure to the maintainer-local notesdcbcf05fix(compile): unwind the doc indent when a child generator throws (#6570)e54716cdocs(ecosystem): add @apical-ts/craft (#5946)c5b9bcbbench: measure what a runtime island's leaked indent cost the generated source22bed61feat(v4): add z.iban() string format with mod-97 checksum (#6571)36f1796fix(v4): stop the memoizer from pinning a finished parse (#6572)f7fd554perf(v4): drop the lookaheads from the email regex (#6573)f9465d4docs: reconcile the sponsor listings with active sponsorships (#6576)213ee75feat(compile): add z.withParser for externally generated parsers (#6575)6de10dcdocs: reconcile the sponsor listings against every active sponsorship (#6579)661673adocs: make the 9thCO logo visible on the light theme1c51cbe4.6.03b15499feat(lang): add Tajik (tg) localec532d76test(locales): cover Tajik error branches574d480fix(locales): clarify Tajik discriminator value messagedd9c36ffix(v4): defer recursive object index inference (#6580)b12aa52fix: preserve unique tags with defaulted discriminators (#6582)v4.5.4Compare Source
Commits:
84e416ffix(v4): stop the cycle walk from firing a default factory (#6500)e8e206f4.5.4v4.5.3Compare Source
v4.5.2Compare Source
Commits:
a354314fix(docs): keep blog posts out of the docs collection (#6484)d378c42ci: drop canary publishing from the release workflow (#6487)212b941fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#6488)e7576f5docs(blog): let the page show through the navbar in dark mode (#6489)fedb06ffix(docs): match the blog TOC hover bar to the 2px active indicator6c932fcchore: bump devcontainer image to Node 24 (#6470)6635d9ddocs(blog): soften the "method memoization" attribution019ae29fix(docs): drop ISR on the docs route so the home page hydrates652bb43chore(docs): drop the scroll log from the route-change scroller571c8e8fix(docs): render blog tabs with the stock fumadocs tab card9a193aa4.5.2v4.5.1Compare Source
Commits:
2e862dbci: gate the GitHub release and JSR publish on the version being live on npm8e033804.5.1v4.5.0Compare Source
Zod 4.5 is now available.
At a glance:
z.compile()— the flagship feature of Zod 4.5z.creditCard()— 12–19 digits plus Luhn checksumz.properties()— the multi-property counterpart toz.property()z.deepPartial()/.exactPartial()z.validate(): boolean— a fast-path to verify input validity without a full parse (up to 16x faster on invalid data)bn), Central Kurdish (ckb), Hindi (hi), Kannada (kn), Norwegian Nynorsk (nn), Brazilian Portuguese (pt-BR), Slovak (sk), Turkmen (tk)z.compile()You can now pre-compile any Zod schema using
z.compile(schema). This dramatically speeds up parsing performance.A compiled schema can be used exactly like an uncompiled one. There are no special rules around compiled schemas. They're just faster.
On objects, arrays, and unions, this speeds up parsing by a factor of ~3–7. More complex schemas stand to benefit more than simpler ones.
Time per parse by schema type, standard parser vs compiled — lower is better (benchmark)
Below are the Moltar benchmark results comparing Zod (compiled and uncompiled) against the Moltar ParseSafe bench.
Throughput on the moltar benchmark fixture (parseSafe: returns a new object with unknown keys stripped) — higher is better (benchmark)
And the equivalent results for the Moltar AssertLoose bench. Tested against the new
z.validate(schema, input)function (detailed later in the post).Throughput on the moltar benchmark fixture (assertLoose: returns a boolean, unknown keys allowed) — higher is better (benchmark)
Zod's entire test suite runs twice—once normally and again with auto-compilation enabled globally—to ensure perfect fidelity.
How it works
Under the hood,
z.compile()walks the entire schema once and produces a hyperoptimized snippet of flat, loop-free JavaScript that can validate inputs far faster than a standard runtime validator. This snippet can be executed vianew Function()(effectively a more powerfuleval) to serve as a fast-path validator. Schemas use this to "fast check" validity, falling back to the regular runtime logic on validation failure to provide granular error information.Take this simple
Pointschema:Here is the generated snippet for it:
For the large majority of inputs, the generated function validates the data with the fastest logic JavaScript can express: straight-line
typeofchecks and property reads, with no interpreter in between. When it can't handle an input, Zod falls back to the standard parser.This is the function Zod generates for the
Playerschema above:Armed with the power of
new Function(), this happens in-process at runtime. There is no need to integrate with your build system.import "zod/compile"To compile every schema in an application, import
zod/compileonce at the top of your entry point. Every schema constructed after that import is automatically compiled the first time it's used to parse data.It also works as a Node.js CLI flag, which guarantees it runs before any module defines a schema:
Or set
preloadinbunfig.tomlornub.jsonc.{ "preload": ["zod/compile"] }All schemas benefit to varying degrees, though complex object/tuple/array schemas benefit more than simple scalar validators.
