Zod Updates & Release Notes

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243f, the pre-rewrite copy of 9c21983 with identical contents.

Commits

• 0cd3af5 docs: load the en locale directly in Zod Mini
• 9d5e60f docs: import locales from zod/locales, not z.locales
• 34a626f docs: tighten the z.locales tree-shaking note
• 74304ce release: stage npm versions instead of publishing them (#6622)
• b2ef983 docs: add Code for Japan to bronze sponsors
• 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
• bacad51 docs: square the Code for Japan logo to match the other bronze tiles
• c42596b release: hold the run on the release-approval environment until the staged versions are approved (#6638)
• a2ba4a6 fix(types): declare record output and input as members, not base type arguments (#6645)
• a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
• 529f78d 4.6.6
• 9c21983 ci: stage at verbose so a failed OIDC token exchange says why

Original source

Commits

d2b135c docs: add the 4.6.x patch highlights to the 4.6 post

f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections

de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#6598)

56222cd feat(instanceof): key the .properties() shape off the instance type (#6600)

ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"

cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""

0f3f5ee 4.6.5

59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

Original source

Zod 4.6 is now available.

npm install zod@latest

At a glance:

• .validate() — checks input validity without building a result (up to 35x faster than .safeParse().success on a compiled schema)
• z.instanceof().properties() — validates properties of an instance
• fromJSONSchema() — enforces six validation keywords it used to ignore
• z.iban() — electronic-format IBAN plus mod-97 checksum
• z.withParser() — installs a parser generated elsewhere, for environments without new Function
• Faster CommonJS — drops the getter on every export (~3x faster z.validate() under require)
• Memory retention in recursive schemas — releases the parsed input, fixing a 4.5 out-of-memory regression
• @zod/mini — Zod Mini as a standalone package, versioned in lockstep with zod since 4.5

.validate()

Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a ZodError, which makes rejection cheap. The return type is a guard on the schema's input type.

z.validate(z.string(), "hi"); // true
z.validate(z.string(), 42); // false

It is a method on Zod Classic schemas too. (#6547)

const Player = z.object({
username: z.string(),
xp: z.number(),
});
if (Player.validate(data)) {
data.username; // narrowed
}

In conjunction with z.compile(), this can be up to 35x faster than .safeParse().success on invalid input.

Time per call on invalid input, compiled with z.compile() — lower is better (benchmark)

Uncompiled schemas

Without compilation it is up to 5.9x faster. The saving is the result object: .safeParse() allocates one with an accessor pair on every call, and .validate() allocates nothing.

Time per call on invalid input, plain schemas — lower is better (benchmark)

Both charts measure the failure path. The key feature of .validate() is that it can short-circuit on the first issue it encounters, instead of aggregating a full ZodIssue[] array.

Note

Async refinements are covered by .validateAsync().

z.properties()

A new API for validating specific properties of an object. Unlike z.object() it validates in-place, so it plays nice with class instances. (#6536)

const responseLike = z.properties({ status: z.number().min(200).max(299) });
responseLike.parse(new Response("ok", { status: 200 })); // ✅ a real Response
responseLike.parse({ status: 204 }); // ✅ a plain object

A corresponding .properties() method has been added to ZodInstanceOf.

Zod

const okResponse = z.instanceof(Response).properties({
ok: z.literal(true),
status: z.number().min(200).max(299),
});

Zod Mini

const okResponse = z.instanceof(Response).check(...z.properties({
ok: z.literal(true),
status: z.number().check(z.minimum(200), z.maximum(299)),
}));

The input comes back untouched, so the prototype survives and the methods still work. That is the part z.object() cannot do: it would hand back a plain object and the Response would be gone.

const res = await fetch("/api/user");
okResponse.parse(res) === res; // ✅ true

fromJSONSchema()

Six additional JSON Schema keywords are now supported in z.fromJSONSchema(). (#6535)

• minProperties / maxProperties
• uniqueItems
• contains
• minContains / maxContains

const schema = z.fromJSONSchema({
type: "object",
minProperties: 2, // also maxProperties
});
schema.parse({ a: 1 }); // ❌ too few properties
schema.parse({ a: 1, b: 2 }); // ✅

Both property bounds count the input's own keys. Array uniqueness is structural, so [{ a: 1 }, { a: 1 }] is a duplicate.

z.fromJSONSchema({ type: "array", uniqueItems: true }).parse([{ a: 1 }, { a: 1 }]); // ❌
z.fromJSONSchema({
type: "array",
contains: { type: "number" }, // also minContains and maxContains
minContains: 2,
}).parse(["a", 2]); // ❌ only one number

z.iban()

A new string format: an IBAN in electronic format, with a valid ISO 7064 MOD 97-10 checksum. (#6571)

z.iban().parse("DE89370400440532013000"); // ✅
z.iban().parse("DE89370400440532013001"); // ❌ bad checksum

z.withParser()

z.compile() builds its parser with new Function, which a strict Content Security Policy blocks. z.withParser() is that installer on its own: it takes a parser generated somewhere else, at build time or by a native compiler, and installs it under the same contract. (#6575)

const Player = z.object({ username: z.string(), xp: z.number() });
// isPlayer is a type guard your build step generated
const Fast = z.withParser(Player, (input) =>
isPlayer(input) ? { username: input.username, xp: input.xp } : z.INVALID
);

The supplied parser owns the whole result, so it has to return what the schema would have returned. This one rebuilds the object rather than handing back its input, because z.object() strips unknown keys. Returning z.INVALID hands the input to the runtime, which stays the only source of ZodErrors.

Faster CommonJS

TypeScript compiles a re-export to a getter, and 252 of the 255 exports on Zod 4.5's CommonJS entrypoint were getters. V8 could not see a constant callee behind one, so it could not inline the call. The 4.6 build emits plain properties and freezes the exports object. On a compiled schema, z.validate() under require is about 3x faster than it was in Zod 4.5. (#6564)

const { z } = require("zod");
const CompiledPlayer = z.compile(Player);
z.validate(CompiledPlayer, data); // ~3x faster than Zod 4.5

Only calls through the namespace were affected. A method call like Player.safeParse(data) never reads the exports object, and the ESM build is unchanged.

