fix(deps): update all minor dependencies #43
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/all-minor-dependencies"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
1.7.0→1.8.00.17.4→0.18.00.3.0→0.3.14.3.2→4.4.04.3.2→4.4.022.20.1→22.20.24.13.2→4.13.724.20.0-slim→24.21.0-slim24.20.0-slim→24.21.0-slim0.63.0→0.67.04.18.0→4.21.00.22.14→0.23.04.3.2→4.4.04.23.12→4.23.134.4.3→4.6.2Release Notes
mui/base-ui (@base-ui/react)
v1.8.0Compare Source
Sep 4, 2026
General changes
Alert Dialog
Autocomplete
readOnly(#5541) by @vikusczaria-orientationto the role owners (#5551) by @gonzoblascoAvatar
keepMountedprop to<Avatar.Image>(#5536) by @atomiksCheckbox
Checkbox Group
Combobox
data-readonlyto<Combobox.Trigger>(#5418) by @sai6855createItemscollection API (#5326) by @atomiksreadOnly(#5541) by @vikusczaria-orientationto the role owners (#5551) by @gonzoblascoObject.prototype(#5518) by @XionWCFMDialog
Drawer
Field
Form
clearErrorsdropping updates when multiple fields change at once (#5446) by @sai6855Menu
aria-orientationto the role owners (#5551) by @gonzoblascoMenubar
aria-required-children(#5058) by @michaldudakNavigation Menu
<NavigationMenu.Trigger>(#5521) by @sai6855Number Field
Popover
Scroll Area
Select
aria-orientationto the role owners (#5551) by @gonzoblasco<Select.Positioner>(#5469) by @sai6855readOnly(#5531) by @vikusczObject.prototype(#5518) by @XionWCFMSlider
Switch
Tabs
Toast
Tooltip
All contributors of this release in alphabetical order: @alex-js-ltd, @atomiks, @azeng4499, @chuganzy, @edwardhorsey, @flaviendelangle, @gilsmt, @gonzoblasco, @jjenzz, @marwenilo, @michaldudak, @radist2s, @sai6855, @vikuscz, @wanxiankai, @XionWCFM
tursodatabase/libsql-client-ts (@libsql/client)
v0.18.0Compare Source
shadcn-ui/ui (@shadcn/react)
v0.3.1Compare Source
Patch Changes
503a3a57aec9a3817e37f90aa0817b1fabd284d0Thanks @shadcn! - Setdata-pending-scrollon the MessageScroller root and viewport untildefaultScrollPosition("end"or"last-anchor") is applied, so the viewport can be hidden and a server-rendered transcript does not flash the top of the thread on reload.tsparticles/tsparticles (@tsparticles/engine)
v4.4.0Compare Source
Bug Fixes
4.3.3 (2026-07-23)
Bug Fixes
4.3.2 (2026-07-10)
Bug Fixes
4.3.1 (2026-07-01)
Note: Version bump only for package @tsparticles/engine
tsparticles/tsparticles (@tsparticles/react)
v4.4.0Compare Source
Bug Fixes
4.3.3 (2026-07-23)
Note: Version bump only for package @tsparticles/react
4.3.2 (2026-07-10)
Bug Fixes
4.3.1 (2026-07-01)
Note: Version bump only for package @tsparticles/react
honojs/hono (hono)
v4.13.7Compare Source
Security fixes
This release includes a fix for the following security issue:
hono/jsxrenders plain strings unescaped in boundary components, leading to XSSAffects:
Suspense,ErrorBoundary, andContext.Providerinhono/jsx, andrenderToString()/renderToReadableStream()inhono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child orfallbackof these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqvUsers who render untrusted strings inside
Suspense,ErrorBoundary, orContext.Provider, or pass them directly tohono/jsx/dom/server, are strongly encouraged to upgrade to this version.v4.13.6Compare Source
What's Changed
editorconfig-checkerin #5336Full Changelog: https://github.com/honojs/hono/compare/v4.13.5...v4.13.6
v4.13.5Compare Source
Security fixes
This release includes fixes for the following security issues:
Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a
?after a#was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcxIncomplete fix for CVE-2026-39408:
toSSG()still writes files outside the output directoryAffects:
toSSG()for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments inssgParamsvalues were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjvUnbounded dot-notation nesting in
parseBody()can cause memory exhaustionAffects:
parseBody()when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfcUsers who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use
parseBody({ dot: true })are strongly encouraged to upgrade to this version.v4.13.4Compare Source
What's Changed
Full Changelog: https://github.com/honojs/hono/compare/v4.13.3...v4.13.4
v4.13.3Compare Source
What's Changed
Full Changelog: https://github.com/honojs/hono/compare/v4.13.2...v4.13.3
nodejs/node (node)
v24.21.0: 2026-09-08, Version 24.21.0 'Krypton' (LTS), @aduh95Compare Source
Notable Changes
71106e1f17] - crypto: update root certificates to NSS 3.126 (Node.js GitHub Bot) #65495afca0a912d] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #639496274fccbd9] - deps: update OpenSSL to 3.5.8 (Node.js GitHub Bot) #6554253cba013c7] - deps: update Undici to 7.29.1 (Node.js GitHub Bot) #657890529772798] - (SEMVER-MINOR) lib,src: improve histogram implementation (James M Snell) #6502441c7062b81] - (SEMVER-MINOR) net: improve performance ofnet.BlockList(James M Snell) #649745197b5a3c5] - (SEMVER-MINOR) perf_hooks: add statistical hypothesis testing to histogram (James M Snell) #6541635c635b032] - (SEMVER-MINOR) util: add non-throwingMIMEType.parse(James M Snell) #64965Commits
84d706cb9b] - assert: improve documentation wording (Kamal Rawal) #6495390d127db33] - (SEMVER-MINOR) benchmark: add --analyze mode to compare.js (James M Snell) #65416ad1d7884c3] - benchmark: add test-only and mock timers cases (Luan Muniz) #640971d8f045914] - benchmark: applyhighWaterMarkin webstreamspipe-to(Matteo Collina) #65138ed7ba3c993] - benchmark: complete the sqlite is-transaction fix (Edy Silva) #65218c8837e1aa3] - benchmark: add test runner hooks and options (Luan Muniz) #637542ba8661e23] - buffer: prevent string write offset overflow (Matteo Collina) #65043cc9ee6c2ae] - buffer: treat detached ArrayBuffers as empty (Archkon) #645045a5d73e4c5] - build: pass target architecture to small-icu genccode (ulofiai) #65095273e72d1a5] - build: deprecate always enabled--enable-static(Chengzhong Wu) #6510389a67246e3] - build: check FIPS option value in node.gyp (Filip Skokan) #649822d21f41cd5] - build: handle malformed OpenSSL macros (Filip Skokan) #64982f62bc0f862] - build,win: add PGO workload scripts (Stefan Stojanovic) #6369633d0c7dc12] - child_process: keep SIGWINCH from killing on Win (Kirill Saied) #6451071106e1f17] - crypto: update root certificates to NSS 3.126 (Node.js GitHub Bot) #65495419af8b86d] - crypto: fix missing error checks on ASN1_STRING_to_UTF8() (Nora Dossche) #652008029383f3f] - crypto: use available BoringSSL APIs (Filip Skokan) #65423a9bd780e19] - crypto: remove obsolete BoringSSL shims (Filip Skokan) #654237defefad3f] - crypto: read WebCrypto inputs through primordials (Filip Skokan) #651156ed1e38627] - crypto: fix disabling FIPS mode (Filip Skokan) #64982afca0a912d] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #639499b9dd6e9cf] - debugger: wait for target startup (Filip Skokan) #6519407faaeeffd] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #6565353cba013c7] - deps: update undici to 7.29.1 (Node.js GitHub Bot) #657890268ca547c] - deps: update archs files for openssl-3.5.8 (Node.js GitHub Bot) #655426274fccbd9] - deps: upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) #655426bdcd121fa] - deps: update zlib to 1.3.2.1-motley-8002e91 (Node.js GitHub Bot) #65316c2aa446b6d] - deps: update simdjson to 4.6.7 (Node.js GitHub Bot) #653183e58e48ea8] - deps: update googletest to49495ea(Node.js GitHub Bot) #65317670b3665c0] - deps: cherry-pick libuv/libuv@e640dc9(ulofiai) #65118ca1c67b021] - deps: float ICU-23262 patch for icu78 (René) #646784ad043b0aa] - deps: enable AVX-512 OpenSSL asm with clang (Daniel Lemire) #6513696b4af109b] - deps: update googletest tod89aac5(Node.js GitHub Bot) #65153774f663c56] - dgram: don't swallow bind errors when callback is provided (armanmikoyan) #6260294b118d62e] - diagnostics_channel: validate before channel activation (Trivikram Kamat) #6531309788665bd] - dns: validate address type in lookupService (Lazizbek Ergashev) #6487815f95fc0e2] - dns: validate port range insetServers()(René) #6502137b9e9a154] - dns: fix crash on setServers with port 0 (Lazizbek Ergashev) #65009cd6205fa0d] - doc: update AHAFS reference link (Taeuk Ha) #654810e6f9ae42e] - doc: fix property names in os.networkInterfaces() example (Jihwan) #65469034a827b41] - doc: fix broken links in cli.md (Donghoon Kang) #65412eb364621d4] - doc: remove outdated WASI version fallback (이혜미) #65303b13f425bf8] - doc: fix broken GYP link in n-api.md (Donghoon Kang) #6541345c4011067] - doc: