renovate-bot opened a new pull request, #9107: URL: https://github.com/apache/texera/pull/9107
> [!NOTE] > This PR body was truncated due to platform limits. This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [zod](https://zod.dev) ([source](https://redirect.github.com/colinhacks/zod)) | [`3.25.76` → `4.6.6`](https://renovatebot.com/diffs/npm/zod/3.25.76/4.6.6) |  |  | --- ### Zod can exhaust memory while validating oversized constrained collections [CVE-2023-54404](https://nvd.nist.gov/vuln/detail/CVE-2023-54404) / [GHSA-mrhx-c7xc-m3w5](https://redirect.github.com/advisories/GHSA-mrhx-c7xc-m3w5) <details> <summary>More information</summary> #### Details Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions. #### Severity - CVSS Score: 8.2 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2023-54404](https://nvd.nist.gov/vuln/detail/CVE-2023-54404) - [https://github.com/colinhacks/zod/issues/1872](https://redirect.github.com/colinhacks/zod/issues/1872) - [https://github.com/colinhacks/zod/pull/6475](https://redirect.github.com/colinhacks/zod/pull/6475) - [https://github.com/colinhacks/zod/pull/6652](https://redirect.github.com/colinhacks/zod/pull/6652) - [https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd](https://redirect.github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd) - [https://github.com/colinhacks/zod](https://redirect.github.com/colinhacks/zod) - [https://www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation](https://www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-mrhx-c7xc-m3w5) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>colinhacks/zod (zod)</summary> ### [`v4.6.6`](https://redirect.github.com/colinhacks/zod/releases/tag/v4.6.6) [Compare Source](https://redirect.github.com/colinhacks/zod/compare/v4.6.5...v4.6.6) > Six malicious commits pushed to `main` on September 21 with a compromised git credential were reverted the same day in [#​6620](https://redirect.github.com/colinhacks/zod/issues/6620) and have since been removed from the history of `main`. None were ever published to npm. The npm provenance for 4.6.6 names [`284243f`](https://redirect.github.com/colinhacks/zod/commit/284243fb), the pre-rewrite copy of [`9c21983`](https://redirect.github.com/colinhacks/zod/commit/9c219833) with identical contents. #### Commits: - [`0cd3af5`](https://redirect.github.com/colinhacks/zod/commit/0cd3af5e9f50ad11bbcd4407a46a21b8848ba574) docs: load the en locale directly in Zod Mini - [`9d5e60f`](https://redirect.github.com/colinhacks/zod/commit/9d5e60f162997b764b40d45aa02481888db50dea) docs: import locales from zod/locales, not z.locales - [`34a626f`](https://redirect.github.com/colinhacks/zod/commit/34a626f307871ecbb0123947559328dc52ed5e3e) docs: tighten the z.locales tree-shaking note - [`74304ce`](https://redirect.github.com/colinhacks/zod/commit/74304ce5b5796b5edb9a88ceb8e170b6ea3e82df) release: stage npm versions instead of publishing them ([#​6622](https://redirect.github.com/colinhacks/zod/issues/6622)) - [`b2ef983`](https://redirect.github.com/colinhacks/zod/commit/b2ef983e0711ff6517d6020b021071e2e5653efa) docs: add Code for Japan to bronze sponsors - [`8fb2faf`](https://redirect.github.com/colinhacks/zod/commit/8fb2faf0584828a6a027d8279db36f6f52784462) docs: crop the Code for Japan logo and list it first in bronze - [`bacad51`](https://redirect.github.com/colinhacks/zod/commit/bacad518c41610d654658172d325874bf0ee6290) docs: square the Code for Japan logo to match the other bronze tiles - [`c42596b`](https://redirect.github.com/colinhacks/zod/commit/c42596bd1c87e941d7241d10e012c5c196adcc10) release: hold the run on the release-approval environment until the staged versions are approved ([#​6638](https://redirect.github.com/colinhacks/zod/issues/6638)) - [`a2ba4a6`](https://redirect.github.com/colinhacks/zod/commit/a2ba4a67986a3e6b2b131be30084a2f460d9ea67) fix(types): declare record output and input as members, not base type arguments ([#​6645](https://redirect.github.com/colinhacks/zod/issues/6645)) - [`a0ebf97`](https://redirect.github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd) fix(v4): check array, set and map size bounds before parsing elements ([#​6652](https://redirect.github.com/colinhacks/zod/issues/6652)) - [`529f78d`](https://redirect.github.com/colinhacks/zod/commit/529f78dd9431b07f49647fee3aa0819b3f8b66b7) 4.6.6 - [`9c21983`](https://redirect.github.com/colinhacks/zod/commit/9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1) ci: stage at verbose so a failed OIDC token exchange says why ### [`v4.6.5`](https://redirect.github.com/colinhacks/zod/releases/tag/v4.6.5) [Compare Source](https://redirect.github.com/colinhacks/zod/compare/v4.6.4...v4.6.5) #### Commits: - [`d2b135c`](https://redirect.github.com/colinhacks/zod/commit/d2b135cfb7a3582b9eb515756b9166bcb9521f4a) docs: add the 4.6.x patch highlights to the 4.6 post - [`f1448f7`](https://redirect.github.com/colinhacks/zod/commit/f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1) docs: fold the 4.6.x patch highlights into the 4.6 post's own sections - [`de65a5c`](https://redirect.github.com/colinhacks/zod/commit/de65a5cb39ed22a507fac935788f718fa88d104f) docs: lead the properties section with the check and add a Zod Mini tab ([#​6598](https://redirect.github.com/colinhacks/zod/issues/6598)) - [`56222cd`](https://redirect.github.com/colinhacks/zod/commit/56222cd1532c07bcb91b67df529cab4c0a215330) feat(instanceof): key the .properties() shape off the instance type ([#​6600](https://redirect.github.com/colinhacks/zod/issues/6600)) - [`ca0229a`](https://redirect.github.com/colinhacks/zod/commit/ca0229a404818290e6cdcfefcd7eb2d04bcbb543) Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI ([#​6595](https://redirect.github.com/colinhacks/zod/issues/6595))" - [`cc4cd4e`](https://redirect.github.com/colinhacks/zod/commit/cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9) Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI ([#​6595](https://redirect.github.com/colinhacks/zod/issues/6595))"" - [`0f3f5ee`](https://redirect.github.com/colinhacks/zod/commit/0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee) 4.6.5 - [`59bbc03`](https://redirect.github.com/colinhacks/zod/commit/59bbc03e10c636b9eb3c393dfeb552819774ec21) chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump ### [`v4.6.4`](https://redirect.github.com/colinhacks/zod/releases/tag/v4.6.4) [Compare Source](https://redirect.github.com/colinhacks/zod/compare/v4.6.3...v4.6.4) A patch on top of [4.6.3](https://redirect.github.com/colinhacks/zod/releases/tag/v4.6.3). - [`d6bc1e30`](https://redirect.github.com/colinhacks/zod/commit/d6bc1e30) feat: add `z.currencyCode()` over a vendored ISO 4217 list, refreshed