Memory retention in recursive schemas

A recursive schema held the input and output of its last parse until the next parse replaced it, so one long-lived schema pinned every object it had touched. Zod 4.4 released that input and Zod 4.5 did not, which surfaced as an out-of-memory failure on a repository-wide lint run. The parse state is weak throughout now: one parse of a 29k-node tree retains 2.2 MB where it used to retain 10.1 MB, and recursive parses give up about 6% for it. (#6572)

const Category = z.object({
name: z.string(),
get children() {
return z.array(Category);
},
});

Bug fixes

⚠️ Error maps run on the first read of error

Because safeParse() now builds its error lazily, error maps — global, locale, and per-schema error — run when result.error is first read, not at parse time. Code that swaps z.config() between the parse and the read gets the newer configuration. (#6519)

const result = schema.safeParse(12);
z.config(z.locales.fr());
result.error.issues[0].message; // French in 4.6, English in 4.5

An error map with a side effect never runs if nothing reads the error. Throwing parses are unaffected — .parse() builds and throws its error immediately, never takes the lazy path, and its stack still points at your call site.

⚠️ z.emoji() rejects component-only strings

Unicode's Emoji_Component property covers the pieces that attach to an emoji, so z.emoji() accepted "123", "#", "*", and a lone zero-width joiner, variation selector, or skin tone modifier. The pattern now requires at least one pictograph, regional indicator, or keycap. (#6532)

z.emoji().parse("😀"); // ✅
z.emoji().parse("1️⃣"); // ✅ the keycap is the anchor
z.emoji().parse("123"); // ❌ was accepted in 4.5

Flags, subdivision flags, skin-tone-modified emoji, and ZWJ sequences are unchanged. Closes #6515.

⚠️ Numeric enum options no longer include the reverse mappings

A numeric TypeScript enum also carries its reverse mapping (0 to "UK") at runtime. The parser already ignored those keys, but .options was read straight off the enum object, so a three-member enum listed six values and three of them failed to parse. (#6542)

enum Country { UK, Germany, France }
z.enum(Country).options; // 4.5: ["UK", "Germany", "France", 0, 1, 2] — 4.6: [0, 1, 2]

⚠️ base64 patterns

The runtime patterns for z.base64() and z.base64url() are the character sets, with length and padding enforced in code, so a multi-megabyte string can no longer overflow the regex stack through a composed schema. The JSON Schema output still emits the exact block forms, so z.toJSONSchema() is unchanged. (#6534, #6527)

Composing z.base64() into a template literal now checks the alphabet but not the length, which is how z.creditCard() already behaves there. The exported z.regexes.base64url is now the length-aware form, so it overflows on a multi-megabyte input the same way z.regexes.base64 does.

⚠️ The email pattern dropped its lookaheads

z.email() opened with two lookaheads, and the second scanned the whole string before the match began. Both are gone, and the rule they enforced — no empty segment in the local part — is expressed structurally instead, so z.email() accepts and rejects exactly what it did before. Valid addresses validate roughly twice as fast. (#6573)

The pattern string is user-visible, and every copy of it changes: z.regexes.email, which has no capture groups now — neither of the two it used to expose held a usable value; issue.pattern on a failed z.email(); and the pattern that z.toJSONSchema() emits, which no longer carries a lookahead, so validators outside ECMAScript can compile it.

Composing an email into a template literal also stops applying its no-consecutive-dots rule to the rest of the string.

z.templateLiteral([z.email(), "|", z.string()]).parse("[email protected]|a..b");
// 4.5: ❌ — the lookahead reached past the email segment — 4.6: ✅

⚠️ Chained checks no longer overwrite each other in JSON Schema

Each check used to write its own bounds into the schema as it attached, in chain order, so a format check applied after .min() and .max() replaced the tighter values with its own range. The converter folds the checks as a conjunction now. The order they are chained in no longer changes the output. (#6554, #6553)

z.toJSONSchema(z.number().min(0).max(23).int());
// 4.5: { minimum: -9007199254740991, maximum: 9007199254740991 }
// 4.6: { minimum: 0, maximum: 23 }

Runtime parsing enforced the bounds in every version. Only the emitted schema was wrong. The same fold fixes two more cases: a repeated multipleOf kept the first divisor and dropped the rest, so z.number().multipleOf(2).multipleOf(3) emitted a schema that accepts 4, and z.string().min(8).length(5) emitted minLength: 5, widening a bound the runtime still rejected. Closes #6550.

⚠️ Metadata members materialize on first read

Eight members on a Zod Classic schema — .format, .minLength, .maxLength, .minValue, .maxValue, .isInt, .minDate and .maxDate — are computed from the checks now instead of being written onto every instance at construction. Each one is a prototype getter that becomes an own property on first read. (#6554)

const s = z.string().min(3).max(9);
Object.keys(s); // 4.5: ["def", "type", "format", "minLength", "maxLength"] — 4.6: ["def", "type"]
s.minLength; // 3 in both
Object.keys(s); // 4.6: ["def", "type", "minLength"]

A key is absent until something reads it, and Object.assign({}, schema) copies only the members that have been read. Deleting one restores the getter, and the next read recomputes it.

The values can move too, because the getters read the same fold the JSON Schema converter does. An order-dependent chain reports the tighter bound now instead of whichever check wrote last.

z.string().min(8).length(5).minLength; // 4.5: 5 — 4.6: 8

Commits

Zod 4.6 rolls up 72 commits.