document that an empty OPENSSL_CONF skips config loading (Orgad Shaneh) #64949fde6776c5f] - doc: fix broken TLS security level example (soreavis) #65391290c1fec04] - doc: clarify socket destroyed behavior (Dayun) #65395a7e8269947] - doc: update outdated nodejs.org guide links (Donghoon Kang) #653947809f11249] - doc: clarify that ipv4 mapped to ipv6 are classified as ipv6 (Vedant Kulkarni) #6211764cd3a6e95] - doc: clarify how fs.Dirent file types are determined (soreavis) #645329b92fdce14] - doc: update security release prepare command (Rafael Gonzaga) #646996f9b9df3c1] - doc: clarify copyFile symlink behavior (T) #629412480acb550] - doc: document setRawMode write access on Windows (Erik Demaine) #63856a1e9c3a5db] - doc: add missing return types in fs.md (Chaseton Collins) #653074533572040] - doc: add missing return types in buffer.md (Yuya Inoue) #6530839ecedbbd2] - doc: fix lint clean command (greenhead) #652740b1fb8fcd8] - doc: fix typo in onboarding.md (서울민트초코) #652953165b5d38a] - doc: add missingadded:tags tofs.lchmod(Lazizbek Ergashev) #65283113b808e59] - doc: fix SQLite changeset constant descriptions (greenhead) #65265c3eb51d5a1] - doc: document open pull request limit (Matteo Collina) #65250d7accdcd52] - doc: document http2 header constants (Harjoth Khara) #64548f47111416f] - doc: create ai-guidelines and include to CONTRIBUTING (Rafael Gonzaga) #62105c3b120e737] - doc: update synopsis (Augustin Mauroy) #6517139f4c831fd] - doc: fix broken internal links (greenhead) #64901be25cdd69e] - doc: report proper return type on urlPattern.test (Brian Muenzenmeyer) #648311bf7737810] - doc: fix permission documentation examples (greenhead) #64897b7932e68a1] - doc: document sqlite parameter binding (Guilherme Araújo) #650895234a5169c] - doc: finalize statements in sqlite examples (Guilherme Araújo) #6508839ea929da7] - doc: document quic stopSending() and resetStream() (Issac) #648882ba198db73] - doc: clarify sqlite bare parameter default (Sumit Kumar Das) #62009314f9b200f] - doc: remove usage ofutil.inherits(Augustin Mauroy) #60817d82a61662c] - doc: fix grammar in worker_threads.md (이혜미) #6491344c0c8ff5b] - doc: clarify OpenSSL FIPS configuration (Filip Skokan) #649829b2ca70e0d] - doc: remove--expose-gcflag from CLI documentation (Dario Piotrowicz) #58909a0a12397b9] - doc: document ArrayBuffer support in pbkd2Sync (kyungrae2002) #64976b48699e077] - doc: correct default highWaterMark values (Yilong Li) #646170312ee133c] - esm: avoid super-linear data URL MIME regex (Sumit Kumar Das) #61951cd84d55c81] - esm: only register text format when enabled (Efe Karasakal) #64992c0a8ef611e] - esm: fix wasm import name in error message (이혜미) #64950e6c34f90c2] - events: inline iterationCondition hybrid dispatch closure (Szymon Łągiewka) #644736ee4b40c91] - events: inline createEvent hybrid dispatch closure (Szymon Łągiewka) #64473367549eed5] - fs: use sized reads for large files in readFileUtf8 (Shelley Vohr) #653288a5b1ae4c2] - fs: fix realpath of namespaced drive paths (Jason Zhang) #65378c9233b950d] - fs: fix glob early return skipping sibling entries (Srinu desetti) #64895bc54dd8905] - fs: pass symlink type in cp when filter is provided (Jerry Zhao) #62654fcb4333aca] - fs: allocate FSReqPromise stat arrays lazily (Samuel Attard) #63886c35876154e] - fs: fix out-of-bounds write in mkdtemp for long prefixes (Hierax_Umbra) #64770b269616936] - fs: treatstd::errc::permission_deniedasEPERMerror (Kirill Saied) #64698212fe77e76] - fs: add windowsHandle option to file streams (Kirill Saied) #6385175df6cb435] - http: improve performance with known-length calls to end() (Tim Perry) #6546648d9cd4a28] - http: cache maxHeaderPairs per header section (GetThatCookie) #6498804785c8f43] - http: fix keylog listener setup on existing agent sockets (Shani Singh) #650664b90031534] - http: emit drain on socket takeover and avoid stale HWM reuse (Naman Trivedi) #6499183a27559cd] - http2: adapt receive deferral for Node.js 24 (Matteo Collina) #65093f43bed0ecc] - http2: avoid uaf while receiving and sending rst_stream (esgor) #64166b42d664321] - inspector: avoid calling into JS from V8 interrupts (Joyee Cheung) #650286bf852197d] - lib: use bracket notation instead of startsWith/endsWith for single char (Taejin Kim) #61500151ca7e104] - lib: harden webidl dictionary member reads (Filip Skokan) #651157e8c2c9f44] - lib: use validateArray for array arguments (greenhead) #64959424fe2bc5a] - lib: add and test [EnforceRange] in webcrypto dictionaries (Filip Skokan) #650910529772798] - (SEMVER-MINOR) lib,src: improve histogram implementation (James M Snell) #65024186e1b76e8] - meta: move targos to emeritus (Michaël Zasso) #65393b41b07c72a] - meta: add unified http api initiative (James M Snell) #65139f85b6ecd67] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #651828f3d01bdce] - meta: add Aviv Keller to.mailmap(Aviv Keller) #65048cfad1d5b28] - meta: update sccache to 0.17.0 (René) #64985349c53c441] - module: report unreadable package.json (Paul Bouchon) #65223bd21e6706e] - module: cache nearest parent package.json per directory (Shelley Vohr) #65326961bd04370] - module: fix --check on ambiguous ESM files (Paul Bouchon) #65203f45ef73420] - net: handle undefined parent in _unrefTimer and _destroy (Shivay-98) #6464441c7062b81] - (SEMVER-MINOR) net: improve performance of net.BlockList (James M Snell) #649745197b5a3c5] - (SEMVER-MINOR) perf_hooks: add statistical hypothesis testing to histogram (James M Snell) #654161722ddac28] - permission: enforce addon permission in GetLinkedBinding (Rafael Gonzaga) #65432dff2b675db] - process: validate resource stats array offsets (Archkon) #65098f277983e7b] - quic: changes for nghttp3_conn_close_stream2 (Marten Richter) #64574a4c770c78e] - quic: mark drain promise handled (James M Snell) #653192460b171c5] - quic: reset rejected HTTP/3 request streams with H3_REQUEST_REJECTED (trivenay) #6544218a7ccf302] - quic: write desired size needs update on maxstream (Marten Richter) #647689017f4a780] - quic: do not destroy incoming streams that have a consumer (trivenay) #65335ddc41c1ef4] - quic: fix wake up blob (Marten Richter) #6404488bee43d7c] - quic: convert incoming :status header to number (Hallison Pereira Melo) #63589cd776fe97c] - quic: fix infinite loop if STOP_SENDING received on a buffering stream (Tim Perry) #647154f6eda3c23] - repl: keep entries added while history file is loading (Mhayk Whandson) #64513cd1e6ce29b] - repl: add benchmarks (Aviv Keller) #645902ba740669d] - sea: avoid dangling CLI option pointers (Archkon) #64755ec5e2d6856] - sea: handle NUL bytes in asset keys (Archkon) #64773703b854293] - sea: reject trailing content in config JSON (Archkon) #64774a61a5fdd1c] - sqlite: prevent reentrant session.close() (Trivikram Kamat) #653496ae81be0a3] - sqlite: reject statement-less SQL in prepare() (Trevor Burnham) #65157043dfe4996] - sqlite: reject statement-less SQL in SQLTagStore (Trevor Burnham) #65157b8faee02e1] - sqlite: check null returns from sqlite value functions (Nora Dossche) #63288d6d2a71bee] - sqlite: validate maxSize argument in createTagStore() (Anshika Jain) #6379261a046309f] - sqlite: reject non-positive backup rates (Trivikram Kamat) #64893514e3f30fb] - sqlite: clear SQLTagStore bindings (Matteo Collina) #65041c1542255b8] - sqlite: bind Boolean (mike-git374) #62001cdb732beb5] - sqlite: fix undefined behaviour inSession::Changeset()(Nora Dossche) #63637fbe8861111] - sqlite: bind ArrayBuffer (mike-git374) #62061e3c6bd6bc8] - src: add missing vector include (Filip Skokan) #65622793cf69df8] - src: fix heap value deduplication in embedder graph (Ilyas Shabi) #64801ea5935b04c] - src: fix out-of-bounds write when transcoding odd-length ucs2 (nashit hayat) #6451222e5023f4d] - src: escape Windows environment variables in task runner (Antoine du Hamel) #65217a0f3c62bd9] - src: simplify c++ diagnostics channel API (James M Snell) #651588e831a3d2e] - src: make minor cleanup to permission checks (James M Snell) #65158968b2ca3a3] - src: use DictionaryTemplate for permission diag channel message (James M Snell) #6515818e16e7f8d] - src: cache permission strings (James M Snell) #65158c8625a4b6f] - src: add SetAbortHandler (Max H Fisher) #64684c990140d60] - src: match cmd.exe case-insensitively in task runner (Archkon) #64907d7463b9dbc] - src: reuse cached env strings in remaining files (Seongeun Lee) #65039b055a43b93] - src: expose Windows-only fs open flags (Kirill Saied) #647757f21e37496] - src: report why --enable-fips failed (Filip Skokan) #649798c11beae27] - src: update repeated use strings to env (James M Snell) #647609e2c477e26] - stream: normalize fused stateless transform results (Trivikram Kamat) #65367107e96dd41] - stream: encode whole chunks in TextEncoderStream (Matteo Collina) #65414164068279b] - stream: prevent share from eagerly draining source (Trivikram Kamat) #6533893d822bdc1] - stream: drain pending writes before broadcast end (Trivikram Kamat) #653346b8b9c362f] - stream: reuse unexposed managed read buffers (GetThatCookie) #649904ec4fab367] - stream: avoid duplicated endReadableNT scheduling (Matteo Collina) #6531086d1196ebf] - stream: decouple transform backpressure changes (Matteo Collina) #65143b8a7a75b19] - stream: reject pull on signal abort during flush (Trivikram Kamat) #65346386ed6a06d] - stream: avoid leaking consumers on signal failure (Trivikram Kamat) #6529974d53bd73b] - stream: use validateObject for zlib/iter params (greenhead) #650153a174ce16b] - stream: use validateNumber for BYOB reader options.min (greenhead) #65014859ea01cb2] - stream: consolidate non-op algorithm callbacks (Matteo Collina) #65138c577669825] - stream: cut promise churn in webstreams hot paths (Matteo Collina) #65138d631e910db] - stream: preserve falsy cancellation reasons (Trivikram Kamat) #64705f9c21eabbd] - stream: use validateBuffer for BYOB reader view (greenhead) #65046b89c8f5d1e] - stream: fix recursive WritableStream abort (Jeong SeokChan) #6482539e0457e86] - test: fix link-local dgram scope assertion (Filip Skokan) #656291433cf9d5b] - test: account for varied OpenSSL CCM final behaviours (Filip Skokan) #655427d135d24b7] - test: convert forEach to for of test-messageevent-brandcheck file (Nachiketa Pathak) #65279421ee11715] - test: use spawnSyncAndAssert in windowsHide test (Junsoo Ha) #65351929d5705bc] - test: remove test-debugger-run-after-quit-restart as flaky on macOS (Yuya Inoue) #65424f38f154c14] - test: simplify test-timers-interval-promisified.js (Donghoon Kang) #65322a98e27f2a9] - test: add Headers coverage and benchmark (Yagiz Nizipli) #6536538fdbb62aa] - test: deflake test-net-listen-ipv6only (sangwook) #6417306c7684b01] - test: use common/child_process spawnSync helpers (Junsoo Ha) #653776438c70004] - test: fix Linux debug skip in SEA test guard (구현우) #63751fe0e4f1b65] - test: avoid timer race in event loop delay test (Trivikram Kamat) #647286ff69baea8] - test: enforce exit code intest-http-server-stale-close(Antoine du Hamel) #65198ba87603016] - test: convert test-async-local-storage-bind to async loop (freida-code) #652708d6b89f454] - test: replaceforEach()withfor...ofin parallel tests (Phillip Markert) #65272a60572a7bb] - test: convert forEach to for in test-constant.js file (NIxxy25) #65271f82060c6ce] - test: use for-of instead of forEach (Felix P.) #652685ded71f9cc] - test: coverrealpathSyncresolving symlinks after a FIFO stat (Hendrik Liebau) #65113ac9835225e] - test: account for [EnforceRange] in test-webcrypto-prototype-pollution (Filip Skokan) #65173550d24277e] - test: update WPT for WebCryptoAPI to4c2fd05(Node.js GitHub Bot) #651502aa26559f0] - test: update WPT for urlpattern to4832db4(Node.js GitHub Bot) #65151d45c010108] - test: fix hidden error in test-http-server-stale-close.js (Meghan Denny) #59357881f8d092d] - test: avoid deadlock issue in pipeline http2 tests to fix flakiness (Tim Perry) #65079e4b1e3ee75] - test: allow half-open CONNECT tunnel sockets (Trivikram Kamat) #6497300f4240d48] - test: update passphrases to comply with the next OpenSSL FIPS mode (Filip Skokan) #65077cf7680efb7] - test: use libuv clock for immediate queue test (Trivikram Kamat) #64889b0c12772ff] - test: increase timeout in probe-failure-hang-during-evaluate (Joyee Cheung) #647197e279104b4] - test: update WPT for WebCryptoAPI to82c3d90(Node.js GitHub Bot) #64977ac11f88d16] - test,doc: cover and document multi-byte offset/size in randomFill (kyungrae2002) #6483467da38cada] - test_runner: match dotfiles in default coverage exclude (semimikoh) #63401b06c61a08f] - test_runner: print coverage and diagnostic info with dot reporter (mag123c) #614237cb9c9c126] - test_runner: use run options with isolation="none" (Sylvester Keil) #62269339acf4201] - test_runner: mock dual-package with conditional exports (Maruthan G) #62943e7a68bca08] - test_runner: add classname hierarchy for JUnit reporter (mag123c) #602206a248acefe] - test_runner: fix junit report on empty diagnostic (Lazizbek Ergashev) #65357d01dda79b6] - test_runner: do not tag-filter test file wrappers (Chemi Atlow) #6517032ead10ddd] - test_runner: fix env option validation (Jihwan) #64865b0ef155440] - tls: throw on invalid ALPNProtocols instead of aborting (Sankalp Thakur) #65076dcf65c50ce] - tls: fix authorized state on no-cert TLS1.3 client cert resumption (Tim Perry) #64677b0f54bda78] - tools: improve commit queue failure comment (Filip Skokan) #65433bc1f2718d5] - tools: fix max body length handler increate-release-proposal.sh(Antoine du Hamel) #65455bbe76516a9] - tools: bump brace-expansion in/tools/clang-format(dependabot[bot]) #6498467697debdf] - tools: make env variables consistent in cron jobs (Antoine du Hamel) #65168ac8a68ec92] - tools: only include fast-tracked and old enough PRs in CQ (Antoine du Hamel) #651976d9999fa2e] - tools: remove skip logic incommit-queue.sh(Antoine du Hamel) #6516260bfa1694e] - tools: bump js-yaml from 4.2.0 to 4.3.1 in /tools/lint-md (dependabot[bot]) #65129782748527e] - tools: bump js-yaml from 4.2.0 to 4.3.1 in /tools/eslint (dependabot[bot]) #65130dac257340f] - tools: fix GITHUB_TOKEN permissions for CQ workflow (Antoine du Hamel) #65192e624785846] - tools: use the read-only token when filtering PRs in CQ (Antoine du Hamel) #651697d9dcfaaa7] - tools: delay removal ofcommit-queuelabel (Antoine du Hamel) #651010d7c7936e7] - tools: move ncu config to global for commit queue (Filip Skokan) #651325e1db5a38a] - tools: prefilter commit queue metadata (Filip Skokan) #64343f41509b91d] - tools: lazy-abort failed PR merges in CQ (Antoine du Hamel) #65004ceb0e99acd] - tools: sync mk-ca-bundle.pl with curl (Archkon) #64753600663b23f] - tty: add raw-vt and io raw modes (Samuel Williams) #64140a40bfc742e] - typings: add signal_wrap internal binding types (Seongeun Lee) #65229b103a4a3b9] - typings: add diagnostics_channel typings (Seongeun Lee) #65227e64de34b89] - typings: add watchdog internal binding types (Seongeun Lee) #65228c57c83b4d1] - typings: add internal_only_v8 binding typeis (Donghoon Kang) #65071f15e8c9dcd] - typings: add credentials internal binding types (Donghoon Kang) #65036a500256b0b] - url: skip unused href reuse comparison (Yagiz Nizipli) #6536158390f8bec] - url: speed up WHATWG URL parsing (Yagiz Nizipli) #653617d5428c812] - url: speed up URLSearchParams (Yagiz Nizipli) #653638e2461d819] - url: bounds-check short Windows file URL paths (Archkon) #647889ffc0da90c] - url: handle unparsable serialized URLs in setters (Matteo Collina) #64651fa9d4e075d] - util: allow single-line format when break length is infinite (Hamid Reza Ghavami) #64238b68a7c3862] - util: fix OSC 8 hyperlink stripping in stripVTControlCharacters (Dushyant Singh Hada) #6431910cbb6dc00] - util: fix formatting of functions returned from getters (Richard Gibson) #6483964c20b449e] - util: use more primordials incomparisons.js(Ayoub Mabrouk) #61198cea9786de8] - util: preserve function names without source map names (Hiroki Osame) #6510835c635b032] - (SEMVER-MINOR) util: add non-throwing MIMEType.parse (James M Snell) #649655858c2ba9a] - zlib: validate pledgedSrcSize for sync zstd (Archkon) #64601oxc-project/oxc (oxfmt)
v0.67.0Compare Source
🛡️ Security
9a612d5deps: Update npm packages (#26178) (renovate[bot])v0.66.0Compare Source
v0.65.0Compare Source
v0.64.0Compare Source
🚀 Features
c07fe7coxfmt: SupportexperimentalOperatorPosition(#25643) (leaysgur)📚 Documentation
fed6681oxfmt: Skip expanding overrides options (#25572) (leaysgur)shadcn-ui/ui (shadcn)
v4.21.0Compare Source
Minor Changes
c257f688cf4de7ec10cc1be84cad29cd4631182cThanks @shadcn! - installcnand generateexport { cn } from "cn"forlib/utilson init. Registry components now importcnfrom thecnpackage.Patch Changes
8720dec73f5aebed9f649ea58636f54599fdedf1Thanks @shadcn! - usetwMergefromcninstead oftailwind-mergeinternally.v4.20.1Compare Source
Patch Changes
04bb134c52af23af7d77673618ef4e3862b7c310Thanks @shadcn! - preserve leading comments when runningshadcn migrate cn.v4.20.0Compare Source