weekly by CI ([#​6595](https://redirect.github.com/colinhacks/zod/pull/6595)) - [`ad32d751`](https://redirect.github.com/colinhacks/zod/commit/ad32d751) perf: `z.url()` rejects an invalid URL with `URL.canParse()` instead of a throwing constructor, about 50x faster; fewer allocations on the validation path ([#​6588](https://redirect.github.com/colinhacks/zod/pull/6588)) - [`2bb08717`](https://redirect.github.com/colinhacks/zod/commit/2bb08717) chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump - [`f6e1701a`](https://redirect.github.com/colinhacks/zod/commit/f6e1701a) chore(deps): bump next to 15.5.25 and vite to 7.3.6 ([#​6153](https://redirect.github.com/colinhacks/zod/pull/6153)) ### [`v4.6.3`](https://redirect.github.com/colinhacks/zod/releases/tag/v4.6.3) [Compare Source](https://redirect.github.com/colinhacks/zod/compare/v4.6.2...v4.6.3) A patch on top of [4.6.2](https://redirect.github.com/colinhacks/zod/releases/tag/v4.6.2). - [`413cce9a`](https://redirect.github.com/colinhacks/zod/commit/413cce9a) fix(v4): make z.properties() a check again ([#​6594](https://redirect.github.com/colinhacks/zod/pull/6594)) — removes the standalone `z.properties()` schema from 4.6.0; `z.instanceof().properties()` and `.check(...z.properties())` are unchanged - [`75d63ee1`](https://redirect.github.com/colinhacks/zod/commit/75d63ee1) docs: show only the `.properties()` method form in the 4.6 post - [`46da9572`](https://redirect.github.com/colinhacks/zod/commit/46da9572) docs: match the error-message examples to what the parsers emit ### [`v4.6.2`](https://redirect.github.com/colinhacks/zod/releases/tag/v4.6.2) [Compare Source](https://redirect.github.com/colinhacks/zod/compare/v4.6.1...v4.6.2) A patch on top of [4.6.1](https://redirect.github.com/colinhacks/zod/releases/tag/v4.6.1). - [`9446b5cc`](https://redirect.github.com/colinhacks/zod/commit/9446b5cc) fix: preserve undefined prefault outputs and object keys ([#​6587](https://redirect.github.com/colinhacks/zod/pull/6587)) — closes [#​6585](https://redirect.github.com/colinhacks/zod/issues/6585) - [`0c483c58`](https://redirect.github.com/colinhacks/zod/commit/0c483c58) docs: the [Zod 4.6 announcement post](https://zod.dev/blog/zod-4-6) ([#​6546](https://redirect.github.com/colinhacks/zod/pull/6546)) - [`a00c3f34`](https://redirect.github.com/colinhacks/zod/commit/a00c3f34) docs: use Trigger.dev's brand-kit lockups for the platinum card ### [`v4.6.1`](https://redirect.github.com/colinhacks/zod/releases/tag/v4.6.1) [Compare Source](https://redirect.github.com/colinhacks/zod/compare/v4.6.0...v4.6.1) A patch on top of [4.6.0](https://redirect.github.com/colinhacks/zod/releases/tag/v4.6.0). - [`b12aa523`](https://redirect.github.com/colinhacks/zod/commit/b12aa523) fix: preserve unique tags with defaulted discriminators ([#​6582](https://redirect.github.com/colinhacks/zod/pull/6582)) — closes [#​6577](https://redirect.github.com/colinhacks/zod/issues/6577) - [`dd9c36fa`](https://redirect.github.com/colinhacks/zod/commit/dd9c36fa) fix(v4): defer recursive object index inference ([#​6580](https://redirect.github.com/colinhacks/zod/pull/6580)) - [`3b154992`](https://redirect.github.com/colinhacks/zod/commit/3b154992) feat(lang): add Tajik (`tg`) locale ([#​6581](https://redirect.github.com/colinhacks/zod/pull/6581)) by [@​ismoil77](https://redirect.github.com/ismoil77) - [`2efa8b80`](https://redirect.github.com/colinhacks/zod/commit/2efa8b80) ci: give the npm wait a real budget and drop the back-publish path ([#​6583](https://redirect.github.com/colinhacks/zod/pull/6583)) ### [`v4.6.0`](https://redirect.github.com/colinhacks/zod/releases/tag/v4.6.0) [Compare Source](https://redirect.github.com/colinhacks/zod/compare/v4.5.4...v4.6.0) Zod 4.6 is now available. ```sh npm install zod@latest ``` At a glance: - [`.validate()`](https://zod.dev/blog/zod-4-6#validate) — checks input validity without building a result (up to 35x faster than `.safeParse().success` on a compiled schema) - [`z.instanceof().properties()`](https://zod.dev/blog/zod-4-6#zproperties) — validates properties of an instance - [`fromJSONSchema()`](https://zod.dev/blog/zod-4-6#fromjsonschema) — enforces six validation keywords it used to ignore - [`z.iban()`](https://zod.dev/blog/zod-4-6#ziban) — electronic-format IBAN plus mod-97 checksum - [`z.withParser()`](https://zod.dev/blog/zod-4-6#zwithparser) — installs a parser generated elsewhere, for environments without `new Function` - [Faster CommonJS](https://zod.dev/blog/zod-4-6#faster-commonjs) — drops the getter on every export (\~3x faster `z.validate()` under `require`) - [Memory retention in recursive schemas](https://zod.dev/blog/zod-4-6#memory-retention-in-recursive-schemas) — releases the parsed input, fixing a 4.5 out-of-memory regression - [`@zod/mini`](https://zod.dev/packages/mini) — Zod Mini as a standalone package, versioned in lockstep with `zod` since 4.5 #### `.validate()` Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a `ZodError`, which makes rejection cheap. The return type is a guard on the schema's input type. ```ts z.validate(z.string(), "hi"); // true z.validate(z.string(), 42); // false ``` It is a method on Zod Classic schemas too. ([#​6547](https://redirect.github.com/colinhacks/zod/pull/6547)) ```ts const Player = z.object({ username: z.string(), xp: z.number(), }); if (Player.validate(data)) { data.username; // narrowed } ``` In conjunction with [`z.compile()`](https://zod.dev/compile), this can be up to 35x faster than `.safeParse().success` on invalid input.  *Time per call on invalid input, compiled with z.compile() — lower is better ([benchmark](https://redirect.github.com/colinhacks/zod/blob/main/packages/bench/validate-vs-safeparse.ts))* <details> <summary><b>Uncompiled schemas</b></summary> Without compilation it is up to 5.9x faster. The saving is the result object: `.safeParse()` allocates one with an accessor pair on every call, and `.validate()` allocates nothing.  *Time per call on invalid input, plain schemas — lower is better ([benchmark](https://redirect.github.com/colinhacks/zod/blob/main/packages/bench/validate-vs-safeparse.ts))* </details> Both charts measure the failure path. The key feature of `.validate()` is that it can *short-circuit* on the first issue it encounters, instead of aggregating a full `ZodIssue[]` array. > \[!NOTE] > Async refinements are covered by `.validateAsync()`. #### `z.properties()` A new API for validating specific properties of an object. Unlike `z.object()` it validates *in-place*, so it plays nice with class instances. ([#​6536](https://redirect.github.com/colinhacks/zod/pull/6536)) ```ts const responseLike = z.properties({ status: z.number().min(200).max(299) }); responseLike.parse(new Response("ok", { status: 200 })); // ✅ a real Response responseLike.parse({ status: 204 }); // ✅ a plain object ``` A corresponding `.properties()` method has been added to `ZodInstanceOf`. **Zod** ```ts const okResponse = z.instanceof(Response).properties({ ok: z.literal(true), status: z.number().min(200).max(299), }); ``` **Zod Mini** ```ts const okResponse = z.instanceof(Response).check(...z.properties({ ok: z.literal(true), status: z.number().check(z.minimum(200), z.maximum(299)), })); ``` The input comes back untouched, so the prototype survives and the methods still work. That is the part `z.object()` cannot do: it would hand back a plain object and the `Response` would be gone. ```ts const res = await fetch("/api/user"); okResponse.parse(res) === res; // ✅ true ``` #### `fromJSONSchema()` Six additional JSON Schema keywords are now supported in `z.fromJSONSchema()`. ([#​6535](https://redirect.github.com/colinhacks/zod/pull/6535)) - [`minProperties`](https://json-schema.org/understanding-json-schema/reference/object#size) / [`maxProperties`](https://json-schema.org/understanding-json-schema/reference/object#size) - [`uniqueItems`](https://json-schema.org/understanding-json-schema/reference/array#uniqueItems) - [`contains`](https://json-schema.org/understanding-json-schema/reference/array#contains) - [`minContains`](https://json-schema.org/understanding-json-schema/reference/array#mincontains-maxcontains) / [`maxContains`](https://json-schema.org/understanding-json-schema/reference/array#mincontains-maxcontains) ```ts const schema = z.fromJSONSchema({ type: "object", minProperties: 2, // also maxProperties }); schema.parse({ a: 1 }); // ❌ too few properties schema.parse({ a: 1, b: 2 }); // ✅ ``` Both property bounds count the input's own keys. Array uniqueness is structural, so `[{ a: 1 }, { a: 1 }]` is a duplicate. ```ts z.fromJSONSchema({ type: "array", uniqueItems: true }).parse([{ a: 1 }, { a: 1 }]); // ❌ z.fromJSONSchema({ type: "array", contains: { type: "number" }, // also minContains and maxContains minContains: 2, }).parse(["a", 2]); // ❌ only one number ``` #### `z.iban()` A new string format: an IBAN in electronic format, with a valid ISO 7064 MOD 97-10 checksum. ([#​6571](https://redirect.github.com/colinhacks/zod/pull/6571)) ```ts z.iban().parse("DE89370400440532013000"); // ✅ z.iban().parse("DE89370400440532013001"); // ❌ bad checksum ``` #### `z.withParser()` `z.compile()` builds its parser with `new Function`, which a strict Content Security Policy blocks. `z.withParser()` is that installer on its own: it takes a parser generated somewhere else, at build time or by a native compiler, and installs it under the same contract. ([#​6575](https://redirect.github.com/colinhacks/zod/pull/6575)) ```ts const Player = z.object({ username: z.string(), xp: z.number() }); // isPlayer is a type guard your build step generated const Fast = z.withParser(Player, (input) => isPlayer(input) ? { username: input.username, xp: input.xp } : z.INVALID ); ``` The supplied parser owns the whole result, so it has to return what the schema would have returned. This one rebuilds the object rather than handing back its input, because `z.object()` strips unknown keys. Returning `z.INVALID` hands the input to the runtime, which stays the only source of `ZodError`s. #### Faster CommonJS TypeScript compiles a re-export to a getter, and 252 of the 255 exports on Zod 4.5's CommonJS entrypoint were getters. V8 could not see a constant callee behind one, so it could not inline the call. The 4.6 build emits plain properties and freezes the exports object. On a compiled schema, `z.validate()` under `require` is about 3x faster than it was in Zod 4.5. ([#​6564](https://redirect.github.com/colinhacks/zod/pull/6564)) ```ts const { z } = require("zod"); const CompiledPlayer = z.compile(Player); z.validate(CompiledPlayer, data); // ~3x faster than Zod 4.5 ``` Only calls through the namespace were affected. A method call like `Player.safeParse(data)` never reads the exports object, and the ESM build is unchanged. #### Memory retention in recursive schemas A recursive schema held the input and output of its last parse until the next parse replaced it, so one long-lived schema pinned every object it had touched. Zod 4.4 released that input and Zod 4.5 did not, which surfaced as an out-of-memory failure on a repository-wide lint run. The parse state is weak throughout now: one parse of a 29k-node tree retains 2.2 MB where it used to retain 10.1 MB, and recursive parses give up about 6% for it. ([#​6572](https://redirect.github.com/colinhacks/zod/pull/6572)) ```ts const Category = z.object({ name: z.string(), get children() { return z.array(Category); }, }); ``` #### Bug fixes ##### ⚠️ Error maps run on the first read of `error` Because `safeParse()` now builds its error lazily, error maps — global, locale, and per-schema `error` — run when `result.error` is first read, not at parse time. Code that swaps `z.config()` between the parse and the read gets the newer configuration. ([#​6519](https://redirect.github.com/colinhacks/zod/pull/6519)) ```ts const result = schema.safeParse(12); z.config(z.locales.fr()); result.error.issues[0].message; // French in 4.6, English in 4.5 ``` An error map with a side effect never runs if nothing reads the error. Throwing parses are unaffected — `.parse()` builds and throws its error immediately, never takes the lazy path, and its stack still points at your call site. ##### ⚠️ `z.emoji()` rejects component-only strings Unicode's `Emoji_Component` property covers the pieces that attach to an emoji, so `z.emoji()` accepted `"123"`, `"#"`, `"*"`, and a lone zero-width joiner, variation selector, or skin tone modifier. The pattern now requires at least one pictograph, regional indicator, or keycap. ([#​6532](https://redirect.github.com/colinhacks/zod/pull/6532)) ```ts z.emoji().parse("😀"); // ✅ z.emoji().parse("1️⃣"); // ✅ the keycap is the anchor z.emoji().parse("123"); // ❌ was accepted in 4.5 ``` Flags, subdivision flags, skin-tone-modified emoji, and ZWJ sequences are unchanged. Closes [#​6515](https://redirect.github.com/colinhacks/zod/issues/6515). ##### ⚠️ Numeric enum options no longer include the reverse mappings A numeric TypeScript enum also carries its reverse mapping (`0` to `"UK"`) at runtime. The parser already ignored those keys, but `.options` was read straight off the enum object, so a three-member enum listed six values and three of them failed to parse. ([#​6542](https://redirect.github.com/colinhacks/zod/pull/6542)) ```ts enum Country { UK, Germany, France } z.enum(Country).options; // 4.5: ["UK", "Germany", "France", 0, 1, 2] — 4.6: [0, 1, 2] ``` ##### ⚠️ base64 patterns The runtime patterns