661673ae docs: make the 9thCO logo visible on the light theme by @colinhacks
6de10dce docs: reconcile the sponsor listings against every active sponsorship (#6579) by @colinhacks
213ee75d feat(compile): add z.withParser for externally generated parsers (#6575) by @colinhacks
f9465d4e docs: reconcile the sponsor listings with active sponsorships (#6576) by @colinhacks
f7fd5548 perf(v4): drop the lookaheads from the email regex (#6573) by @colinhacks
36f17960 fix(v4): stop the memoizer from pinning a finished parse (#6572) by @colinhacks
22bed613 feat(v4): add z.iban() string format with mod-97 checksum (#6571) by @colinhacks
c5b9bcb3 bench: measure what a runtime island's leaked indent cost the generated source by @colinhacks
e54716cb docs(ecosystem): add @apical-ts/craft (#5946) by @gunzip
dcbcf052 fix(compile): unwind the doc indent when a child generator throws (#6570) by @colinhacks
277613a6 docs: move the release procedure to the maintainer-local notes by @colinhacks
eb1c1089 ci: release only on workflow_dispatch behind the npm environment (#6569) by @colinhacks
741981ff perf(compile): for-in record walk, cheaper issue finalization, and a generative compile differential (#6567) by @colinhacks
804e0f52 perf: seal the CommonJS exports so require("zod") stops reading through a getter (#6564) by @colinhacks
6f048367 fix(v4): derive JSON Schema constraints by folding checks in the converter (#6554) by @colinhacks
e4d67f3e Migrate development and CI to Nub (#6562) by @colinhacks
7a002366 fix(v4): don't let format checks overwrite tighter min/max bounds (#6553) by @colinhacks
5489a532 test(v4): pin the check-chain case that keeps compiled validate's definite guard (#6551) by @colinhacks
e7604717 docs: attribute the compiled failure cost to the fallback, not the double pass by @colinhacks
764ac59f perf(v4): settle z.validate on the first failure in parse order (#6544) by @colinhacks
07917f4c test(v4): pin the lazy safeParse error's stack behavior (#6548) by @colinhacks
62e6624b feat(v4): add .validate() and .validateAsync() to Zod Classic (#6547) by @colinhacks
cafbee47 fix(v4): parse recursive schemas built by a factory (#6530) by @colinhacks
4d730882 Release the parsed input once a failing safeParse builds its error (#6543) by @colinhacks
90269c60 Keep a numeric TS enum's reverse-mapping keys out of .options (#6542) by @colinhacks
18e71c71 Rename the JSON Schema process helper so bundler polyfills cannot collide (#6541) by @colinhacks
68aca3dc docs: cover the 4.5 API surface that never made it into the reference by @colinhacks
eca96871 fix(v4): enforce the six JSON Schema keywords fromJSONSchema silently dropped (#6535) by @colinhacks
81ded991 perf: answer z.validate from the compiled fast path on invalid input (#6538) by @colinhacks
51caf010 refactor: collapse cachedInternal back into cached (#6540) by @colinhacks
abfb3897 feat(v4): make z.properties() a schema, and give z.instanceof() a .properties() method (#6536) by @colinhacks
69f2a7ff Collapse toZod's normalizer and move its docs to the API reference (#6539) by @colinhacks
bf990216 perf: move util.cached's accessor to a prototype (#6537) by @colinhacks
bec73bea perf(v4): build the safeParse error on first read (#6519) by @colinhacks
07c43e2a Keep the runtime base64 regexes linear so composed parse paths cannot overflow (#6534) by @colinhacks
bc1157e7 docs: use a Response example for z.properties() by @colinhacks
2ec972ec refactor: collapse toZod's enum leaf normalizer to a dummy union (#6533) by @colinhacks
68a609ac Widen literal inputs in property check types (#6520) by @colinhacks
0227e53d docs: bump the star pill's GitHub mark to 20px by @colinhacks
84dd3b0f perf: build literal and enum pattern regexes lazily (#6531) by @colinhacks
f83ab511 fix(v4): reject component-only strings from z.emoji() (#6532) by @colinhacks
74f9a6d3 docs: drop the toZod enum block from basics and pin the page's curation rule in a comment by @colinhacks
a2a019a5 Accept enum-typed targets in z.toZod (#6528) by @colinhacks
319f47f4 Emit a length-aware base64url pattern in toJSONSchema (#6527) by @colinhacks
08ba069e perf(v4): read Luhn digits with charCodeAt instead of string indexing (#6529) by @colinhacks
1ec6b7c5 docs: add an RSS feed to the blog at /blog/rss.xml by @colinhacks
b801439b bench: add typebox (compiled and dynamic) to the moltar cross-library harness by @colinhacks
7ae49d64 docs: drop the circle around the star pill's GitHub mark and center it on the pill's arc by @colinhacks
93f3ab32 docs: replace the blog navbar's GitHub icon with a star-count pill by @colinhacks
fb2fedfd docs: tighten the memory chart callout, pad the canvas, say "less memory" by @colinhacks
ff56a551 docs: center the memory chart callout labels and pad them off the number by @colinhacks
8cd1250f docs: center the memory chart callout labels by @colinhacks
3195ed01 docs: label the memory chart like the compile chart by @colinhacks
a6b49390 Mark the compile internals @internal instead of hiding them (#6518) by @colinhacks
40b4d0b3 fix(ci): read zod's latest version with npm view when picking the backfill dist-tag by @colinhacks
5ff95665 Stop re-exporting the compile internals from zod/v4/core (#6511) by @colinhacks
f412178d ci: publish @zod/mini to JSR in lockstep with npm (#6510) by @colinhacks
f3e7c72e fix(docs): render the docs 404 page inside the (doc) layout once by @colinhacks
f3cb3644 docs: surface the blog on the home page and in the sidebar by @colinhacks
cd4f9a67 perf(v4): report Standard Schema issues without constructing a ZodError (#6509) by @colinhacks
43b9bfc5 docs: drop the bound-methods section from the Zod package page by @colinhacks
70eb2c07 docs: drop the traits section and the compilation feature bullet by @colinhacks
1c0bce0c docs: bring the 4.5 charts and worked examples into the docs pages by @colinhacks
a0898b4b ci: wait hours for npm to serve a publish, not ten minutes (#6502) by @colinhacks
c46eeff0 chore: narrow blanket biome-ignore comments (#6504) by @pullfrog[bot]
c7ec94d3 ci: check zod and @zod/mini lockstep on npm after every publish (#6507) by @colinhacks
81065739 chore(docs): build with Turbopack by @colinhacks
abd41adb docs(wiki): move plans and comparisons into a gitignored internal/ (#6506) by @colinhacks
2956c4c2 chore(mini): sync @zod/mini to 4.5.4 by @colinhacks
8ce9e8d5 feat(mini): publish Zod Mini as the standalone @zod/mini package (#6491) by @colinhacks
93186cab docs(wiki): drop the zod-compiler benchmark (#6505) by @colinhacks
908c9e17 fix(docs): retry the GitHub stars fetch and log the real status by @colinhacks

Original source

Commits

• a354314 fix(docs): keep blog posts out of the docs collection (#6484)
• d378c42 ci: drop canary publishing from the release workflow (#6487)
• 212b941 fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#6488)
• e7576f5 docs(blog): let the page show through the navbar in dark mode (#6489)
• fedb06f fix(docs): match the blog TOC hover bar to the 2px active indicator
• 6c932fc chore: bump devcontainer image to Node 24 (#6470)
• 6635d9d docs(blog): soften the "method memoization" attribution
• 019ae29 fix(docs): drop ISR on the docs route so the home page hydrates
• 652bb43 chore(docs): drop the scroll log from the route-change scroller
• 571c8e8 fix(docs): render blog tabs with the stock fumadocs tab card
• 9a193aa 4.5.2