Minor Changes
51f3e12203b0026ea106cafb4f770bda9abead87Thanks @shadcn! - addnpx shadcn migrate cnto replaceclsx,tailwind-mergeandcnfastin Tailwind CSS v4 projects.v4.19.1Compare Source
Patch Changes
f9ea1e600ea5dd7b1b79769b7b25cafa400cee6fThanks @shadcn! - Add the official shadcn/ui website to the package metadata.v4.19.0Compare Source
Minor Changes
#11582
33c81f991f1013653444d6819107b2b356563f57Thanks @shadcn! - add private repository support to GitHub registries via GitHub CLI credentials or GH_TOKEN.#11248
b4f2023b1d5c733db67d4e90eb9485a95c5ed480Thanks @rbadillap! - addnpx shadcn migrate base-colorto switch a project's base color.rolldown/tsdown (tsdown)
v0.23.0Compare Source
🧭 Migration Guide
Most users can upgrade directly. Before upgrading, run one final build with
tsdown@0.22.14and resolve all deprecation warnings.bundle: false→unbundle: true;bundle: truecan be removedoutExtension→outExtensionspublicDir/--public-dir→copy/--copyremoveNodeProtocol: true→nodeProtocol: 'strip'injectStyle→css.injectinlineOnly/deps.onlyAllowBundle→deps.onlyBundleskipNodeModulesBundle: true→deps.neverBundle: trueresolveDepSubpathnow defaults tofalse; set it totrueto preserve the previous behaviorrolldown-plugin-dtswas upgraded from0.27.13to0.28.5dts.oxc: true→dts.generator: 'oxc'dts.tsgo: true→dts.generator: 'tsgo';oxcandtsgoobjects now only configure their respective generatorsdts.volarPlugins→dts.customLanguages; rename each language'screatehook tocreateVolarPluginsvue, now throw when combined with an incompatible generatordts.cjsReexportwas removed; dual-format builds now generate CJS declarations in a separate passstricttoesm-only; setprofile: 'strict'to preserve the previous checksbuild()now returns{ bundles, watch }; replaceconst bundles = await build()withconst { bundles } = await build()^22.18.0,^24.11.0, or>=26.0.0rolldown-plugin-dtsnow requires Rolldown 1.2.xtypesandtypesVersionsfallbacks were removed; use TypeScript'sbundler,node16, ornodenextmodule resolution🚨 Breaking Changes
typesandtypesVersionsfields - by @sxzz (be3ea)esm-only- by @sxzz (9b3cf)deps.onlyAllowBundle- by @sxzz (30c55)resolveDepSubpathby default - by @sxzz (d300f)skipNodeModulesBundle- by @sxzz (f2a3d)dts.generatorthe only way to select generator - by @sxzz (eb75f)🚀 Features
css.modules.localsConvention- by @sxzz and @lazerg (b566f)summaryoption to skip per-file size logs - by @lazerg in #1036 (020e9)🐞 Bug Fixes
unplugin-unusedv0.5+ - by @sxzz (53c78)@import- by @lazerg in #1038 (ebee5)resolveDepSubpathwhenneverBundleistrue- by @lazerg in #1053 (4943c)🏎 Performance
asyncDisposepolyfill - by @sxzz (82675)ansiswithutil.styleText- by @sxzz (be6bf)View changes on GitHub
tsparticles/tsparticles (tsparticles)
v4.4.0Compare Source
Note: Version bump only for package tsparticles
4.3.3 (2026-07-23)
Note: Version bump only for package tsparticles
4.3.2 (2026-07-10)
Note: Version bump only for package tsparticles
4.3.1 (2026-07-01)
Note: Version bump only for package tsparticles
privatenumber/tsx (tsx)
v4.23.13Compare Source
Bug Fixes
This release is also available on:
colinhacks/zod (zod)
v4.6.2Compare Source
Commits:
a00c3f3docs: use Trigger.dev's brand-kit lockups for the platinum card0c483c5docs: Zod 4.6 announcement post (#6546)9446b5cfix: preserve undefined prefault outputs and object keys (#6587)e359f734.6.2v4.6.1Compare Source
A patch on top of 4.6.0.
b12aa523fix: preserve unique tags with defaulted discriminators (#6582) — closes #6577dd9c36fafix(v4): defer recursive object index inference (#6580)3b154992feat(lang): add Tajik (tg) locale (#6581) by @ismoil772efa8b80ci: give the npm wait a real budget and drop the back-publish path (#6583)v4.6.0Compare Source
Zod 4.6 is now available.
At a glance:
.validate()— checks input validity without building a result (up to 35x faster than.safeParse().successon a compiled schema)z.instanceof().properties()— validates properties of an instancefromJSONSchema()— enforces six validation keywords it used to ignorez.iban()— electronic-format IBAN plus mod-97 checksumz.withParser()— installs a parser generated elsewhere, for environments withoutnew Functionz.validate()underrequire)@zod/mini— Zod Mini as a standalone package, versioned in lockstep withzodsince 4.5.validate()Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a
ZodError, which makes rejection cheap. The return type is a guard on the schema's input type.It is a method on Zod Classic schemas too. (#6547)
In conjunction with
z.compile(), this can be up to 35x faster than.safeParse().successon invalid input.Time per call on invalid input, compiled with z.compile() — lower is better (benchmark)
Uncompiled schemas
Without compilation it is up to 5.9x faster. The saving is the result object:
.safeParse()allocates one with an accessor pair on every call, and.validate()allocates nothing.Time per call on invalid input, plain schemas — lower is better (benchmark)
Both charts measure the failure path. The key feature of
.validate()is that it can short-circuit on the first issue it encounters, instead of aggregating a fullZodIssue[]array.z.properties()A new API for validating specific properties of an object. Unlike
z.object()it validates in-place, so it plays nice with class instances. (#6536)A corresponding
.properties()method has been added toZodInstanceOf.Zod
Zod Mini
The input comes back untouched, so the prototype survives and the methods still work. That is the part
z.object()cannot do: it would hand back a plain object and theResponsewould be gone.fromJSONSchema()Six additional JSON Schema keywords are now supported in
z.fromJSONSchema(). (#6535)minProperties/maxPropertiesuniqueItemscontainsminContains/maxContainsBoth property bounds count the input's own keys. Array uniqueness is structural, so
[{ a: 1 }, { a: 1 }]is a duplicate.z.iban()A new string format: an IBAN in electronic format, with a valid ISO 7064 MOD 97-10 checksum. (#6571)
z.withParser()z.compile()builds its parser withnew Function, which a strict Content Security Policy blocks.z.withParser()is that installer on its own: it takes a parser generated somewhere else, at build time or by a native compiler, and installs it under the same contract. (#6575)The supplied parser owns the whole result, so it has to return what the schema would have returned. This one rebuilds the object rather than handing back its input, because
z.object()strips unknown keys. Returningz.INVALIDhands the input to the runtime, which stays the only source ofZodErrors.Faster CommonJS
TypeScript compiles a re-export to a getter, and 252 of the 255 exports on Zod 4.5's CommonJS entrypoint were getters. V8 could not see a constant callee behind one, so it could not inline the call. The 4.6 build emits plain properties and freezes the exports object. On a compiled schema,
z.validate()underrequireis about 3x faster than it was in Zod 4.5. (#6564)Only calls through the namespace were affected. A method call like
Player.safeParse(data)never reads the exports object, and the ESM build is unchanged.Memory retention in recursive schemas
A recursive schema held the input and output of its last parse until the next parse replaced it, so one long-lived schema pinned every object it had touched. Zod 4.4 released that input and Zod 4.5 did not, which surfaced as an out-of-memory failure on a repository-wide lint run. The parse state is weak throughout now: one parse of a 29k-node tree retains 2.2 MB where it used to retain 10.1 MB, and recursive parses give up about 6% for it. (#6572)
Bug fixes
⚠️ Error maps run on the first read of
errorBecause
safeParse()now builds its error lazily, error maps — global, locale, and per-schemaerror— run whenresult.erroris first read, not at parse time. Code that swapsz.config()between the parse and the read gets the newer configuration. (#6519)An error map with a side effect never runs if nothing reads the error. Throwing parses are unaffected —
.parse()builds and throws its error immediately, never takes the lazy path, and its stack still points at your call site.⚠️
z.emoji()rejects component-only stringsUnicode's
Emoji_Componentproperty covers the pieces that attach to an emoji, soz.emoji()accepted"123","#","*", and a lone zero-width joiner, variation selector, or skin tone modifier. The pattern now requires at least one pictograph, regional indicator, or keycap. (#6532)Flags, subdivision flags, skin-tone-modified emoji, and ZWJ sequences are unchanged. Closes #6515.
