chore(deps): update peerdependency zod to v4

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
zod (source)	>=3 → >=4.5.4

---

Release Notes

colinhacks/zod (zod)

v4.5.4

Compare Source

Commits:

• 84e416f fix(v4): stop the cycle walk from firing a default factory (#​6500)
• e8e206f 4.5.4

v4.5.3

Compare Source

v4.5.2

Compare Source

Commits:

• a354314 fix(docs): keep blog posts out of the docs collection (#​6484)
• d378c42 ci: drop canary publishing from the release workflow (#​6487)
• 212b941 fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#​6488)
• e7576f5 docs(blog): let the page show through the navbar in dark mode (#​6489)
• fedb06f fix(docs): match the blog TOC hover bar to the 2px active indicator
• 6c932fc chore: bump devcontainer image to Node 24 (#​6470)
• 6635d9d docs(blog): soften the "method memoization" attribution
• 019ae29 fix(docs): drop ISR on the docs route so the home page hydrates
• 652bb43 chore(docs): drop the scroll log from the route-change scroller
• 571c8e8 fix(docs): render blog tabs with the stock fumadocs tab card
• 9a193aa 4.5.2

v4.5.1

Compare Source

Commits:

• 2e862db ci: gate the GitHub release and JSR publish on the version being live on npm
• 8e03380 4.5.1

v4.5.0

Compare Source

Zod 4.5 is now available.

npm install zod@latest

At a glance:

• z.compile() — the flagship feature of Zod 4.5
• z.creditCard() — 12–19 digits plus Luhn checksum
• z.properties() — the multi-property counterpart to z.property()
• z.deepPartial()/.exactPartial()
• z.validate(): boolean — a fast-path to verify input validity without a full parse (up to 16x faster on invalid data)
• 9x reduction in memory footprint
• New locales: Bengali (bn), Central Kurdish (ckb), Hindi (hi), Kannada (kn), Norwegian Nynorsk (nn), Brazilian Portuguese (pt-BR), Slovak (sk), Turkmen (tk)

z.compile()

You can now pre-compile any Zod schema using z.compile(schema). This dramatically speeds up parsing performance.

import*aszfrom"zod";constPlayer=z.object({username: z.string(),bio: z.string(),xp: z.number()});constCompiledPlayer=z.compile(Player);

A compiled schema can be used exactly like an uncompiled one. There are no special rules around compiled schemas. They're just faster.

Player.parse({ ... });CompiledPlayer.parse({ ... });// ~2x faster

On objects, arrays, and unions, this speeds up parsing by a factor of ~3–7. More complex schemas stand to benefit more than simpler ones.

Time per parse by schema type, standard parser vs compiled — lower is better (benchmark)

Below are the Moltar benchmark results comparing Zod (compiled and uncompiled) against the Moltar ParseSafe bench.

Throughput on the moltar benchmark fixture (parseSafe: returns a new object with unknown keys stripped) — higher is better (benchmark)

And the equivalent results for the Moltar AssertLoose bench. Tested against the new z.validate(schema, input) function (detailed later in the post).

Throughput on the moltar benchmark fixture (assertLoose: returns a boolean, unknown keys allowed) — higher is better (benchmark)

Zod's entire test suite runs twice—once normally and again with auto-compilation enabled globally—to ensure perfect fidelity.

How it works

Under the hood, z.compile() walks the entire schema once and produces a hyperoptimized snippet of flat, loop-free JavaScript that can validate inputs far faster than a standard runtime validator. This snippet can be executed via new Function() (effectively a more powerful eval) to serve as a fast-path validator. Schemas use this to "fast check" validity, falling back to the regular runtime logic on validation failure to provide granular error information.

Take this simple Point schema:

constPoint=z.object({x: z.number(),y: z.number()});

Here is the generated snippet for it:

constisPoint=newFunction("input",` if (typeof input !== "object" || input === null) return false; if (typeof input.x !== "number") return false; if (typeof input.y !== "number") return false; return true;`);isPoint({x: 1,y: 2});// trueisPoint({x: "1"});// false

For the large majority of inputs, the generated function validates the data with the fastest logic JavaScript can express: straight-line typeof checks and property reads, with no interpreter in between. When it can't handle an input, Zod falls back to the standard parser.