Original source

Zod 4.5 is now available.

npm install zod@latest

At a glance:

• z.compile() — the flagship feature of Zod 4.5
• z.creditCard() — 12–19 digits plus Luhn checksum
• z.properties() — the multi-property counterpart to z.property()
• z.deepPartial()/.exactPartial()
• z.validate(): boolean — a fast-path to verify input validity without a full parse (up to 16x faster on invalid data)
• 9x reduction in memory footprint
• New locales: Bengali (bn), Central Kurdish (ckb), Hindi (hi), Kannada (kn), Norwegian Nynorsk (nn), Brazilian Portuguese (pt-BR), Slovak (sk), Turkmen (tk)

z.compile()

You can now pre-compile any Zod schema using z.compile(schema). This dramatically speeds up parsing performance.

import * as z from "zod";
const Player = z.object({
username: z.string(),
bio: z.string(),
xp: z.number()
});
const CompiledPlayer = z.compile(Player);

A compiled schema can be used exactly like an uncompiled one. There are no special rules around compiled schemas. They're just faster.

Player.parse({ ... });
CompiledPlayer.parse({ ... }); // ~2x faster

On objects, arrays, and unions, this speeds up parsing by a factor of ~3–7. More complex schemas stand to benefit more than simpler ones.

Time per parse by schema type, standard parser vs compiled — lower is better (benchmark)

Below are the Moltar benchmark results comparing Zod (compiled and uncompiled) against the Moltar ParseSafe bench.

Throughput on the moltar benchmark fixture (parseSafe: returns a new object with unknown keys stripped) — higher is better (benchmark)

And the equivalent results for the Moltar AssertLoose bench. Tested against the new z.validate(schema, input) function (detailed later in the post).

Throughput on the moltar benchmark fixture (assertLoose: returns a boolean, unknown keys allowed) — higher is better (benchmark)

Zod's entire test suite runs twice—once normally and again with auto-compilation enabled globally—to ensure perfect fidelity.

How it works

Under the hood, z.compile() walks the entire schema once and produces a hyperoptimized snippet of flat, loop-free JavaScript that can validate inputs far faster than a standard runtime validator. This snippet can be executed via new Function() (effectively a more powerful eval) to serve as a fast-path validator. Schemas use this to "fast check" validity, falling back to the regular runtime logic on validation failure to provide granular error information.

Take this simple Point schema:

const Point = z.object({
x: z.number(),
y: z.number()
});

Here is the generated snippet for it:

const isPoint = new Function("input", `
if (typeof input !== "object" || input === null) return false;
if (typeof input.x !== "number") return false;
if (typeof input.y !== "number") return false;
return true;
`);
isPoint({ x: 1, y: 2 }); // true
isPoint({ x: "1" }); // false

For the large majority of inputs, the generated function validates the data with the fastest logic JavaScript can express: straight-line typeof checks and property reads, with no interpreter in between. When it can't handle an input, Zod falls back to the standard parser.

This is the function Zod generates for the Player schema above:

if (typeof input !== "object" || input === null || Array.isArray(input)) return INVALID;
const v0 = input["username"];
if (typeof v0 !== "string") return INVALID;
const v1 = input["bio"];
if (typeof v1 !== "string") return INVALID;
const v2 = input["xp"];
if (typeof v2 !== "number" || !Number.isFinite(v2)) return INVALID;
const v3 = { "username": v0, "bio": v1, "xp": v2 };
return v3;

Armed with the power of new Function(), this happens in-process at runtime. There is no need to integrate with your build system.

The compiled schema is purely additive on top of the existing schema. It tacks on the pre-compiled fast path for checking valid inputs. When invalid data is detected, it returns the INVALID symbol to signal that parsing should fall back to the uncompiled parser. This structurally prevents subtle deviations in error reporting between compiled and uncompiled variants.

import "zod/compile"

To compile every schema in an application, import zod/compile once at the top of your entry point. Every schema constructed after that import is automatically compiled the first time it's used to parse data.

import "zod/compile"; // must come before modules that define schemas
import * as z from "zod";
const schema = z.object({ name: z.string() });
schema.parse({ name: "ok" }); // compiled on first parse

It also works as a Node.js CLI flag, which guarantees it runs before any module defines a schema:

node --import zod/compile app.js

Or set preload in bunfig.toml or nub.jsonc.

{
"preload": ["zod/compile"]
}

All schemas benefit to varying degrees, though complex object/tuple/array schemas benefit more than simple scalar validators.

Read the docs, or the full technical writeup: Introducing z.compile()

z.creditCard()

A new string format: 12–19 digits, optionally separated by single spaces or hyphens, with a valid Luhn checksum. (#5931)

z.creditCard().parse("4111 1111 1111 1111"); // ✅
z.creditCard().parse("4111 1111 1111 1112"); // ❌ bad checksum

z.properties()

The multi-property counterpart to z.property(). (#5912)

const httpsUrl = z.instanceof(URL).check(
...z.properties({
protocol: z.literal("https:" as string),
hostname: z.string().regex(z.regexes.domain),
})
);
httpsUrl.parse(new URL("https://example.com")); // ✅
httpsUrl.parse(new URL("http://localhost")); // ❌ protocol

z.deepPartial()

Back in functional form after being removed as a method in Zod 4. (#5928)

const Post = z.object({
title: z.string(),
author: z.object({ name: z.string(), email: z.string() }),
});
const PartialPost = z.deepPartial(Post);
type PartialPost = z.output<typeof PartialPost>;
// => { title?: string; author?: { name?: string; email?: string } }
PartialPost.parse({ author: {} }); // ✅

The result is still a ZodObject, so .shape and .extend() keep working.