z.creditCard()A new string format: 12–19 digits, optionally separated by single spaces or hyphens, with a valid Luhn checksum. (#5931)
z.properties()The multi-property counterpart to
z.property(). (#5912)z.deepPartial()Back in functional form after being removed as a method in Zod 4. (#5928)
The result is still a
ZodObject, so.shapeand.extend()keep working..exactPartial()Like
.partial(), but wraps each field inz.exactOptional()instead ofz.optional(): keys may be omitted, but an explicitundefinedis rejected. This matches TypeScript'sPartial<>underexactOptionalPropertyTypes. (#6065)In Zod Mini it's a top-level function:
z.exactPartial(Recipe).z.validate()Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a
ZodError, which makes rejection cheap: on invalid input it is up to 16x faster than.safeParse().success. The return type is a guard on the schema's input type, andz.validateAsync()covers schemas with async refinements. (#6471)z.input()/z.output()Project a schema onto its input or output side. Useful for validating the two halves of a codec independently. (#5928)
This is a no-op on schemas not containing codecs/pipes.
z.toZod<T>()A utility to define a Zod schema that agrees exactly with a static type, often one that is handwritten or externally defined. (#5913)
z.getDiscriminatedOption()Extract a discriminated union member by discriminator value. (#5947)
Cyclical inputs
Zod recursive schemas now support cyclical data. For bundle size reasons, Zod Mini requires you to register a memoizer explicitly. (#6387, #6482)
Zod
Zod Mini
9x reduction in schema memory footprint
In Zod 4.4 a bare
z.string()retained 7.5kb of heap. In Zod 4.5 it retains 784 bytes.Retained heap per schema instance, Zod 4.4.3 vs 4.5 (benchmark)
In Zod 4.4 and earlier, all schema methods were automatically bound to the instance itself. This allowed users to pluck methods from schemas without causing issues due to
this-binding.A consequence of this is that each bound method allocates space on the heap; method implementations are not shared across all instances via
prototype, as you'd expect. Zod 4.5 implements a method memoization pattern that avoids allocating bound methods until they are actually accessed.Faster failures
Zod
.parse()/.safeParse()instantiates a JavaScriptError, which captures a stack trace. In the case of validation failures, this is often much slower than the parsing logic itself. When using.safeParse(), Zod no longer captures this stack trace, speeding up failure-path parses by a factor of ~7.5x. (#6316, #6450)Player schema (benchmark)
Symbol keys in
z.object()A shape can now declare a symbol key. TypeScript tracks it: a
constsymbol infers asunique symbol, soz.infermakes the key required and checks its value type. Undeclared symbol keys are still ignored. (#6448)Bug fixes
All of these fix soundness issues, so a schema that relied on the old behavior may now reject input it used to accept.
z.iso.datetime()requires secondsRFC 3339 mandates seconds.
z.iso.datetime()andz.iso.datetime({ offset: true })no longer accept minute-precision input like2020-01-01T06:15Z.local: truestill admits2020-01-01T06:15, since an unqualified datetime is outside RFC 3339 either way. (#6457)To accept both forms, union the two precisions:
.min(),.max(), and.length()counted UTF-16 code units, soz.string().max(5)rejected five emoji. They now count Unicode code points, which is what every non-JS consumer of a length bound does (Postgres, MySQL, Go, Python, and themaxLengththatz.toJSONSchema()emits)..max()only loosens;.min()and.length()tighten for astral input. Graphemes are unchanged — a ZWJ sequence is still several code points. (#6441)Closes #3355.
A record's key schema now governs only the keys that match it, the way TypeScript treats an index signature. Intersecting an object with a pattern-keyed record no longer rejects the object's own keys. (#6412)
Separately, an
unrecognized_keysissue no longer aborts the schema it came from, so a strict object with an extra key and a bad value now reports both issues instead of just the first. Closes #2200, #2573, #4017, #5663.__proto__is always strippedObject and record parsers now drop a
__proto__key whether it comes from the input, is declared by the schema, or is produced by a record key transform. A key that a record's key schema normalizes to__proto__is dropped too..strict()reports an own__proto__input key asunrecognized_keysinstead of silently swallowing it. Error formatters and both JSON Schema converters use own-property writes so atoStringorconstructorpath segment can't walk ontoObject.prototype(#6213, #6367, #6346). (#6386, #6354, #6355, #6221)z.ipv6()validated by handing the string tonew URL(), which let::@1\and::1\nthrough. It now checks the address alphabet directly (#6442).z.ulid()restricts the first character to0–7; anything higher overflows the 48-bit timestamp. A fixture that doesn't start with a real timestamp, such as one with a leading letter, is now rejected (#6095).z.httpUrl()enforces the RFC 1035 length limits on the host, matchingz.hostname()(#6035).z.emoji()no longer backtracks exponentially on a failed match (#6347).z.string().includes(sub, { position: N })emits a JSON Schema pattern that allows at least N leading characters, matchingString.prototype.includes(#6024).Commits
Zod 4.5 rolls up 155 commits. Thanks to everyone who contributed: @dokson, @deepshekhardas, @zirkelc, @francisjohnjohnston-web, @MerlijnW70, @codinsonn, @oimo23, @JSap0914, @zelinewang, @abhishek-chaudhary2003, @spokodev, @Mohammad-Faiz-Cloud-Engineer, @hamed-bavar, @MGPOCKY, @ChiChuRita, @dinwwwh, @thristhart, @tsmartin9, @vedanshshetti, @belicam, @frastefanini, @andersk, @musaddiq-rafi, @tachmyratsaparmyradov, @arvindfroi, @KUMachine, @spidersouris, @catdalfonso, @mneetika, @gwagjiug, @MahinAnowar, @MaksZhukov, @emmayusufu, @agcty, @devareddy05, @Vish05, @yamcodes, @mattiasahlsen, @samchungy, @ozzyfromspace, @udohjeremiah, @patrickwehbe, @gajus, @Harm-Nullix, @thwbh, @IdanGonen, @irfanfandi, @JuerGenie, @marcalexiei, @itsahmedbilal, @DucMinhNe, @meliharik.