for `z.base64()` and `z.base64url()` are the character sets, with length and padding enforced in code, so a multi-megabyte string can no longer overflow the regex stack through a composed schema. The JSON Schema output still emits the exact block forms, so `z.toJSONSchema()` is unchanged. ([#​6534](https://redirect.github.com/colinhacks/zod/pull/6534), [#​6527](https://redirect.github.com/colinhacks/zod/pull/6527)) Composing `z.base64()` into a template literal now checks the alphabet but not the length, which is how `z.creditCard()` already behaves there. The exported `z.regexes.base64url` is now the length-aware form, so it overflows on a multi-megabyte input the same way `z.regexes.base64` does. ##### ⚠️ The email pattern dropped its lookaheads `z.email()` opened with two lookaheads, and the second scanned the whole string before the match began. Both are gone, and the rule they enforced — no empty segment in the local part — is expressed structurally instead, so `z.email()` accepts and rejects exactly what it did before. Valid addresses validate roughly twice as fast. ([#​6573](https://redirect.github.com/colinhacks/zod/pull/6573)) The pattern string is user-visible, and every copy of it changes: `z.regexes.email`, which has no capture groups now — neither of the two it used to expose held a usable value; `issue.pattern` on a failed `z.email()`; and the `pattern` that `z.toJSONSchema()` emits, which no longer carries a lookahead, so validators outside ECMAScript can compile it. Composing an email into a template literal also stops applying its no-consecutive-dots rule to the rest of the string. ```ts z.templateLiteral([z.email(), "|", z.string()]).parse("[email protected]|a..b"); // 4.5: ❌ — the lookahead reached past the email segment — 4.6: ✅ ``` ##### ⚠️ Chained checks no longer overwrite each other in JSON Schema Each check used to write its own bounds into the schema as it attached, in chain order, so a format check applied after `.min()` and `.max()` replaced the tighter values with its own range. The converter folds the checks as a conjunction now. The order they are chained in no longer changes the output. ([#​6554](https://redirect.github.com/colinhacks/zod/pull/6554), [#​6553](https://redirect.github.com/colinhacks/zod/pull/6553)) ```ts z.toJSONSchema(z.number().min(0).max(23).int()); // 4.5: { minimum: -9007199254740991, maximum: 9007199254740991 } // 4.6: { minimum: 0, maximum: 23 } ``` Runtime parsing enforced the bounds in every version. Only the emitted schema was wrong. The same fold fixes two more cases: a repeated `multipleOf` kept the first divisor and dropped the rest, so `z.number().multipleOf(2).multipleOf(3)` emitted a schema that accepts 4, and `z.string().min(8).length(5)` emitted `minLength: 5`, widening a bound the runtime still rejected. Closes [#​6550](https://redirect.github.com/colinhacks/zod/issues/6550). ##### ⚠️ Metadata members materialize on first read Eight members on a Zod Classic schema — `.format`, `.minLength`, `.maxLength`, `.minValue`, `.maxValue`, `.isInt`, `.minDate` and `.maxDate` — are computed from the checks now instead of being written onto every instance at construction. Each one is a prototype getter that becomes an own property on first read. ([#​6554](https://redirect.github.com/colinhacks/zod/pull/6554)) ```ts const s = z.string().min(3).max(9); Object.keys(s); // 4.5: ["def", "type", "format", "minLength", "maxLength"] — 4.6: ["def", "type"] s.minLength; // 3 in both Object.keys(s); // 4.6: ["def", "type", "minLength"] ``` A key is absent until something reads it, and `Object.assign({}, schema)` copies only the members that have been read. Deleting one restores the getter, and the next read recomputes it. The values can move too, because the getters read the same fold the JSON Schema converter does. An order-dependent chain reports the tighter bound now instead of whichever check wrote last. ```ts z.string().min(8).length(5).minLength; // 4.5: 5 — 4.6: 8 ``` #### Commits Zod 4.6 rolls up 72 commits. - [`661673ae`](https://redirect.github.com/colinhacks/zod/commit/661673ae) docs: make the 9thCO logo visible on the light theme by [@​colinhacks](https://redirect.github.com/colinhacks) - [`6de10dce`](https://redirect.github.com/colinhacks/zod/commit/6de10dce) docs: reconcile the sponsor listings against every active sponsorship ([#​6579](https://redirect.github.com/colinhacks/zod/pull/6579)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`213ee75d`](https://redirect.github.com/colinhacks/zod/commit/213ee75d) feat(compile): add z.withParser for externally generated parsers ([#​6575](https://redirect.github.com/colinhacks/zod/pull/6575)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`f9465d4e`](https://redirect.github.com/colinhacks/zod/commit/f9465d4e) docs: reconcile the sponsor listings with active sponsorships ([#​6576](https://redirect.github.com/colinhacks/zod/pull/6576)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`f7fd5548`](https://redirect.github.com/colinhacks/zod/commit/f7fd5548) perf(v4): drop the lookaheads from the email regex ([#​6573](https://redirect.github.com/colinhacks/zod/pull/6573)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`36f17960`](https://redirect.github.com/colinhacks/zod/commit/36f17960) fix(v4): stop the memoizer from pinning a finished parse ([#​6572](https://redirect.github.com/colinhacks/zod/pull/6572)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`22bed613`](https://redirect.github.com/colinhacks/zod/commit/22bed613) feat(v4): add z.iban() string format with mod-97 checksum ([#​6571](https://redirect.github.com/colinhacks/zod/pull/6571)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`c5b9bcb3`](https://redirect.github.com/colinhacks/zod/commit/c5b9bcb3) bench: measure what a runtime island's leaked indent cost the generated source by [@​colinhacks](https://redirect.github.com/colinhacks) - [`e54716cb`](https://redirect.github.com/colinhacks/zod/commit/e54716cb) docs(ecosystem): add [@​apical-ts/craft](https://redirect.github.com/apical-ts/craft) ([#​5946](https://redirect.github.com/colinhacks/zod/pull/5946)) by [@​gunzip](https://redirect.github.com/gunzip) - [`dcbcf052`](https://redirect.github.com/colinhacks/zod/commit/dcbcf052) fix(compile): unwind the doc indent when a child generator throws ([#​6570](https://redirect.github.com/colinhacks/zod/pull/6570)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`277613a6`](https://redirect.github.com/colinhacks/zod/commit/277613a6) docs: move the release procedure to the maintainer-local notes by [@​colinhacks](https://redirect.github.com/colinhacks) - [`eb1c1089`](https://redirect.github.com/colinhacks/zod/commit/eb1c1089) ci: release only