.exactPartial()

Like .partial(), but wraps each field in z.exactOptional() instead of z.optional(): keys may be omitted, but an explicit undefined is rejected. This matches TypeScript's Partial<> under exactOptionalPropertyTypes. (#6065)

const Recipe = z.object({ title: z.string(), servings: z.number() });
const PartialRecipe = Recipe.exactPartial();
PartialRecipe.parse({}); // ✅
PartialRecipe.parse({ title: undefined }); // ❌

In Zod Mini it's a top-level function: z.exactPartial(Recipe).

z.validate()

Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a ZodError, which makes rejection cheap: on invalid input it is up to 16x faster than .safeParse().success. The return type is a guard on the schema's input type, and z.validateAsync() covers schemas with async refinements. (#6471)

z.validate(z.string(), "hi"); // true
z.validate(z.string(), 42); // false

z.input() / z.output()

Project a schema onto its input or output side. Useful for validating the two halves of a codec independently. (#5928)

const isoDate = z.codec(z.iso.datetime(), z.date(), {
decode: (s) => new Date(s),
encode: (d) => d.toISOString(),
});
const Event = z.object({ name: z.string(), at: isoDate });
z.input(Event).parse({ name: "launch", at: "2024-01-01T00:00:00Z" }); // ✅
z.output(Event).parse({ name: "launch", at: new Date() }); // ✅

This is a no-op on schemas not containing codecs/pipes.

z.toZod<T>()

A utility to define a Zod schema that agrees exactly with a static type, often one that is handwritten or externally defined. (#5913)

type Player = { username: string; xp: number };
const Player = z.toZod<Player>()(
z.object({
username: z.string(),
xp: z.number(),
})
);
Player.shape.username; // ZodString — the schema is returned unchanged

z.getDiscriminatedOption()

Extract a discriminated union member by discriminator value. (#5947)

const Fruit = z.object({ type: z.literal("fruit"), seeds: z.boolean() });
const Veg = z.object({ type: z.literal("vegetable"), leafy: z.boolean() });
const Produce = z.discriminatedUnion("type", [Fruit, Veg]);
z.getDiscriminatedOption(Produce, "fruit"); // typeof Fruit
z.getDiscriminatedOption(Produce, "meat"); // ❌ TypeScript error

Cyclical inputs

Zod recursive schemas now support cyclical data. For bundle size reasons, Zod Mini requires you to register a memoizer explicitly. (#6387, #6482)

Zod

const Category = z.object({
name: z.string(),
get subcategories() {
return z.array(Category);
},
});
const input: any = { name: "root", subcategories: [] };
input.subcategories.push(input);
const result = Category.parse(input);
result.subcategories[0] === result; // true

Zod Mini

// register a memoizer before defining any schemas
z.config({ memoizer: z.memoizer() });
const result = Category.parse(input);
result.subcategories[0] === result; // true

9x reduction in schema memory footprint

In Zod 4.4 a bare z.string() retained 7.5kb of heap. In Zod 4.5 it retains 784 bytes.

Retained heap per schema instance, Zod 4.4.3 vs 4.5 (benchmark)

In Zod 4.4 and earlier, all schema methods were automatically bound to the instance itself. This allowed users to pluck methods from schemas without causing issues due to this-binding.

const { parse } = z.string();
parse("some data");

A consequence of this is that each bound method allocates space on the heap; method implementations are not shared across all instances via prototype, as you'd expect. Zod 4.5 implements a method memoization pattern that avoids allocating bound methods until they are actually accessed.

Read the deep dive: Reducing Zod's memory footprint by an order of magnitude

Faster failures

Zod .parse()/.safeParse() instantiates a JavaScript Error, which captures a stack trace. In the case of validation failures, this is often much slower than the parsing logic itself. When using .safeParse(), Zod no longer captures this stack trace, speeding up failure-path parses by a factor of ~7.5x. (#6316, #6450)

const result = Player.safeParse({ username: 42, bio: "hello", xp: 12 });
result.success; // false — ~7.5x faster than Zod 4.4

Player schema (benchmark)

Symbol keys in z.object()

A shape can now declare a symbol key. TypeScript tracks it: a const symbol infers as unique symbol, so z.infer makes the key required and checks its value type. Undeclared symbol keys are still ignored. (#6448)

const TAG = Symbol("tag");
const schema = z.object({ name: z.string(), [TAG]: z.number() });
schema.parse({ name: "alice", [TAG]: 42 }); // ✅ { name: "alice", [TAG]: 42 }
schema.safeParse({ name: "alice" }); // ❌ the symbol key is required

Bug fixes

All of these fix soundness issues, so a schema that relied on the old behavior may now reject input it used to accept.

⚠️ z.iso.datetime() requires seconds

RFC 3339 mandates seconds. z.iso.datetime() and z.iso.datetime({ offset: true }) no longer accept minute-precision input like 2020-01-01T06:15Z. local: true still admits 2020-01-01T06:15, since an unqualified datetime is outside RFC 3339 either way. (#6457)

z.iso.datetime().parse("2020-01-01T06:15:00Z"); // ✅
z.iso.datetime().parse("2020-01-01T06:15Z"); // ❌ was accepted in 4.4

To accept both forms, union the two precisions:

z.union([z.iso.datetime(), z.iso.datetime({ precision: -1 })]);

⚠️ String length counts code points

.min(), .max(), and .length() counted UTF-16 code units, so z.string().max(5) rejected five emoji. They now count Unicode code points, which is what every non-JS consumer of a length bound does (Postgres, MySQL, Go, Python, and the maxLength that z.toJSONSchema() emits). .max() only loosens; .min() and .length() tighten for astral input. Graphemes are unchanged — a ZWJ sequence is still several code points. (#6441)

z.string().max(5).parse("😀😀😀😀😀"); // was too_big, now passes
z.string().min(5).parse("😀😀😀"); // was fine, now too_small

Closes #3355.

⚠️ Record keys and intersections match TypeScript

A record's key schema now governs only the keys that match it, the way TypeScript treats an index signature. Intersecting an object with a pattern-keyed record no longer rejects the object's own keys. (#6412)

z.object({ name: z.string() })
.and(z.record(z.string().regex(/^S_/), z.string()))
.parse({ name: "a", S_a: "s" });
// 4.4: throws invalid_key on "name"
// 4.5: { name: "a", S_a: "s" }

Separately, an unrecognized_keys issue no longer aborts the schema it came from, so a strict object with an extra key and a bad value now reports both issues instead of just the first. Closes #2200, #2573, #4017, #5663.