9782f87cperf(v4): validate without building the output, and keep schemas out of dictionary mode (#6480) by @colinhacks773a4867refactor(v4): declare a trait's members on $constructor (#6478) by @colinhacks68fb3f13feat(v4): make z.compile() fall back instead of throwing (#6479) by @colinhacks37b01501feat(v4): add z.isValid and z.isValidAsync (#6471) by @colinhacks749f5452docs: add fullproduct.dev to v4 ecosystem page (#6001) by @codinsonn24cdb7fdperf(v4): close the fastpass bindings into the compiled parser (#6464) by @colinhacks8d896186fix(v4): stop emitting a multipleOf that JSON Schema rejects (#6468) by @colinhacks43f729dbfeat(v4): make a tuple's items optional with .partial() (#6465) by @colinhacks97edaf7dfix(v4): don't throw from safeParse on bigint multipleOf(0n) (#6466) by @colinhacks21a6f0cbfeat(v4): let z.nanoid() take a custom length (#4004) by @oimo239d5b20effix(v4): restrict the first ULID character to [0-7] (#6095) by @JSap09141cf9cd09docs: record that error maps run per parse, and how to translate at render by @colinhacks7ce3e77dfix(v4): run a wrapper's inner schema on its own payload (#6462) by @colinhacks7b612b53fix(v4): fold an intersection of object schemas into one object (#6461) by @colinhacks1c43b774docs(v4): record why the failure path is not worth compiling by @colinhacksbadf0b78fix(v4): build the catch context from the input that failed (#6192) by @zelinewanga87ac366fix(v4)!: distinguish number and bigint formats at the type level (#6052) by @abhishek-chaudhary20036726c1dddocs: record what z.input and z.output do with transforms and wrappers by @colinhacks7cfc0122fix(v4): keep a wrapper's stored value only on the side it belongs to by @colinhacksa825c1b0fix(v4): empty enums and literals match nothing (#6459) by @colinhacks7c070db9feat(v4): expose the function schema on .implement() results (#6267) by @deepshekhardas3a496968fix(v4): make record input keys optional when the value can fill them (#6460) by @colinhacks53cec2a0fix(v4): resolve z.input past a preprocess transform by @colinhacks2125d30cfix(v4): accept exact decimal multiples in multipleOf (#6223) by @spokodev168122fcfix(v4): carry a pipe's own checks through z.output by @colinhacks51a1368afix(v4): let the includes(position) pattern match at or after the offset (#6024) by @francisjohnjohnston-web72a05c4ffeat(v4): expose stringbool truthy/falsy/case via _zod.bag (#6357) by @hamed-bavar036b39f4fix(v4)!: require seconds once a datetime carries a Z or an offset (#6457) by @colinhacks5825605eperf(v4): skip the eager stack capture when building a ZodError (#6450) by @colinhacksd85472c4feat(v4): support declared symbol keys in z.object() (#6448) by @colinhacksd4108872fix(v4): correct the date/time format keywords in both JSON Schema directions (#6452) by @colinhacks555e5f46Add z.toZod helper (#5913) by @colinhackse0e51a55docs(v4): cut the compile comments down to what they explain (#6449) by @colinhacks6574e784fix(v4): stop catch resurrecting issues an optional already resolved (#6440) by @colinhacks937b5d01perf(v4): prefix issue paths in place in the object JIT failure path (#6445) by @colinhacksb63db248fix(v4): keep a memoized node's cached issues private to the cache (#6443) by @colinhacks6ec3d043fix(resolution): keep pnpm's own warnings out of the attw snapshot (#6446) by @colinhacks830ba314fix(v4): validate the address, and return the string that was validated (#6442) by @colinhacksf101d8caPreserve callsites in parse stack traces (#5910) by @colinhacks6c77d028feat: compact simple anyOf unions to type array in toJSONSchema (#6339) by @deepshekhardas28e1ebd8fix(v4): measure string length in Unicode code points (#6441) by @colinhacks060bc9f3refactor: share default when-clauses for size/length checks (#6394) by @zirkelc2848177ddocs: point the flattened/formatted error deprecations at a symbol that exists by @colinhacks3c2dee9e](https://redirect.github.com/colinhacks/zod/commit/3Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.