on workflow_dispatch behind the npm environment ([#​6569](https://redirect.github.com/colinhacks/zod/pull/6569)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`741981ff`](https://redirect.github.com/colinhacks/zod/commit/741981ff) perf(compile): for-in record walk, cheaper issue finalization, and a generative compile differential ([#​6567](https://redirect.github.com/colinhacks/zod/pull/6567)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`804e0f52`](https://redirect.github.com/colinhacks/zod/commit/804e0f52) perf: seal the CommonJS exports so require("zod") stops reading through a getter ([#​6564](https://redirect.github.com/colinhacks/zod/pull/6564)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`6f048367`](https://redirect.github.com/colinhacks/zod/commit/6f048367) fix(v4): derive JSON Schema constraints by folding checks in the converter ([#​6554](https://redirect.github.com/colinhacks/zod/pull/6554)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`e4d67f3e`](https://redirect.github.com/colinhacks/zod/commit/e4d67f3e) Migrate development and CI to Nub ([#​6562](https://redirect.github.com/colinhacks/zod/pull/6562)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`7a002366`](https://redirect.github.com/colinhacks/zod/commit/7a002366) fix(v4): don't let format checks overwrite tighter min/max bounds ([#​6553](https://redirect.github.com/colinhacks/zod/pull/6553)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`5489a532`](https://redirect.github.com/colinhacks/zod/commit/5489a532) test(v4): pin the check-chain case that keeps compiled validate's definite guard ([#​6551](https://redirect.github.com/colinhacks/zod/pull/6551)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`e7604717`](https://redirect.github.com/colinhacks/zod/commit/e7604717) docs: attribute the compiled failure cost to the fallback, not the double pass by [@​colinhacks](https://redirect.github.com/colinhacks) - [`764ac59f`](https://redirect.github.com/colinhacks/zod/commit/764ac59f) perf(v4): settle z.validate on the first failure in parse order ([#​6544](https://redirect.github.com/colinhacks/zod/pull/6544)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`07917f4c`](https://redirect.github.com/colinhacks/zod/commit/07917f4c) test(v4): pin the lazy safeParse error's stack behavior ([#​6548](https://redirect.github.com/colinhacks/zod/pull/6548)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`62e6624b`](https://redirect.github.com/colinhacks/zod/commit/62e6624b) feat(v4): add .validate() and .validateAsync() to Zod Classic ([#​6547](https://redirect.github.com/colinhacks/zod/pull/6547)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`cafbee47`](https://redirect.github.com/colinhacks/zod/commit/cafbee47) fix(v4): parse recursive schemas built by a factory ([#​6530](https://redirect.github.com/colinhacks/zod/pull/6530)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`4d730882`](https://redirect.github.com/colinhacks/zod/commit/4d730882) Release the parsed input once a failing safeParse builds its error ([#​6543](https://redirect.github.com/colinhacks/zod/pull/6543)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`90269c60`](https://redirect.github.com/colinhacks/zod/commit/90269c60) Keep a numeric TS enum's reverse-mapping keys out of `.options` ([#​6542](https://redirect.github.com/colinhacks/zod/pull/6542)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`18e71c71`](https://redirect.github.com/colinhacks/zod/commit/18e71c71) Rename the JSON Schema `process` helper so bundler polyfills cannot collide ([#​6541](https://redirect.github.com/colinhacks/zod/pull/6541)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`68aca3dc`](https://redirect.github.com/colinhacks/zod/commit/68aca3dc) docs: cover the 4.5 API surface that never made it into the reference by [@​colinhacks](https://redirect.github.com/colinhacks) - [`eca96871`](https://redirect.github.com/colinhacks/zod/commit/eca96871) fix(v4): enforce the six JSON Schema keywords fromJSONSchema silently dropped ([#​6535](https://redirect.github.com/colinhacks/zod/pull/6535)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`81ded991`](https://redirect.github.com/colinhacks/zod/commit/81ded991) perf: answer z.validate from the compiled fast path on invalid input ([#​6538](https://redirect.github.com/colinhacks/zod/pull/6538)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`51caf010`](https://redirect.github.com/colinhacks/zod/commit/51caf010) refactor: collapse cachedInternal back into cached ([#​6540](https://redirect.github.com/colinhacks/zod/pull/6540)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`abfb3897`](https://redirect.github.com/colinhacks/zod/commit/abfb3897) feat(v4): make z.properties() a schema, and give z.instanceof() a .properties() method ([#​6536](https://redirect.github.com/colinhacks/zod/pull/6536)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`69f2a7ff`](https://redirect.github.com/colinhacks/zod/commit/69f2a7ff) Collapse toZod's normalizer and move its docs to the API reference ([#​6539](https://redirect.github.com/colinhacks/zod/pull/6539)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`bf990216`](https://redirect.github.com/colinhacks/zod/commit/bf990216) perf: move util.cached's accessor to a prototype ([#​6537](https://redirect.github.com/colinhacks/zod/pull/6537)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`bec73bea`](https://redirect.github.com/colinhacks/zod/commit/bec73bea) perf(v4): build the safeParse error on first read ([#​6519](https://redirect.github.com/colinhacks/zod/pull/6519)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`07c43e2a`](https://redirect.github.com/colinhacks/zod/commit/07c43e2a) Keep the runtime base64 regexes linear so composed parse paths cannot overflow ([#​6534](https://redirect.github.com/colinhacks/zod/pull/6534)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`bc1157e7`](https://redirect.github.com/colinhacks/zod/commit/bc1157e7) docs: use a Response example for z.properties() by [@​colinhacks](https://redirect.github.com/colinhacks) - [`2ec972ec`](https://redirect.github.com/colinhacks/zod/commit/2ec972ec) refactor: collapse toZod's enum leaf normalizer to a dummy union ([#​6533](https://redirect.github.com/colinhacks/zod/pull/6533)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`68a609ac`](https://redirect.github.com/colinhacks/zod/commit/68a609ac) Widen literal inputs in property check types ([#​6520](https://redirect.github.com/colinhacks/zod/pull/6520)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`0227e53d`](https://redirect.github.com/colinhacks/zod/commit/0227e53d) docs: bump the star pill's GitHub mark to 20px by [@​colinhacks](https://redirect.github.com/colinhacks) - [`84dd3b0f`](https://redirect.github.com/colinhacks/zod/commit/84dd3b0f) perf: build literal and enum pattern regexes lazily ([#​6531](https://redirect.github.com/colinhacks/zod/pull/6531)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`f83ab511`](https://redirect.github.com/colinhacks/zod/commit/f83ab511) fix(v4): reject component-only strings from z.emoji() ([#​6532](https://redirect.github.com/colinhacks/zod/pull/6532)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`74f9a6d3`](https://redirect.github.com/colinhacks/zod/commit/74f9a6d3) docs: drop the toZod enum block from basics and pin the page's curation rule in a comment by [@​colinhacks](https://redirect.github.com/colinhacks) - [`a2a019a5`](https://redirect.github.com/colinhacks/zod/commit/a2a019a5) Accept enum-typed targets in z.toZod ([#​6528](https://redirect.github.com/colinhacks/zod/pull/6528)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`319f47f4`](https://redirect.github.com/colinhacks/zod/commit/319f47f4) Emit a length-aware base64url pattern in toJSONSchema ([#​6527](https://redirect.github.com/colinhacks/zod/pull/6527)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`08ba069e`](https://redirect.github.com/colinhacks/zod/commit/08ba069e) perf(v4): read Luhn digits with charCodeAt instead of string indexing ([#​6529](https://redirect.github.com/colinhacks/zod/pull/6529)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`1ec6b7c5`](https://redirect.github.com/colinhacks/zod/commit/1ec6b7c5) docs: add an RSS feed to the blog at /blog/rss.xml by [@​colinhacks](https://redirect.github.com/colinhacks) - [`b801439b`](https://redirect.github.com/colinhacks/zod/commit/b801439b) bench: add typebox (compiled and dynamic) to the moltar cross-library harness by [@​colinhacks](https://redirect.github.com/colinhacks) - [`7ae49d64`](https://redirect.github.com/colinhacks/zod/commit/7ae49d64) docs: drop the circle around the star pill's GitHub mark and center it on the pill's arc by [@​colinhacks](https://redirect.github.com/colinhacks) - [`93f3ab32`](https://redirect.github.com/colinhacks/zod/commit/93f3ab32) docs: replace the blog navbar's GitHub icon with a star-count pill by [@​colinhacks](https://redirect.github.com/colinhacks) - [`fb2fedfd`](https://redirect.github.com/colinhacks/zod/commit/fb2fedfd) docs: tighten the memory chart callout, pad the canvas, say "less memory" by [@​colinhacks](https://redirect.github.com/colinhacks) - [`ff56a551`](https://redirect.github.com/colinhacks/zod/commit/ff56a551) docs: center the memory chart callout labels and pad them off the number by [@​colinhacks](https://redirect.github.com/colinhacks) - [`8cd1250f`](https://redirect.github.com/colinhacks/zod/commit/8cd1250f) docs: center the memory chart callout labels by [@​colinhacks](https://redirect.github.com/colinhacks) - [`3195ed01`](https://redirect.github.com/colinhacks/zod/commit/3195ed01) docs: label the memory chart like the compile chart by [@​colinhacks](https://redirect.github.com/colinhacks) - [`a6b49390`](https://redirect.github.com/colinhacks/zod/commit/a6b49390) Mark the compile internals [@​internal](https://redirect.github.com/internal) instead of hiding them ([#​6518](https://redirect.github.com/colinhacks/zod/pull/6518)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`40b4d0b3`](https://redirect.github.com/colinhacks/zod/commit/40b4d0b3) fix(ci): read zod's latest version with npm view when picking the backfill dist-tag by [@​colinhacks](https://redirect.github.com/colinhacks) - [`5ff95665`](https://redirect.github.com/colinhacks/zod/commit/5ff95665) Stop re-exporting the compile internals from zod/v4/core ([#​6511](https://redirect.github.com/colinhacks/zod/pull/6511)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`f412178d`](https://redirect.github.com/colinhacks/zod/commit/f412178d) ci: publish [@​zod/mini](https://redirect.github.com/zod/mini) to JSR in lockstep with npm ([#​6510](https://redirect.github.com/colinhacks/zod/pull/6510)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`f3e7c72e`](https://redirect.github.com/colinhacks/zod/commit/f3e7c72e) fix(docs): render the docs 404 page inside the (doc) layout once by [@​colinhacks](https://redirect.github.com/colinhacks) - [`f3cb3644`](https://redirect.github.com/colinhacks/zod/commit/f3cb3644) docs: surface the blog on the home page and in the sidebar by [@​colinhacks](https://redirect.github.com/colinhacks) - [`cd4f9a67`](https://redirect.github.com/colinhacks/zod/commit/cd4f9a67) perf(v4): report Standard Schema issues without constructing a ZodError ([#​6509](https://redirect.github.com/colinhacks/zod/pull/6509)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`43b9bfc5`](https://redirect.github.com/colinhacks/zod/commit/43b9bfc5) docs: drop the bound-methods section from the Zod package page by [@​colinhacks](https://redirect.github.com/colinhacks) - [`70eb2c07`](https://redirect.github.com/colinhacks/zod/commit/70eb2c07) docs: drop the traits section and the compilation feature bullet by [@​colinhacks](https://redirect.github.com/colinhacks) - [`1c0bce0c`](https://redirect.github.com/colinhacks/zod/commit/1c0bce0c) docs: bring the 4.5 charts and worked examples into the docs pages by [@​colinhacks](https://redirect.github.com/colinhacks) - [`a0898b4b`](https://redirect.github.com/colinhacks/zod/commit/a0898b4b) ci: wait hours for npm to serve a publish, not ten minutes ([#​6502](https://redirect.github.com/colinhacks/zod/pull/6502)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`c46eeff0`](https://redirect.github.com/colinhacks/zod/commit/c46eeff0) chore: narrow blanket biome-ignore comments ([#​6504](https://redirect.github.com/colinhacks/zod/pull/6504)) by [@​pullfrog\[bot\]](https://redirect.github.com/pullfrog\[bot]) - [`c7ec94d3`](https://redirect.github.com/colinhacks/zod/commit/c7ec94d3) ci: check zod and [@​zod/mini](https://redirect.github.com/zod/mini) lockstep on npm after every publish ([#​6507](https://redirect.github.com/colinhacks/zod/pull/6507)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`81065739`](https://redirect.github.com/colinhacks/zod/commit/81065739) chore(docs): build with Turbopack by [@​colinhacks](https://redirect.github.com/colinhacks) - [`abd41adb`](https://redirect.github.com/colinhacks/zod/commit/abd41adb) docs(wiki): move plans and comparisons into a gitignored internal/ ([#​6506](https://redirect.github.com/colinhacks/zod/pull/6506)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`2956c4c2`](https://redirect.github.com/colinhacks/zod/commit/2956c4c2) chore(mini): sync [@​zod/mini](https://redirect.github.com/zod/mini) to 4.5.4 by [@​colinhacks](https://redirect.github.com/colinhacks) - [`8ce9e8d5`](https://redirect.github.com/colinhacks/zod/commit/8ce9e8d5) feat(mini): publish Zod Mini as the standalone [@​zod/mini](https://redirect.github.com/zod/mini) package ([#​6491](https://redirect.github.com/colinhacks/zod/pull/6491)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`93186cab`](https://redirect.github.com/colinhacks/zod/commit/93186cab) docs(wiki): drop the zod-compiler benchmark ([#​6505](https://redirect.github.com/colinhacks/zod/pull/6505)) by [@​colinhacks](https://redirect.github.com/colinhacks) - [`908c9e17`](https://redirect.github.com/colinhacks/zod/commit/908c9e17) fix(docs): retry the GitHub stars fetch and log the real status by [@​colinhacks](https://redirect.github.com/colinhacks) ### [`v4.5.4`](https://redirect.github.com/colinhacks/zod/releases/tag/v4.5.4) [Compare Source](https://redirect.github.com/colinhacks/zod/compare/v4.5.3...v4.5.4) #### Commits: - [`84e416f`](https://redirect.github.com/colinhacks/zod/commit/84e416fbf4740527bbc8f319634f4e1b065bb42c) fix(v4): stop the cycle walk from firing a default factory ([#​6500](https://redirect.github.com/colinhacks/zod/issues/6500)) - [`e8e206f`](https://redirect.github.com/colinhacks/zod/commit/e8e206fa33ac5fe7ce20a2beb12d57b1cb3df653) 4.5.4 ### [`v4.5.3`](https://redirect.github.com/colinhacks/zod/releases/tag/v4.5.3) [Compare Source](https://redirect.github.com/colinhacks/zod/compare/v4.5.2...v4.5.3) #### Commits: - [`e6b6ab3`](https://redirect.github.com/colinhacks/zod/commit/e6b6ab347675cd2bd54b1bdbed16f98c59be82a9) docs(blog): widen the z.compile example to a 20-property schema - [`87d6464`](https://redirect.github.com/colinhacks/zod/commit/87d6464418582bb96fc665a01f852ca6da324ad0) fix(docs): drop the OG description when the title wraps past two lines - [`99fce39`](https://redirect.github.com/colinhacks/zod/commit/99fce394a026823e602b9c30d8d5d9f5f1932ce7) bench(v4): z.compile() against zod-compiler ([#​6499](https://redirect.github.com/colinhacks/zod/issues/6499)) - [`e3a695b`](https://redirect.github.com/colinhacks/zod/commit/e3a695b6bf3f0d591ea682816e3cdaea04b0f967) docs(v4): record the email regex and container output-shape findings under Open - [`7e24a24`](https://redirect.github.com/colinhacks/zod/commit/7e24a24288183ce02554f1ded7775d0650a7b7e6) docs(blog): drop the reading time and put a GitHub link in the navbar - [`eab51ff`](https://redirect.github.com/colinhacks/zod/commit/eab51ff3592b2d11d863f4ee4d5452f31a3de1b6) fix(v4): emit record numeric keys as strings in toJSONSchema ([#​6497](https://redirect.github.com/colinhacks/zod/issues/6497)) ### [`v4.5.2`](https://redirect.github.com/colinhacks/zod/releases/tag/v4.5.2) [Compare Source](https://redirect.github.com/colinhacks/zod/compare/v4.5.1...v4.5.2) #### Commits: - [`a354314`](https://redirect.github.com/colinhacks/zod/commit/a354314ac04fdd5484aa62dd5c3a4b553211a0e4) fix(docs): keep blog posts out of the docs collection ([#​6484](https://redirect.github.com/colinhacks/zod/issues/6484)) - [`d378c42`](https://redirect.github.com/colinhacks/zod/commit/d378c42aff6869f0929058a7923cd775880f5c4c) ci: drop canary publishing from the release workflow ([#​6487](https://redirect.github.com/colinhacks/zod/issues/6487)) - [`212b941`](https://redirect.github.com/colinhacks/zod/commit/212b941791e7faae078e17645eb612824fd8f79a) fix(v4): let a prototype method getter answer a bare call so vi.spyOn works ([#​6488](https://redirect.github.com/colinhacks/zod/issues/6488)) - [`e7576f5`](https://redirect.github.com/colinhacks/zod/commit/e7576f542a7bc7ef3cc5eeec237714fd0e6b6e98) docs(blog): let the page show through the navbar in dark mode ([#​6489](https://redirect.github.com/colinhacks/zod/issues/6489)) - [`fedb06f`](https://redirect.github.com/colinhacks/zod/commit/fedb06fafe33a66ce0b5c236ad2557e0a5a170fe) fix(docs): match the blog TOC hover bar to the 2px active indicator - [`6c932fc`](https://redirect.github.com/colinhacks/zod/commit/6c932fcb2eea6eb671710ea058ca9fdc382ada89) chore: bump devcontainer image to Node 24 ([#​6470](https://redirect.github.com/colinhacks/zod/issues/6470)) - [`6635d9d`](https://redirect.github.com/colinhacks/zod/commit/6635d9dd367a664109de83c021995821f48efa29) docs(blog): soften the "method memoization" attribution - [`019ae29`](https://redirect.github.com/colinhacks/zod/commit/019ae299cc75daa132bf1acf59086a520abf6b85) fix(docs): drop ISR on the docs route so the home page hydrates - [`652bb43`](https://redirect.github.com/colinhacks/zod/commit/652bb438aa4c626c1cd7948c6849c4691239fca7) chore(docs): drop the scroll log from the route-change scroller - [`571c8e8`](https://redirect.github.com/colinhacks/zod/commit/571c8e8a3d73b4305f4abfdd6977773cc12f2bf5) fix(docs): render blog tabs with the stock fumadocs tab card - [`9a193aa`](https://redirect.github.com/colinhacks/zod/commit/9a193aa24b4efa3b315b91d4c56c8bc385b8513f) 4.5.2 ### [`v4.5.1`](https://redirect.github.com/colinhacks/zod/releases/tag/v4.5.1) [Compare Source](https://redirect.github.com/colinhacks/zod/compare/v4.5.0...v4.5.1) #### Commits: - [`2e862db`](https://redirect.github.com/colinhacks/zod/commit/2e862dbf89da2835e5206a8fd3d3be61afe3cf7f) ci: gate the GitHub release and JSR publish on the version being live on npm - [`8e03380`](https://redirect.github.com/colinhacks/zod/commit/8e03380510db36fa6fda979fc78a375fdea8021c) 4.5.1 ### [`v4.5.0`](https://redirect.github.com/colinhacks/zod/releases/tag/v4.5.0) [Compare Source](https://redirect.github.com/colinhacks/zod/compare/v4.4.3...v4.5.0) Zod 4.5 is now available. ```sh npm install zod@latest ``` At a glance: - [`z.compile()`](#zcompile) — the flagship feature of Zod 4.5 - [`z.creditCard()`](#zcreditcard) — 12–19 digits plus Luhn checksum - [`z.properties()`](#zproperties) — the multi-property counterpart to `z.property()` - [`z.deepPartial()`](#zdeeppartial)/[`.exactPartial()`](#exactpartial) - [`z.validate(): boolean`](#zvalidate) — a fast-path to verify input validity without a full parse (up to 16x faster on invalid data) - [9x reduction in memory footprint](#​9x-reduction-in-schema-memory-footprint) - [New locales](https://zod.dev/error-customization#locales): Bengali (`bn`), Central Kurdish (`ckb`), Hindi (`hi`), Kannada (`kn`), Norwegian Nynorsk (`nn`), Brazilian Portuguese (`pt-BR`), Slovak (`sk`), Turkmen (`tk`) #### `z.compile()` You can now pre-compile any Zod schema using `z.compile(schema)`. This dramatically speeds up parsing performance. ```ts import * as z from "zod"; const Player = z.object({ username: z.string(), bio: z.string(), xp: z.number(), // ...20 more properties... }); const CompiledPlayer = z.compile(Player); ``` A compiled schema can be used *exactly* like an uncompiled one. There are no special rules