⚠️ proto is always stripped

Object and record parsers now drop a proto key whether it comes from the input, is declared by the schema, or is produced by a record key transform. A key that a record's key schema normalizes to proto is dropped too. .strict() reports an own proto input key as unrecognized_keys instead of silently swallowing it. Error formatters and both JSON Schema converters use own-property writes so a toString or constructor path segment can't walk onto Object.prototype (#6213, #6367, #6346). (#6386, #6354, #6355, #6221)

⚠️ Stricter string formats

z.ipv6() validated by handing the string to new URL(), which let ::@1\ and ::1\n through. It now checks the address alphabet directly (#6442).

z.ulid() restricts the first character to 0–7; anything higher overflows the 48-bit timestamp. A fixture that doesn't start with a real timestamp, such as one with a leading letter, is now rejected (#6095).

z.httpUrl() enforces the RFC 1035 length limits on the host, matching z.hostname() (#6035).

z.emoji() no longer backtracks exponentially on a failed match (#6347).

z.string().includes(sub, { position: N }) emits a JSON Schema pattern that allows at least N leading characters, matching String.prototype.includes (#6024).

Commits

Zod 4.5 rolls up 155 commits. Thanks to everyone who contributed: @dokson, @deepshekhardas, @zirkelc, @francisjohnjohnston-web, @MerlijnW70, @codinsonn, @oimo23, @JSap0914, @zelinewang, @abhishek-chaudhary2003, @spokodev, @Mohammad-Faiz-Cloud-Engineer, @hamed-bavar, @MGPOCKY, @ChiChuRita, @dinwwwh, @thristhart, @tsmartin9, @vedanshshetti, @belicam, @frastefanini, @andersk, @musaddiq-rafi, @tachmyratsaparmyradov, @arvindfroi, @KUMachine, @spidersouris, @catdalfonso, @mneetika, @gwagjiug, @MahinAnowar, @MaksZhukov, @emmayusufu, @agcty, @devareddy05, @Vish05, @yamcodes, @mattiasahlsen, @samchungy, @ozzyfromspace, @udohjeremiah, @patrickwehbe, @gajus, @Harm-Nullix, @thwbh, @IdanGonen, @irfanfandi, @JuerGenie, @marcalexiei, @itsahmedbilal, @DucMinhNe, @meliharik.