This is the function Zod generates for the Player schema above:

if(typeofinput!=="object"||input===null||Array.isArray(input))returnINVALID;constv0=input["username"];if(typeofv0!=="string")returnINVALID;constv1=input["bio"];if(typeofv1!=="string")returnINVALID;constv2=input["xp"];if(typeofv2!=="number"||!Number.isFinite(v2))returnINVALID;constv3={"username": v0,"bio": v1,"xp": v2};returnv3;

Armed with the power of new Function(), this happens in-process at runtime. There is no need to integrate with your build system.

The compiled schema is purely additive on top of the existing schema. It tacks on the pre-compiled fast path for checking valid inputs. When invalid data is detected, it returns the INVALID symbol to signal that parsing should fall back to the uncompiled parser. This structurally prevents subtle deviations in error reporting between compiled and uncompiled variants.

import "zod/compile"

To compile every schema in an application, import zod/compile once at the top of your entry point. Every schema constructed after that import is automatically compiled the first time it's used to parse data.

import"zod/compile";// must come before modules that define schemasimport*aszfrom"zod";constschema=z.object({name: z.string()});schema.parse({name: "ok"});// compiled on first parse

It also works as a Node.js CLI flag, which guarantees it runs before any module defines a schema:

node --import zod/compile app.js

Or set preload in bunfig.toml or nub.jsonc.

{
"preload": ["zod/compile"]
}

All schemas benefit to varying degrees, though complex object/tuple/array schemas benefit more than simple scalar validators.

Read the docs, or the full technical writeup: Introducing z.compile()

z.creditCard()

A new string format: 12–19 digits, optionally separated by single spaces or hyphens, with a valid Luhn checksum. (#​5931)

z.creditCard().parse("4111 1111 1111 1111");// ✅z.creditCard().parse("4111 1111 1111 1112");// ❌ bad checksum

z.properties()

The multi-property counterpart to z.property(). (#​5912)

consthttpsUrl=z.instanceof(URL).check(
...z.properties({protocol: z.literal("https:"asstring),hostname: z.string().regex(z.regexes.domain),}));httpsUrl.parse(newURL("https://example.com"));// ✅httpsUrl.parse(newURL("http://localhost"));// ❌ protocol

z.deepPartial()

Back in functional form after being removed as a method in Zod 4. (#​5928)

constPost=z.object({title: z.string(),author: z.object({name: z.string(),email: z.string()}),});constPartialPost=z.deepPartial(Post);typePartialPost=z.output<typeofPartialPost>;// => { title?: string; author?: { name?: string; email?: string }}PartialPost.parse({author: {}});// ✅

The result is still a ZodObject, so .shape and .extend() keep working.

.exactPartial()

Like .partial(), but wraps each field in z.exactOptional() instead of z.optional(): keys may be omitted, but an explicit undefined is rejected. This matches TypeScript's Partial<> under exactOptionalPropertyTypes. (#​6065)

constRecipe=z.object({title: z.string(),servings: z.number()});constPartialRecipe=Recipe.exactPartial();PartialRecipe.parse({});// ✅PartialRecipe.parse({title: undefined});// ❌

In Zod Mini it's a top-level function: z.exactPartial(Recipe).

z.validate()

Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a ZodError, which makes rejection cheap: on invalid input it is up to 16x faster than .safeParse().success. The return type is a guard on the schema's input type, and z.validateAsync() covers schemas with async refinements. (#​6471)

z.validate(z.string(),"hi");// truez.validate(z.string(),42);// false

z.input() / z.output()

Project a schema onto its input or output side. Useful for validating the two halves of a codec independently. (#​5928)

constisoDate=z.codec(z.iso.datetime(),z.date(),{decode: (s)=>newDate(s),encode: (d)=>d.toISOString(),});constEvent=z.object({name: z.string(),at: isoDate});z.input(Event).parse({name: "launch",at: "2024-01-01T00:00:00Z"});// ✅z.output(Event).parse({name: "launch",at: newDate()});// ✅

This is a no-op on schemas not containing codecs/pipes.

z.toZod<T>()