around compiled schemas. They're just faster. ```ts Player.parse({ ... }); CompiledPlayer.parse({ ... }); // ~9x faster ``` On objects, arrays, and unions, this speeds up parsing by a factor of \~3–9. More complex schemas stand to benefit more than simpler ones. <picture> <source media="(prefers-color-scheme: dark)" srcset="https://zod.dev/blog/compile-speedup-dark.svg";> <img alt="Time per parse on a shared nanosecond axis, standard parser as a gray bar with the compiled time as a blue bar inside it: an array of 10 objects 377 ns to 68 ns (5.5x), a 20-key object 301 ns to 38 ns (7.8x), an array of 10 strings 241 ns to 33 ns (7.3x), a union of 3 objects 190 ns to 36 ns (5.3x), a 3-element tuple 119 ns to 33 ns (3.6x), a 5-key strict object 117 ns to 32 ns (3.7x), a discriminated union 92 ns to 27 ns (3.4x), a 5-key object 76 ns to 28 ns (2.8x); up to 7.8x faster when compiled" src="https://zod.dev/blog/compile-speedup-light.svg";> </picture> *Time per parse by schema type, standard parser vs compiled — lower is better ([benchmark](https://redirect.github.com/colinhacks/zod/blob/main/packages/bench/compile-matrix.ts))* Below are the Moltar benchmark results comparing Zod (compiled and uncompiled) against the [**Moltar ParseSafe**](https://redirect.github.com/moltar/typescript-runtime-type-benchmarks) bench. <picture> <source media="(prefers-color-scheme: dark)" srcset="https://zod.dev/blog/moltar-dark.svg";> <img alt="Bar chart of operations per second on the moltar benchmark fixture, parseSafe category: Zod 4 compiled 47.5M, typia 45.3M, Zod 4 11.6M, valibot 1.8M, effect 1.7M, Zod 3 1.2M, arktype 152k, yup 121k" src="https://zod.dev/blog/moltar-light.svg";> </picture> *Throughput on the moltar benchmark fixture (parseSafe: returns a new object with unknown keys stripped) — higher is better ([benchmark](https://redirect.github.com/moltar/typescript-runtime-type-benchmarks/pull/2329))* And the equivalent results for the Moltar AssertLoose bench. Tested against the new `z.validate(schema, input)` function (detailed later in the post). <picture> <source media="(prefers-color-scheme: dark)" srcset="https://zod.dev/blog/moltar-assertLoose-dark.svg";> <img alt="Bar chart of operations per second on the moltar benchmark fixture, assertLoose category: typia 74.9M, arktype 66.2M, Zod 4 compiled 60.6M, Zod 4 6.5M, valibot 1.9M, effect 1.7M, Zod 3 1.2M, yup 124k" src="https://zod.dev/blog/moltar-assertLoose-light.svg";> </picture> *Throughput on the moltar benchmark fixture (assertLoose: returns a boolean, unknown keys allowed) — higher is better ([benchmark](https://redirect.github.com/moltar/typescript-runtime-type-benchmarks/pull/2329))* Zod's entire test suite runs twice—once normally and again with auto-compilation enabled globally—to ensure perfect fidelity. <details> <summary>How it works</summary> Under the hood, `z.compile()` walks the entire schema once and produces a hyperoptimized snippet of flat, loop-free JavaScript that can validate inputs far faster than a standard runtime validator. This snippet can be executed via `new Function()` (effectively a more powerful `eval`) to serve as a fast-path validator. Schemas use this to "fast check" validity, falling back to the regular runtime logic on validation failure to provide granular error information. Take this simple `Point` schema: ```ts const Point = z.object({ x: z.number(), y: z.number() }); ``` Here is the generated snippet for it: ```ts const isPoint = new Function("input", ` if (typeof input !== "object" || input === null) return false; if (typeof input.x !== "number") return false; if (typeof input.y !== "number") return false; return true; `); isPoint({ x: 1, y: 2 }); // true isPoint({ x: "1" }); // false ``` For the large majority of inputs, the generated function validates the data with the fastest logic JavaScript can express: straight-line `typeof` checks and property reads, with no interpreter in between. When it can't handle an input, Zod falls back to the standard parser. This is the function Zod generates for the `Player` schema above: ```js if (typeof input !== "object" || input === null || Array.isArray(input)) return INVALID; const v0 = input["username"]; if (typeof v0 !== "string") return INVALID; const v1 = input["bio"]; if (typeof v1 !== "string") return INVALID; const v2 = input["xp"]; if (typeof v2 !== "number" || !Number.isFinite(v2)) return INVALID; const v3 = { "username": v0, "bio": v1, "xp": v2 }; return v3; ``` Armed with the power of `new Function()`, this happens in-process at runtime. There is no need to integrate with your build system. > The compiled schema is purely additive on top of the existing schema. It tacks on the pre-compiled fast path for checking valid inputs. When invalid data is detected, it returns the `INVALID` symbol to signal that parsing should fall back to the uncompiled parser. This structurally prevents subtle deviations in error reporting between compiled and uncompiled variants. </details> ##### `import "zod/compile"` To compile every schema in an application, import `zod/compile` once at the top of your entry point. Every schema constructed after that import is *automatically compiled* the first time it's used to parse data. ```ts import "zod/compile"; // must come before modules that define schemas import * as z from "zod"; const schema = z.object({ name: z.string() }); schema.parse({ name: "ok" }); // compiled on first parse ``` It also works as a Node.js CLI flag, which guarantees it runs before any module defines a schema: ```sh node --import zod/compile app.js ``` Or set `preload` in [`bunfig.toml`](https://bun.com/docs/runtime/bunfig#preload) or [`nub.jsonc`](https://nubjs.com/docs/config# > [!IMPORTANT] > ✂ PR body was truncated to here. </details> --- ### Configuration 📅 **Schedule**: (in timezone Etc/UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/apache/texera). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjE4MC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJyZWxlYXNlL3YxLjIiLCJzZWN1cml0eSJdfQ==--> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
![https://zod.dev/blog/compile-speedup-dark.svg"](https://zod.dev/blog/compile-speedup-dark.svg"){kind=link}
![https://zod.dev/blog/compile-speedup-light.svg"](https://zod.dev/blog/compile-speedup-light.svg"){kind=link}
![https://zod.dev/blog/moltar-dark.svg"](https://zod.dev/blog/moltar-dark.svg"){kind=link}
![https://zod.dev/blog/moltar-light.svg"](https://zod.dev/blog/moltar-light.svg"){kind=link}
![https://zod.dev/blog/moltar-assertLoose-dark.svg"](https://zod.dev/blog/moltar-assertLoose-dark.svg"){kind=link}
![https://zod.dev/blog/moltar-assertLoose-light.svg"](https://zod.dev/blog/moltar-assertLoose-light.svg"){kind=link}