9782f87c perf(v4): validate without building the output, and keep schemas out of dictionary mode (#6480) by @colinhacks
773a4867 refactor(v4): declare a trait's members on $constructor (#6478) by @colinhacks
68fb3f13 feat(v4): make z.compile() fall back instead of throwing (#6479) by @colinhacks
37b01501 feat(v4): add z.isValid and z.isValidAsync (#6471) by @colinhacks
749f5452 docs: add fullproduct.dev to v4 ecosystem page (#6001) by @codinsonn
24cdb7fd perf(v4): close the fastpass bindings into the compiled parser (#6464) by @colinhacks
8d896186 fix(v4): stop emitting a multipleOf that JSON Schema rejects (#6468) by @colinhacks
43f729db feat(v4): make a tuple's items optional with .partial() (#6465) by @colinhacks
97edaf7d fix(v4): don't throw from safeParse on bigint multipleOf(0n) (#6466) by @colinhacks
21a6f0cb feat(v4): let z.nanoid() take a custom length (#4004) by @oimo23
9d5b20ef fix(v4): restrict the first ULID character to [0-7] (#6095) by @JSap0914
1cf9cd09 docs: record that error maps run per parse, and how to translate at render by @colinhacks
7ce3e77d fix(v4): run a wrapper's inner schema on its own payload (#6462) by @colinhacks
7b612b53 fix(v4): fold an intersection of object schemas into one object (#6461) by @colinhacks
1c43b774 docs(v4): record why the failure path is not worth compiling by @colinhacks
badf0b78 fix(v4): build the catch context from the input that failed (#6192) by @zelinewang
a87ac366 fix(v4)!: distinguish number and bigint formats at the type level (#6052) by @abhishek-chaudhary2003
6726c1dd docs: record what z.input and z.output do with transforms and wrappers by @colinhacks
7cfc0122 fix(v4): keep a wrapper's stored value only on the side it belongs to by @colinhacks
a825c1b0 fix(v4): empty enums and literals match nothing (#6459) by @colinhacks
7c070db9 feat(v4): expose the function schema on .implement() results (#6267) by @deepshekhardas
3a496968 fix(v4): make record input keys optional when the value can fill them (#6460) by @colinhacks
53cec2a0 fix(v4): resolve z.input past a preprocess transform by @colinhacks
2125d30c fix(v4): accept exact decimal multiples in multipleOf (#6223) by @spokodev
168122fc fix(v4): carry a pipe's own checks through z.output by @colinhacks
51a1368a fix(v4): let the includes(position) pattern match at or after the offset (#6024) by @francisjohnjohnston-web
72a05c4f feat(v4): expose stringbool truthy/falsy/case via _zod.bag (#6357) by @hamed-bavar
036b39f4 fix(v4)!: require seconds once a datetime carries a Z or an offset (#6457) by @colinhacks
5825605e perf(v4): skip the eager stack capture when building a ZodError (#6450) by @colinhacks
d85472c4 feat(v4): support declared symbol keys in z.object() (#6448) by @colinhacks
d4108872 fix(v4): correct the date/time format keywords in both JSON Schema directions (#6452) by @colinhacks
555e5f46 Add z.toZod helper (#5913) by @colinhacks
e0e51a55 docs(v4): cut the compile comments down to what they explain (#6449) by @colinhacks
6574e784 fix(v4): stop catch resurrecting issues an optional already resolved (#6440) by @colinhacks
937b5d01 perf(v4): prefix issue paths in place in the object JIT failure path (#6445) by @colinhacks
b63db248 fix(v4): keep a memoized node's cached issues private to the cache (#6443) by @colinhacks
6ec3d043 fix(resolution): keep pnpm's own warnings out of the attw snapshot (#6446) by @colinhacks
830ba314 fix(v4): validate the address, and return the string that was validated (#6442) by @colinhacks
f101d8ca Preserve callsites in parse stack traces (#5910) by @colinhacks
6c77d028 feat: compact simple anyOf unions to type array in toJSONSchema (#6339) by @deepshekhardas
28e1ebd8 fix(v4): measure string length in Unicode code points (#6441) by @colinhacks
060bc9f3 refactor: share default when-clauses for size/length checks (#6394) by @zirkelc
2848177d docs: point the flattened/formatted error deprecations at a symbol that exists by @colinhacks
3c2dee9e Add properties checks for instanceof schemas (#5912) by @colinhacks
87ffeb0f fix(v4): an absent key on the middle rung supplies nothing (#6434) by @colinhacks
7785fc82 feat(v4): add z.getDiscriminatedOption (#5947) by @dokson
0135c85a feat(v4): allow passing extra args to apply() (#6337) by @deepshekhardas
ca246d26 fix(v4): drop empty alternation branch from datetime pattern (#6439) by @colinhacks
e073d55b docs: z.iso.datetime() accepts a subset of ISO 8601, not all of it by @colinhacks
d6ca12ae fix(v4): infer recursive getter options in discriminatedUnion (#6422) by @colinhacks
dc51404b Add shorn to Zod Utilities (#6398) by @ChiChuRita
580111da docs: mark AOT compilation as canary-only by @colinhacks
6b0dae79 docs: note that a catch callback is not islanded by @colinhacks
898c4461 refactor(v4): give the runtime and compiled code one URL implementation by @colinhacks
260e5d4b fix(v4): stop islanding a catch callback, which diverged silently by @colinhacks
11c9268b revert(core): drop the exactOptional parse prototype from #6432 (#6438) by @colinhacks
a38ab4a8 fix(core): an omittable discriminator claims undefined (#6432) by @colinhacks
c9ec89e0 perf(core): drop the seal and the per-key WeakSet from the lazy internals (#6435) by @colinhacks
3c9ca1d9 feat(json-schema): emit a root $ref when the root schema has an id (#6029) by @dinwwwh
fa77a4d7 feat(v4): z.compile — ahead-of-time schema compilation (#6085) by @colinhacks
f300476d fix(v4): let a schema's error map cover its own checks' issues (#6426) by @colinhacks
9f0a3d81 fix(core): restore defineLazy semantics lost in the internals move (#6429) by @colinhacks
604464c3 fix(locales): da/nn/no/sv called an IP address a range (#6430) by @colinhacks
7378e7cd fix(locales): backfill the mac and Sizable.map gaps, and pin dictionary parity (#6427) by @colinhacks
b1077f05 perf(memory): install derived internals on a per-constructor prototype (#6415) by @colinhacks
ccc15144 fix(locales): add the credit_card key to the seven locales missing it (#6424) by @colinhacks
73bacbbb fix(from-json-schema): drop redundant inclusive bound for draft-04 exclusive ranges (#6022) by @francisjohnjohnston-web
86b2e6da docs: list el and hr in the supported locales (#6423) by @colinhacks
45fdeda5 fix(v4): refine optin into a three-rung ladder, retire the fallback payload flag (#6419) by @colinhacks
5b34c0ce Improve Portuguese localization and add Brazilian Portuguese (pt-BR) (#6076) by @thristhart
dc1a40a5 fix(locales): improve french translation (#6120) by @tsmartin9
0175a043 feat(locales): add Hindi and Kannada locale support (#6315) by @vedanshshetti
536ee3b0 Locales: added Slovak (sk) language (#6041) by @belicam
07b0c3d8 fix: preserve explicit superRefine issue input (#6053) by @frastefanini
ba98071c feat: add .exactPartial() to ZodObject (#6065) by @andersk
234c407d feat(lang): Added Bengali locale (#5974) by @musaddiq-rafi
377cd9d7 feat(locales): add turkmen (tk) locale (#6168) by @tachmyratsaparmyradov
69b6bb08 feat(locales): add Norwegian Nynorsk (nn) locale (#6092) by @arvindfroi
33d82e6b Add Central Kurdish (ckb) locale (#6078) by @KUMachine
06666fe2 fix(fr): remove hyphen in "non-optionnel" (#5999) by @spidersouris
79cfedea feat(v4): expose the owning schema on check-originated issues (#6420) by @colinhacks
436b5da8 docs: propose compiled constructor graph by @colinhacks
eb4682c9 fix(json-schema): resolve tuple minItems past transform and catch in input mode (#6418) by @colinhacks
4d6b5cd3 fix(json-schema): route unrepresentable default values through unrepresentable by @colinhacks
2abc9e05 docs: note that the JSON Schema emitter reads static optin (#6417) by @colinhacks
578e1cd0 feat(v4): support format: "hostname" in fromJSONSchema (#6305) by @catdalfonso
942bf8cb feat(v4): parse input containing reference cycles (#6387) by @colinhacks
78b523f0 fix(json-schema): keep preprocess object properties required in input mode (#6133) by @MerlijnW70
973b1b44 fix(v4): strip output-typed catch values from the input JSON Schema (#6409) by @colinhacks
5e608851 feat(v4): add z.deepPartial and runtime z.input / z.output (#5928) by @dokson
4e1720c8 fix(v4): align record keys and intersection strictness with TypeScript (#6412) by @colinhacks
4cc4053d fix: honor loose mode for closed record key schemas (#6157) by @pullfrog[bot]
69be843f fix(v4): stop the object JIT fastpass keeping a swallowed issue's value (#6407) by @colinhacks
b899cd17 perf(json-schema): make toJSONSchema(registry) linear in registry size (#6408) by @colinhacks
6074828e fix(v4): make fromJSONSchema propertyNames compose with the other object keywords (#6411) by @colinhacks
d7b209f3 docs: point the Web URLs callout at z.httpUrl() (#6410) by @colinhacks
611bd762 fix(mini): make merge() take an object schema, matching classic (#6404) by @colinhacks
b53e53cc fix(v4): use exact flag in English locale too_small/too_big messages (#6177) by @pullfrog[bot]
421cc9a5 fix(json-schema): unescape JSON Pointer tokens when resolving $ref (#6402) by @colinhacks
4c27fe87 fix(v4): give z.xor() a distinct error when multiple options match (#6376) by @colinhacks
a106fbe7 fix(v4): make fromJSONSchema tuples open-ended by default (#6020) by @mneetika
e8034eba fix(v4): make prefixItems/draft-7 items respect minItems in fromJSONSchema (#6201) by @pullfrog[bot]
784e5c26 fix(v4): let bundlers tree-shake locales out of the default import (#6384) by @colinhacks
97edd70a fix(toJSONSchema): constrain closed tuple length (#6194) by @pullfrog[bot]
f150020d fix(v4): escape non-string enum values in template literal patterns (#5934) by @gwagjiug
faf33a28 fix: surface @deprecated on re-exported compat aliases (#6072) by @MahinAnowar
3956224a docs: state that metadata wins over generated JSON Schema keywords (#6401) by @colinhacks
a1904fc2 fix(v4): report date origin for numeric min/max bounds (#6129) by @MerlijnW70
bd18314c fix: escape JSON Pointer reserved characters in toJSONSchema $ref (closes #6027) (#6144) by @MaksZhukov
2a5164f5 fix(v4): enforce RFC 1035 length limits in regexes.domain (#6035) by @emmayusufu
0e5bc4b1 fix(v4): respect additionalProperties:false with patternProperties in fromJSONSchema (#6199) by @pullfrog[bot]
c8f06d36 fix(v4): clarify infinite number errors (#5906) by @colinhacks
9a7ecc35 fix(json-schema): accept RFC 3339 numeric offsets in date-time format (#6298) by @agcty
0a76f3d7 feat(v4): add z.creditCard() string format (#5931) by @dokson
bd6619c0 feat(json-schema): accept a function for unrepresentable (#6380) by @colinhacks
9d20fdc3 fix(v4): preserve z.preprocess input narrowing (#5967) by @devareddy05
3063993a perf(v4): cut per-schema memory ~90% by moving methods to the prototype (#6318) by @zirkelc
fd074106 feat(json-schema): run override before the unrepresentable error (#6391) by @colinhacks
2715c12e fix(v4): preserve default English locale across tree-shaken bundles (#5959) by @colinhacks
81d9fc6c docs: add zod-form-action to ecosystem (#6314) by @Vish05
d86df5e0 docs: add ArkEnv to ecosystem page (#6203) by @yamcodes
18b4ff99 docs(ecosystem): add zodql to API Libraries (#6227) by @mattiasahlsen
479d6f51 shill oxlint (#6196) by @samchungy
85dba7e1 docs: document that any/unknown object keys are required (#6388) by @colinhacks
d24fb4c3 fix: consistently strip proto from parsed objects (#6386) by @colinhacks
7708d447 perf(v4): lazy ZodError construction (#6316) by @zirkelc
8ac9ae51 fix(docs-v3): serve the docsify SPA fallback on Vercel (#6378) by @colinhacks
31384464 fix(v4): complete reserved-key hardening (#6371) by @colinhacks
600c6909 docs: add Attaform to ecosystem (#6188) by @ozzyfromspace
37c05fa5 docs(ecosystem): rename zod-to-mongo-schema to zod-mongo-schema (#6178) by @udohjeremiah
badfdf08 docs: update keyof() ZodEnum type to the v4 form (#6124) by @patrickwehbe
e25b68e1 perf(v4): let three dead declarations tree-shake under esbuild (#6381) by @colinhacks
53397351 docs(ecosystem): Add zod-mongoose list item in Zod To X (#6062) by @Harm-Nullix
dfa0deb1 docs: add tauri-typegen to ecosystem (#6032) by @thwbh
9c914ee8 docs: add dynamic error message and combined refinement examples for refine() (#6002) by @IdanGonen
921649de fix(v4): formatError and treeifyError handle inherited-name path elements (#6367) by @deepshekhardas
e7029aa4 fix(v4): report own proto key under .strict() (#6221) by @pullfrog[bot]
9c540db8 fix(v4): re-check the record key after the key schema runs (#6355) by @colinhacks
8bb89ea4 docs: add .nonempty() to Strings, Arrays, Sets, and Maps sections (#6056) by @pullfrog[bot]
599c0e41 docs(ecosystem): Add @chrock-studio/overload and @chrock-studio/zod-utils (#6040) by @JuerGenie
27a9036a docs(ecosystem): eslint-plugin-zod is eslint-zod now (#5975) by @marcalexiei
e177a0ee docs(v4): document coerce missing-key breaking change (#5957) (#5964) by @dokson
66fba964 docs: show z.instanceof with built-in classes (#6059) by @itsahmedbilal
2d90846a fix(docs): make the prefault example runnable (#6063) by @DucMinhNe
ead9fcb3 fix(v4): write a declared proto key as an own property (#6354) by @colinhacks
c58764c5 docs: fix UUID helper list in v4 introduction (#6214) by @meliharik
f238fbd2 fix: remove exponential backtracking from the emoji regex (#6347) by @colinhacks
e6c213ec fix(json-schema): keep proto keys as own properties in schema conversion (#6346) by @colinhacks
573fcb75 fix(errors): use own-property semantics in every error-tree walker (#6213) by @pullfrog[bot]
6f5e99fd fix(docs-v3): rename README.md to home.md so Vercel serves it by @colinhacks
bbc68f99 docs: soften Zod 3 EOL callouts to informational tone by @colinhacks
3fc9b25f docs: reframe library-authors page Zod-4-first; note Zod 3 EOL by @colinhacks
f29f2a6d fix(v4): cidrv6 JSON schema pattern matches runtime (#5945) by @dokson
dfd8766b fix(v4): break circular import between classic schemas and iso (#5275) (#5926) by @dokson
fbe8ad1b fix(v4): allow dynamic .catch() under unrepresentable: "any" (#5273) (#5925) by @dokson