⚠️ Numeric enum options no longer include the reverse mappings
A numeric TypeScript enum also carries its reverse mapping (
0to"UK") at runtime. The parser already ignored those keys, but.optionswas read straight off the enum object, so a three-member enum listed six values and three of them failed to parse. (#6542)⚠️ base64 patterns
The runtime patterns for
z.base64()andz.base64url()are the character sets, with length and padding enforced in code, so a multi-megabyte string can no longer overflow the regex stack through a composed schema. The JSON Schema output still emits the exact block forms, soz.toJSONSchema()is unchanged. (#6534, #6527)Composing
z.base64()into a template literal now checks the alphabet but not the length, which is howz.creditCard()already behaves there. The exportedz.regexes.base64urlis now the length-aware form, so it overflows on a multi-megabyte input the same wayz.regexes.base64does.⚠️ The email pattern dropped its lookaheads
z.email()opened with two lookaheads, and the second scanned the whole string before the match began. Both are gone, and the rule they enforced — no empty segment in the local part — is expressed structurally instead, soz.email()accepts and rejects exactly what it did before. Valid addresses validate roughly twice as fast. (#6573)The pattern string is user-visible, and every copy of it changes:
z.regexes.email, which has no capture groups now — neither of the two it used to expose held a usable value;issue.patternon a failedz.email(); and thepatternthatz.toJSONSchema()emits, which no longer carries a lookahead, so validators outside ECMAScript can compile it.Composing an email into a template literal also stops applying its no-consecutive-dots rule to the rest of the string.
⚠️ Chained checks no longer overwrite each other in JSON Schema
Each check used to write its own bounds into the schema as it attached, in chain order, so a format check applied after
.min()and.max()replaced the tighter values with its own range. The converter folds the checks as a conjunction now. The order they are chained in no longer changes the output. (#6554, #6553)Runtime parsing enforced the bounds in every version. Only the emitted schema was wrong. The same fold fixes two more cases: a repeated
multipleOfkept the first divisor and dropped the rest, soz.number().multipleOf(2).multipleOf(3)emitted a schema that accepts 4, andz.string().min(8).length(5)emittedminLength: 5, widening a bound the runtime still rejected. Closes #6550.⚠️ Metadata members materialize on first read
Eight members on a Zod Classic schema —
.format,.minLength,.maxLength,.minValue,.maxValue,.isInt,.minDateand.maxDate— are computed from the checks now instead of being written onto every instance at construction. Each one is a prototype getter that becomes an own property on first read. (#6554)A key is absent until something reads it, and
Object.assign({}, schema)copies only the members that have been read. Deleting one restores the getter, and the next read recomputes it.The values can move too, because the getters read the same fold the JSON Schema converter does. An order-dependent chain reports the tighter bound now instead of whichever check wrote last.
Commits
Zod 4.6 rolls up 72 commits.
661673aedocs: make the 9thCO logo visible on the light theme by @colinhacks6de10dcedocs: reconcile the sponsor listings against every active sponsorship (#6579) by @colinhacks213ee75dfeat(compile): add z.withParser for externally generated parsers (#6575) by @colinhacksf9465d4edocs: reconcile the sponsor listings with active sponsorships (#6576) by @colinhacksf7fd5548perf(v4): drop the lookaheads from the email regex (#6573) by @colinhacks36f17960fix(v4): stop the memoizer from pinning a finished parse (#6572) by @colinhacks22bed613feat(v4): add z.iban() string format with mod-97 checksum (#6571) by @colinhacksc5b9bcb3bench: measure what a runtime island's leaked indent cost the generated source by @colinhackse54716cbdocs(ecosystem): add @apical-ts/craft (#5946) by @gunzipdcbcf052fix(compile): unwind the doc indent when a child generator throws (#6570) by @colinhacks277613a6docs: move the release procedure to the maintainer-local notes by @colinhackseb1c1089ci: release only on workflow_dispatch behind the npm environment (#6569) by @colinhacks741981ffperf(compile): for-in record walk, cheaper issue finalization, and a generative compile differential (#6567) by @colinhacks804e0f52perf: seal the CommonJS exports so require("zod") stops reading through a getter (#6564) by @colinhacks6f048367fix(v4): derive JSON Schema constraints by folding checks in the converter (#6554) by @colinhackse4d67f3eMigrate development and CI to Nub (#6562) by @colinhacks7a002366fix(v4): don't let format checks overwrite tighter min/max bounds (#6553) by @colinhacks5489a532test(v4): pin the check-chain case that keeps compiled validate's definite guard (#6551) by @colinhackse7604717docs: attribute the compiled failure cost to the fallback, not the double pass by @colinhacks764ac59fperf(v4): settle z.validate on the first failure in parse order (#6544) by @colinhacks07917f4ctest(v4): pin the lazy safeParse error's stack behavior (#6548) by @colinhacks62e6624bfeat(v4): add .validate() and .validateAsync() to Zod Classic (#6547) by @colinhackscafbee47fix(v4): parse recursive schemas built by a factory (#6530) by @colinhacks4d730882Release the parsed input once a failing safeParse builds its error (#6543) by @colinhacks90269c60Keep a numeric TS enum's reverse-mapping keys out of.options(#6542) by @colinhacks18e71c71Rename the JSON Schemaprocesshelper so bundler polyfills cannot collide (#6541) by @colinhacks68aca3dcdocs: cover the 4.5 API surface that never made it into the reference by @colinhackseca96871fix(v4): enforce the six JSON Schema keywords fromJSONSchema silently dropped (#6535) by @colinhacks81ded991perf: answer z.validate from the compiled fast path on invalid input (#6538) by @colinhacks51caf010refactor: collapse cachedInternal back into cached (#6540) by @colinhacksabfb3897feat(v4): make z.properties() a schema, and give z.instanceof() a .properties() method (#6536) by @colinhacks69f2a7ffCollapse toZod's normalizer and move its docs to the API reference (#6539) by @colinhacksbf990216perf: move util.cached's accessor to a prototype (#6537) by @colinhacksbec73beaperf(v4): build the safeParse error on first read (#6519) by @colinhacks07c43e2aKeep the runtime base64 regexes linear so composed parse paths cannot overflow (#6534) by @colinhacksbc1157e7docs: use a Response example for z.properties() by @colinhacks2ec972ecrefactor: collapse toZod's enum leaf normalizer to a dummy union (#6533) by @colinhacks68a609acWiden literal inputs in property check types (#6520) by @colinhacks0227e53ddocs: bump the star pill's GitHub mark to 20px by @colinhacks84dd3b0fperf: build literal and enum pattern regexes lazily (#6531) by @colinhacksf83ab511fix(v4): reject component-only strings from z.emoji() (#6532) by @colinhacks74f9a6d3docs: drop the toZod enum block from basics and pin the page's curation rule in a comment by @colinhacksa2a019a5Accept enum-typed targets in z.toZod (#6528) by @colinhacks319f47f4Emit a length-aware base64url pattern in toJSONSchema (#6527) by @colinhacks08ba069eperf(v4): read Luhn digits with charCodeAt instead of string indexing (#6529) by @colinhacks1ec6b7c5docs: add an RSS feed to the blog at /blog/rss.xml by @colinhacksb801439bbench: add typebox (compiled and dynamic) to the moltar cross-library harness by @colinhacks7ae49d64docs: drop the circle around the star pill's GitHub mark and center it on the pill's arc by @colinhacks93f3ab32docs: replace the blog navbar's GitHub icon with a star-count pill by @colinhacksfb2fedfddocs: tighten the memory chart callout, pad the canvas, say "less memory" by @colinhacksff56a551docs: center the memory chart callout labels and pad them off the number by @colinhacks8cd1250fdocs: center the memory chart callout labels by @colinhacks3195ed01docs: label the memory chart like the compile chart by @colinhacksa6b49390Mark the compile internals @internal instead of hiding them (#6518) by @colinhacks40b4d0b3fix(ci): read zod's latest version with npm view when picking the backfill dist-tag by @colinhacks5ff95665Stop re-exporting the compile internals from zod/v4/core (#6511) by @colinhacksf412178dci: publish @zod/mini to JSR in lockstep with npm (#6510) by @colinhacksf3e7c72efix(docs): render the docs 404 page inside the (doc) layout once by @colinhacksf3cb3644docs: surface the blog on the home page and in the sidebar by @colinhackscd4f9a67perf(v4): report Standard Schema issues without constructing a ZodError (#6509) by @colinhacks43b9bfc5docs: drop the bound-methods section from the Zod package page by @colinhacks70eb2c07docs: drop the traits section and the compilation feature bullet by @colinhacks1c0bce0cdocs: bring the 4.5 charts and worked examples into the docs pages by @colinhacksa0898b4bci: wait hours for npm to serve a publish, not ten minutes (#6502) by @colinhacksc46eeff0chore: narrow blanket biome-ignore comments (#6504) by @pullfrog[bot]c7ec94d3ci: check zod and @zod/mini lockstep on npm after every publish (#6507) by @colinhacks81065739chore(docs): build with Turbopack by @colinhacksabd41adbdocs(wiki): move plans and comparisons into a gitignored internal/ (#6506) by @colinhacks2956c4c2chore(mini): sync @zod/mini to 4.5.4 by @colinhacks8ce9e8d5feat(mini): publish Zod Mini as the standalone @zod/mini package (#6491) by @colinhacks93186cabdocs(wiki): drop the zod-compiler benchmark (#6505) by @colinhacks908c9e17fix(docs): retry the GitHub stars fetch and log the real status by @colinhacksv4.5.4Compare Source
Commits:
84e416ffix(v4): stop the cycle walk from firing a default factory (#6500)e8e206f4.5.4v4.5.3Compare Source
Commits:
e6b6ab3docs(blog): widen the z.compile example to a 20-property schema87d6464fix(docs): drop the OG description when the title wraps past two lines99fce39bench(v4): z.compile() against zod-compiler (#6499)e3a695bdocs(v4): record the email regex and container output-shape findings under Open7e24a24docs(blog): drop the reading time and put a GitHub link in the navbareab51fffix(v4): emit record numeric keys as strings in toJSONSchema (#6497)v4.5.2Compare Source
Commits:
a354314fix(docs): keep blog posts out of the docs collection (#6484)d378c42ci: drop canary publishing from the release workflow (#6487)212b941fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#6488)e7576f5docs(blog): let the page show through the navbar in dark mode (#6489)fedb06ffix(docs): match the blog TOC hover bar to the 2px active indicator6c932fcchore: bump devcontainer image to Node 24 (#6470)6635d9ddocs(blog): soften the "method memoization" attribution019ae29fix(docs): drop ISR on the docs route so the home page hydrates652bb43chore(docs): drop the scroll log from the route-change scroller571c8e8fix(docs): render blog tabs with the stock fumadocs tab card9a193aa4.5.2v4.5.1Compare Source
Commits:
2e862dbci: gate the GitHub release and JSR publish on the version being live on npm8e033804.5.1v4.5.0Compare Source
Zod 4.5 is now available.
At a glance:
z.compile()— the flagship feature of Zod 4.5z.creditCard()— 12–19 digits plus Luhn checksumz.properties()— the multi-property counterpart toz.property()z.deepPartial()/.exactPartial()z.validate(): boolean— a fast-path to verify input validity without a full parse (up to 16x faster on invalid data)bn), Central Kurdish (ckb), Hindi (hi), Kannada (kn), Norwegian Nynorsk (nn), Brazilian Portuguese (pt-BR), Slovak (sk), Turkmen (tk)z.compile()You can now pre-compile any Zod schema using
z.compile(schema). This dramatically speeds up parsing performance.A compiled schema can be used exactly like an uncompiled one. There are no special rules around compiled schemas. They're just faster.
On objects, arrays, and unions, this speeds up parsing by a factor of ~3–9. More complex schemas stand to benefit more than simpler ones.
Time per parse by schema type, standard parser vs compiled — lower is better (benchmark)
Below are the Moltar benchmark results comparing Zod (compiled and uncompiled) against the Moltar ParseSafe bench.
Throughput on the moltar benchmark fixture (parseSafe: returns a new object with unknown keys stripped) — higher is better (benchmark)
And the equivalent results for the Moltar AssertLoose bench. Tested against the new
z.validate(schema, input)function (detailed later in the post).Throughput on the moltar benchmark fixture (assertLoose: returns a boolean, unknown keys allowed) — higher is better (benchmark)
Zod's entire test suite runs twice—once normally and again with auto-compilation enabled globally—to ensure perfect fidelity.
How it works
Under the hood,
z.compile()walks the entire schema once and produces a hyperoptimized snippet of flat, loop-free JavaScript that can validate inputs far faster than a standard runtime validator. This snippet can be executed vianew Function()(effectively a more powerfuleval) to serve as a fast-path validator. Schemas use this to "fast check" validity, falling back to the regular runtime logic on validation failure to provide granular error information.Take this simple
Pointschema:Here is the generated snippet for it:
For the large majority of inputs, the generated function validates the data with the fastest logic JavaScript can express: straight-line
typeofchecks and property reads, with no interpreter in between. When it can't handle an input, Zod falls back to the standard parser.This is the function Zod generates for the
Playerschema above:Armed with the power of
new Function(), this happens in-process at runtime. There is no need to integrate with your build system.import "zod/compile"To compile every schema in an application, import
zod/compileonce at the top of your entry point. Every schema constructed after that import is automatically compiled the first time it's used to parse data.It also works as a Node.js CLI flag, which guarantees it runs before any module defines a schema:
Or set
preloadinbunfig.tomlornub.jsonc.All schemas benefit to varying degrees, though complex object/tuple/array schemas benefit more than simple scalar validators.
z.creditCard()A new string format: 12–19 digits, optionally separated by single spaces or hyphens, with a valid Luhn checksum. (#5931)
z.properties()The multi-property counterpart to
z.property(). (#5912)z.deepPartial()Back in functional form after being removed as a method in Zod 4. (#5928)
The result is still a
ZodObject, so.shapeand.extend()keep working..exactPartial()Like
.partial(), but wraps each field inz.exactOptional()instead ofz.optional(): keys may be omitted, but an explicitundefinedis rejected. This matches TypeScript'sPartial<>underexactOptionalPropertyTypes. (#6065)In Zod Mini it's a top-level function:
z.exactPartial(Recipe).z.validate()Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a
ZodError, which makes rejection cheap: on invalid input it is up to 16x faster than.safeParse().success. The return type is a guard on the schema's input type, andz.validateAsync()covers schemas with async refinements. (#6471)z.input()/z.output()Project a schema onto its input or output side. Useful for validating the two halves of a codec independently. (#5928)
This is a no-op on schemas not containing codecs/pipes.
z.toZod<T>()A utility to define a Zod schema that agrees exactly with a static type, often one that is handwritten or externally defined. (#5913)
z.getDiscriminatedOption()Extract a discriminated union member by discriminator value. (#5947)
Cyclical inputs
Zod recursive schemas now support cyclical data. For bundle size reasons, Zod Mini requires you to register a memoizer explicitly. (#6387, #6482)
Zod
Zod Mini
9x reduction in schema memory footprint
In Zod 4.4 a bare
z.string()retained 7.5kb of heap. In Zod 4.5 it retains 784 bytes.Retained heap per schema instance, Zod 4.4.3 vs 4.5 (benchmark)
In Zod 4.4 and earlier, all schema methods were automatically bound to the instance itself. This allowed users to pluck methods from schemas without causing issues due to
this-binding.A consequence of this is that each bound method allocates space on the heap; method implementations are not shared across all instances via
prototype, as you'd expect. Zod 4.5 implements a method memoization pattern that avoids allocating bound methods until they are actually accessed.Faster failures
Zod
.parse()/.safeParse()instantiates a JavaScriptError, which captures a stack trace. In the case of validation failures, this is often much slower than the parsing logic itself. When using.safeParse(), Zod no longer captures this stack trace, speeding up failure-path parses by a factor of ~7.5x. (#6316, #6450)Player schema (benchmark)
Symbol keys in
z.object()A shape can now declare a symbol key. TypeScript tracks it: a
constsymbol infers asunique symbol, soz.infermakes the key required and checks its value type. Undeclared symbol keys are still ignored. (#6448)Bug fixes
All of these fix soundness issues, so a schema that relied on the old behavior may now reject input it used to accept.
⚠️
z.iso.datetime()requires secondsRFC 3339 mandates seconds.
z.iso.datetime()andz.iso.datetime({ offset: true })no longer accept minute-precision input like2020-01-01T06:15Z.local: truestill admits2020-01-01T06:15, since an unqualified datetime is outside RFC 3339 either way. (#6457)To accept both forms, union the two precisions:
⚠️ String length counts code points
.min(),.max(), and.length()counted UTF-16 code units, soz.string().max(5)rejected five emoji. They now count Unicode code points, which is what every non-JS consumer of a length bound does (Postgres, MySQL, Go, Python, and themaxLengththatz.toJSONSchema()emits)..max()only loosens;.min()and.length()tighten for astral input. Graphemes are unchanged — a ZWJ sequence is still several code points. (#6441)Closes #3355.