Original source

Commits

4c2fa95 docs: use Zernio primary wordmark for gold sponsor logo

2aeec83 docs: prune lapsed gold sponsors and rebalance logo sizing

7391be8 docs: prune lapsed silver/bronze sponsors and add active ones

2c70332 docs: normalize bronze sponsor logos to github avatar pattern

9195250 docs: remove Mintlify from bronze sponsors (churned)

b8dffe9 docs: remove Numeric and Speakeasy (2+ missed monthly cycles)

1cab693 fix(v4): restore catch handling for absent object keys (#5937) (#5939)

c2be4f8 fix(v4): generalize optin/fallback to transform; restore preprocess on absent keys (#5941)

f3c9ec0 4.4.3

1fb56a5 docs: document release procedure in AGENTS.md

Original source

Commits

0c62df0 Clean up docs navigation and stale labels (#5901)

20cc794 chore: add security policy and refresh tooling deps

6fbe07b fix(docs): heading anchor links now include the hash so it doesnt scoll all the way up, follows navbar logic (#5791)

4bbed1b Tighten discriminated union option typing

bbac3e5 Update PR guidance for agents

cf0dc94 Merge remote-tracking branch 'origin/main' into fix-discriminated-union-key-constraint

292c894 docs: add Zernio gold sponsor

1fc9f31 docs: document codec inversion

1373c85 docs: remove AI disclosure guidance

e20d02b chore: ignore triage notes

e58ea4d docs: test Zod Mini tab code heights

905761a docs: document preprocess input type narrowing

bf64bac chore: tighten test guidance in AGENTS.md

8ec4e73 chore: update play.ts scratch

02c2baf Make z.preprocess defer optionality to inner schema (#5929)

88015df fix(docs): drop deprecated baseUrl from tsconfig

c59d447 4.4.2

Original source