⚠️ Record keys and intersections match TypeScript
A record's key schema now governs only the keys that match it, the way TypeScript treats an index signature. Intersecting an object with a pattern-keyed record no longer rejects the object's own keys. (#6412)
Separately, an
unrecognized_keysissue no longer aborts the schema it came from, so a strict object with an extra key and a bad value now reports both issues instead of just the first. Closes #2200, #2573, #4017, #5663.⚠️
__proto__is always strippedObject and record parsers now drop a
__proto__key whether it comes from the input, is declared by the schema, or is produced by a record key transform. A key that a record's key schema normalizes to__proto__is dropped too..strict()reports an own__proto__input key asunrecognized_keysinstead of silently swallowing it. Error formatters and both JSON Schema converters use own-property writes so atoStringorconstructorpath segment can't walk ontoObject.prototype(#6213, #6367, #6346). (#6386, #6354, #6355, #6221)⚠️ Stricter string formats
z.ipv6()validated by handing the string tonew URL(), which let::@1\and::1\nthrough. It now checks the address alphabet directly (#6442).z.ulid()restricts the first character to0–7; anything higher overflows the 48-bit timestamp. A fixture that doesn't start with a real timestamp, such as one with a leading letter, is now rejected (#6095).z.httpUrl()enforces the RFC 1035 length limits on the host, matchingz.hostname()(#6035).z.emoji()no longer backtracks exponentially on a failed match (#6347).z.string().includes(sub, { position: N })emits a JSON Schema pattern that allows at least N leading characters, matchingString.prototype.includes(#6024).Commits
Zod 4.5 rolls up 155 commits. Thanks to everyone who contributed: @dokson, @deepshekhardas, @zirkelc, @francisjohnjohnston-web, @MerlijnW70, @codinsonn, @oimo23, @JSap0914, @zelinewang, @abhishek-chaudhary2003, @spokodev, @Mohammad-Faiz-Cloud-Engineer, @hamed-bavar, @MGPOCKY, @ChiChuRita, @dinwwwh, @thristhart, @tsmartin9, @vedanshshetti, @belicam, @frastefanini, @andersk, @musaddiq-rafi, @tachmyratsaparmyradov, @arvindfroi, @KUMachine, @spidersouris, @catdalfonso, @mneetika, @gwagjiug, @MahinAnowar, @MaksZhukov, @emmayusufu, @agcty, @devareddy05, @Vish05, @yamcodes, @mattiasahlsen, @samchungy, @ozzyfromspace, @udohjeremiah, @patrickwehbe, @gajus, @Harm-Nullix, @thwbh, @IdanGonen, @irfanfandi, @JuerGenie, @marcalexiei, @itsahmedbilal, @DucMinhNe, @meliharik.
9782f87cperf(v4): validate without building the output, and keep schemas out of dictionary mode (#6480) by @colinhacks773a4867refactor(v4): declare a trait's members on $constructor (#6478) by @colinhacks68fb3f13feat(v4): make z.compile() fall back instead of throwing (#6479) by @colinhacks37b01501feat(v4): add z.isValid and z.isValidAsync (#6471) by @colinhacks749f5452docs: add fullproduct.dev to v4 ecosystem page (#6001) by @codinsonn24cdb7fdperf(v4): close the fastpass bindings into the compiled parser (#6464) by @colinhacks8d896186fix(v4): stop emitting a multipleOf that JSON Schema rejects (#6468) by @colinhacks43f729dbfeat(v4): make a tuple's items optional with .partial() (#6465) by @colinhacks97edaf7dfix(v4): don't throw from safeParse on bigint multipleOf(0n) (#6466) by @colinhacks21a6f0cbfeat(v4): let z.nanoid() take a custom length (#4004) by @oimo239d5b20effix(v4): restrict the first ULID character to [0-7] (#6095) by @JSap09141cf9cd09docs: record that error maps run per parse, and how to translate at render by @colinhacks7ce3e77dfix(v4): run a wrapper's inner schema on its own payload (#6462) by @colinhacks7b612b53fix(v4): fold an intersection of object schemas into one object (#6461) by @colinhacks1c43b774docs(v4): record why the failure path is not worth compiling by @colinhacksbadf0b78fix(v4): build the catch context from the input that failed (#6192) by @zelinewanga87ac366fix(v4)!: distinguish number and bigint formats at the type level (#6052) by @abhishek-chaudhary20036726c1dddocs: record what z.input and z.output do with transforms and wrappers by @colinhacks7cfc0122fix(v4): keep a wrapper's stored value only on the side it belongs to by @colinhacksa825c1b0fix(v4): empty enums and literals match nothing (#6459) by @colinhacks7c070db9feat(v4): expose the function schema on .implement() results (#6267) by @deepshekhardas3a496968fix(v4): make record input keys optional when the value can fill them (#6460) by @colinhacks53cec2a0fix(v4): resolve z.input past a preprocess transform by @colinhacks2125d30cfix(v4): accept exact decimal multiples in multipleOf (#6223) by @spokodev168122fcfix(v4): carry a pipe's own checks through z.output by @colinhacks51a1368afix(v4): let the includes(position) pattern match at or after the offset (#6024) by @francisjohnjohnston-web72a05c4ffeat(v4): expose stringbool truthy/falsy/case via _zod.bag (#6357) by @hamed-bavar036b39f4fix(v4)!: require seconds once a datetime carries a Z or an offset (#6457) by @colinhacks5825605eperf(v4): skip the eager stack capture when building a ZodError (#6450) by @colinhacksd85472c4feat(v4): support declared symbol keys in z.object() (#6448) by @colinhacksd4108872fix(v4): correct the date/time format keywords in both JSON Schema directions (#6452) by @colinhacks555e5f46Add z.toZod helper (#5913) by @colinhackse0e51a55docs(v4): cut the compile comments down to what they explain (#6449) by @colinhacks6574e784fix(v4): stop catch resurrecting issues an optional already resolved (#6440) by @colinhacks937b5d01perf(v4): prefix issue paths in place in the object JIT failure path (#6445) by @colinhacksb63db248fix(v4): keep a memoized node's cached issues private to the cache (#6443) by @colinhacks6ec3d043fix(resolution): keep pnpm's own warnings out of the attw snapshot (#6446) by @colinhacks830ba314fix(v4): validate the address, and return the string that was validated (#6442) by @colinhacksf101d8caPreserve callsites in parse stack traces (#5910) by @colinhacks6c77d028feat: compact simple anyOf unions to type array in toJSONSchema (#6339) by @deepshekhardas28e1ebd8fix(v4): measure string length in Unicode code points (#6441) by @colinhacks060bc9f3refactor: share default when-clauses for size/length checks (#6394) by @zirkelc2848177ddocs: point the flattened/formatted error deprecations at a symbol that exists by @colinhacks3c2dee9eAdd properties checks for instanceof schemas (#5912) by @colinhacks87ffeb0ffix(v4): an absent key on the middle rung supplies nothing (#6434) by @colinhacks7785fc82feat(v4): add z.getDiscriminatedOption (#5947) by @dokson0135c85afeat(v4): allow passing extra args to apply() (#6337) by @deepshekhardasca246d26fix(v4): drop empty alternation branch from datetime pattern (#6439) by @colinhackse073d55bdocs: z.iso.datetime() accepts a subset of ISO 8601, not all of it by @colinhacksd6ca12aefix(v4): infer recursive getter options in discriminatedUnion (#6422) by @colinhacksdc51404bAdd shorn to Zod Utilities (#6398) by @ChiChuRita580111dadocs: mark AOT compilation as canary-only by @colinhacks6b0dae79docs: note that a catch callback is not islanded by @colinhacks898c4461refactor(v4): give the runtime and compiled code one URL implementation by @colinhacks260e5d4bfix(v4): stop islanding a catch callback, which diverged silently by @colinhacks11c9268brevert(core): drop the exactOptional parse prototype from #6432 (#6438) by @colinhacksa38ab4a8fix(core): an omittable discriminator claims undefined (#6432) by @colinhacksc9ec89e0perf(core): drop the seal and the per-key WeakSet from the lazy internals (#6435) by @colinhacks3c9ca1d9feat(json-schema): emit a root $ref when the root schema has an id (#6029) by @dinwwwhfa77a4d7feat(v4): z.compile — ahead-of-time schema compilation (#6085) by @colinhacksf300476dfix(v4): let a schema's error map cover its own checks' issues (#6426) by @colinhacks9f0a3d81fix(core): restore defineLazy semantics lost in the internals move (#6429) by @colinhacks604464c3fix(locales): da/nn/no/sv called an IP address a range (#6430) by @colinhacks7378e7cdfix(locales): backfill the mac and Sizable.map gaps, and pin dictionary parity (#6427) by @colinhacksb1077f05perf(memory): install derived internals on a per-constructor prototype (#6415) by @colinhacksccc15144fix(locales): add the credit_card key to the seven locales missing it (#6424) by @colinhacks73bacbbbfix(from-json-schema): drop redundant inclusive bound for draft-04 exclusive ranges (#6022) by @francisjohnjohnston-web86b2e6dadocs: list el and hr in the supported locales (#6423) by @colinhacks45fdeda5fix(v4): refine optin into a three-rung ladder, retire the fallback payload flag (#6419) by @colinhacks5b34c0ceImprove Portuguese localization and add Brazilian Portuguese (pt-BR) (#6076) by @thristhartdc1a40a5fix(locales): improve french translation (#6120) by @tsmartin90175a043feat(locales): add Hindi and Kannada locale support (#6315) by @vedanshshetti536ee3b0Locales: added Slovak (sk) language (#6041) by @belicam07b0c3d8fix: preserve explicit superRefine issue input (#6053) by @frastefaniniba98071cfeat: add .exactPartial() to ZodObject (#6065) by @andersk234c407dfeat(lang): Added Bengali locale (#5974) by @musaddiq-rafi377cd9d7feat(locales): add turkmen (tk) locale (#6168) by @tachmyratsaparmyradov69b6bb08feat(locales): add Norwegian Nynorsk (nn) locale (#6092) by @arvindfroi33d82e6bAdd Central Kurdish (ckb) locale (#6078) by @KUMachine06666fe2fix(fr): remove hyphen in "non-optionnel" (#5999) by @spidersouris79cfedeafeat(v4): expose the owning schema on check-originated issues (#6420) by @colinhacks436b5da8docs: propose compiled constructor graph by @colinhackseb4682c9fix(json-schema): resolve tuple minItems past transform and catch in input mode (#6418) by @colinhacks4d6b5cd3fix(json-schema): route unrepresentable default values throughunrepresentableby @colinhacks2abc9e05docs: note that the JSON Schema emitter reads static optin (#6417) by @colinhacks578e1cd0feat(v4): support format: "hostname" in fromJSONSchema (#6305) by @catdalfonso942bf8cbfeat(v4): parse input containing reference cycles (#6387) by @colinhacks78b523f0fix(json-schema): keep preprocess object properties required in input mode (#6133) by @MerlijnW70973b1b44fix(v4): strip output-typed catch values from the input JSON Schema (#6409) by @colinhacks5e608851feat(v4): add z.deepPartial and runtime z.input / z.output (#5928) by @dokson4e1720c8fix(v4): align record keys and intersection strictness with TypeScript (#6412) by @colinhacks4cc4053dfix: honor loose mode for closed record key schemas (#6157) by @pullfrog[bot]69be843ffix(v4): stop the object JIT fastpass keeping a swallowed issue's value (#6407) by @colinhacksb899cd17perf(json-schema): make toJSONSchema(registry) linear in registry size (#6408) by @colinhacks6074828efix(v4): make fromJSONSchema propertyNames compose with the other object keywords (#6411) by @colinhacksd7b209f3docs: point the Web URLs callout at z.httpUrl() (#6410) by @colinhacks611bd762fix(mini): make merge() take an object schema, matching classic (#6404) by @colinhacksb53e53ccfix(v4): use exact flag in English locale too_small/too_big messages (#6177) by @pullfrog[bot]421cc9a5fix(json-schema): unescape JSON Pointer tokens when resolving $ref (#6402) by @colinhacks4c27fe87fix(v4): give z.xor() a distinct error when multiple options match (#6376) by @colinhacksa106fbe7fix(v4): make fromJSONSchema tuples open-ended by default (#6020) by @mneetikae8034ebafix(v4): make prefixItems/draft-7 items respect minItems in fromJSONSchema (#6201) by @pullfrog[bot]784e5c26fix(v4): let bundlers tree-shake locales out of the default import (#6384) by @colinhacks97edd70afix(toJSONSchema): constrain closed tuple length (#6194) by @pullfrog[bot]f150020dfix(v4): escape non-string enum values in template literal patterns (#5934) by @gwagjiugfaf33a28fix: surface @deprecated on re-exported compat aliases (#6072) by @MahinAnowar3956224adocs: state that metadata wins over generated JSON Schema keywords (#6401) by @colinhacksa1904fc2fix(v4): report date origin for numeric min/max bounds (#6129) by @MerlijnW70bd18314cfix: escape JSON Pointer reserved characters in toJSONSchema $ref (closes #6027) (#6144) by @MaksZhukov2a5164f5fix(v4): enforce RFC 1035 length limits in regexes.domain (#6035) by @emmayusufu0e5bc4b1fix(v4): respect additionalProperties:false with patternProperties in fromJSONSchema (#6199) by @pullfrog[bot]c8f06d36fix(v4): clarify infinite number errors (#5906) by @colinhacks9a7ecc35fix(json-schema): accept RFC 3339 numeric offsets in date-time format (#6298) by @agcty0a76f3d7feat(v4): add z.creditCard() string format (#5931) by @doksonbd6619c0feat(json-schema): accept a function forunrepresentable(#6380) by @colinhacks9d20fdc3fix(v4): preserve z.preprocess input narrowing (#5967) by @devareddy053063993aperf(v4): cut per-schema memory ~90% by moving methods to the prototype (#6318) by @zirkelcfd074106feat(json-schema): runoverridebefore the unrepresentable error (#6391) by @colinhacks2715c12efix(v4): preserve default English locale across tree-shaken bundles (#5959) by @colinhacks81d9fc6cdocs: add zod-form-action to ecosystem (#6314) by @Vish05d86df5e0docs: add ArkEnv to ecosystem page (#6203) by @yamcodes18b4ff99docs(ecosystem): add zodql to API Libraries (#6227) by @mattiasahlsen479d6f51shill oxlint (#6196) by @samchungy85dba7e1docs: document that any/unknown object keys are required (#6388) by @colinhacksd24fb4c3fix: consistently strip proto from parsed objects (#6386) by @colinhacks7708d447perf(v4): lazy ZodError construction (#6316) by @zirkelc8ac9ae51fix(docs-v3): serve the docsify SPA fallback on Vercel (#6378) by @colinhacks31384464fix(v4): complete reserved-key hardening (#6371) by @colinhacks600c6909docs: add Attaform to ecosystem (#6188) by @ozzyfromspace37c05fa5docs(ecosystem): rename zod-to-mongo-schema to zod-mongo-schema (#6178) by @udohjeremiahbadfdf08docs: update keyof() ZodEnum type to the v4 form (#6124) by @patrickwehbee25b68e1perf(v4): let three dead declarations tree-shake under esbuild (#6381) by @colinhacks53397351docs(ecosystem): Add zod-mongoose list item in Zod To X (#6062) by @Harm-Nullixdfa0deb1docs: add tauri-typegen to ecosystem (#6032) by @thwbh9c914ee8docs: add dynamic error message and combined refinement examples for refine() (#6002) by @IdanGonen921649defix(v4): formatError and treeifyError handle inherited-name path elements (#6367) by @deepshekhardase7029aa4fix(v4): report own proto key under .strict() (#6221) by @pullfrog[bot]9c540db8fix(v4): re-check the record key after the key schema runs (#6355) by @colinhacks8bb89ea4docs: add .nonempty() to Strings, Arrays, Sets, and Maps sections (#6056) by @pullfrog[bot]599c0e41docs(ecosystem): Add@chrock-studio/overloadand@chrock-studio/zod-utils(#6040) by @JuerGenie27a9036adocs(ecosystem):eslint-plugin-zodiseslint-zodnow (#5975) by @marcalexieie177a0eedocs(v4): document coerce missing-key breaking change (#5957) (#5964) by @dokson66fba964docs: show z.instanceof with built-in classes (#6059) by @itsahmedbilal2d90846afix(docs): make the prefault example runnable (#6063) by @DucMinhNeead9fcb3fix(v4): write a declared proto key as an own property (#6354) by @colinhacksc58764c5docs: fix UUID helper list in v4 introduction (#6214) by @meliharikf238fbd2fix: remove exponential backtracking from the emoji regex (#6347) by @colinhackse6c213ecfix(json-schema): keep proto keys as own properties in schema conversion (#6346) by @colinhacks573fcb75fix(errors): use own-property semantics in every error-tree walker (#6213) by @pullfrog[bot]6f5e99fdfix(docs-v3): rename README.md to home.md so Vercel serves it by @colinhacksbbc68f99docs: soften Zod 3 EOL callouts to informational tone by @colinhacks3fc9b25fdocs: reframe library-authors page Zod-4-first; note Zod 3 EOL by @colinhacksf29f2a6dfix(v4): cidrv6 JSON schema pattern matches runtime (#5945) by @doksondfd8766bfix(v4): break circular import between classic schemas and iso (#5275) (#5926) by @doksonfbe8ad1bfix(v4): allow dynamic.catch()underunrepresentable: "any"(#5273) (#5925) by @doksonConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.
4000c971357f5ad049907f5ad0499005ff6b966505ff6b9665af144f6127af144f6127828c76781e828c76781ee242fc6019e242fc60193d5e7816b3View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.