A utility to define a Zod schema that agrees exactly with a static type, often one that is handwritten or externally defined. (#​5913)

typePlayer={username: string;xp: number};constPlayer=z.toZod<Player>()(z.object({username: z.string(),xp: z.number(),}));Player.shape.username;// ZodString — the schema is returned unchanged

z.getDiscriminatedOption()

Extract a discriminated union member by discriminator value. (#​5947)

constFruit=z.object({type: z.literal("fruit"),seeds: z.boolean()});constVeg=z.object({type: z.literal("vegetable"),leafy: z.boolean()});constProduce=z.discriminatedUnion("type",[Fruit,Veg]);z.getDiscriminatedOption(Produce,"fruit");// typeof Fruitz.getDiscriminatedOption(Produce,"meat");// ❌ TypeScript error

Cyclical inputs

Zod recursive schemas now support cyclical data. For bundle size reasons, Zod Mini requires you to register a memoizer explicitly. (#​6387, #​6482)

Zod

constCategory=z.object({name: z.string(),getsubcategories(){returnz.array(Category);},});constinput: any={name: "root",subcategories: []};input.subcategories.push(input);constresult=Category.parse(input);result.subcategories[0]===result;// true

Zod Mini

// register a memoizer before defining any schemasz.config({memoizer: z.memoizer()});constresult=Category.parse(input);result.subcategories[0]===result;// true

9x reduction in schema memory footprint

In Zod 4.4 a bare z.string() retained 7.5kb of heap. In Zod 4.5 it retains 784 bytes.

Retained heap per schema instance, Zod 4.4.3 vs 4.5 (benchmark)

In Zod 4.4 and earlier, all schema methods were automatically bound to the instance itself. This allowed users to pluck methods from schemas without causing issues due to this-binding.

const{ parse }=z.string();parse("some data");

A consequence of this is that each bound method allocates space on the heap; method implementations are not shared across all instances via prototype, as you'd expect. Zod 4.5 implements a method memoization pattern that avoids allocating bound methods until they are actually accessed.

Read the deep dive: Reducing Zod's memory footprint by an order of magnitude

Faster failures

Zod .parse()/.safeParse() instantiates a JavaScript Error, which captures a stack trace. In the case of validation failures, this is often much slower than the parsing logic itself. When using .safeParse(), Zod no longer captures this stack trace, speeding up failure-path parses by a factor of ~7.5x. (#​6316, #​6450)

constresult=Player.safeParse({username: 42,bio: "hello",xp: 12});result.success;// false — ~7.5x faster than Zod 4.4

Player schema (benchmark)

Symbol keys in z.object()

A shape can now declare a symbol key. TypeScript tracks it: a const symbol infers as unique symbol, so z.infer makes the key required and checks its value type. Undeclared symbol keys are still ignored. (#​6448)

constTAG=Symbol("tag");constschema=z.object({name: z.string(),[TAG]: z.number()});schema.parse({name: "alice",[TAG]: 42});// ✅ { name: "alice", [TAG]: 42 }schema.safeParse({name: "alice"});// ❌ the symbol key is required

Bug fixes

All of these fix soundness issues, so a schema that relied on the old behavior may now reject input it used to accept.

⚠️z.iso.datetime() requires seconds

RFC 3339 mandates seconds. z.iso.datetime() and z.iso.datetime({ offset: true }) no longer accept minute-precision input like 2020-01-01T06:15Z. local: true still admits 2020-01-01T06:15, since an unqualified datetime is outside RFC 3339 either way. (#​6457)

z.iso.datetime().parse("2020-01-01T06:15:00Z");// ✅z.iso.datetime().parse("2020-01-01T06:15Z");// ❌ was accepted in 4.4

To accept both forms, union the two precisions:

z.union([z.iso.datetime(),z.iso.datetime({precision: -1})]);

⚠️ String length counts code points

.min(), .max(), and .length() counted UTF-16 code units, so z.string().max(5) rejected five emoji. They now count Unicode code points, which is what every non-JS consumer of a length bound does (Postgres, MySQL, Go, Python, and the maxLength that z.toJSONSchema() emits). .max() only loosens; .min() and .length() tighten for astral input. Graphemes are unchanged — a ZWJ sequence is still several code points. (#​6441)

z.string().max(5).parse("😀😀😀😀😀");// was too_big, now passesz.string().min(5).parse("😀😀😀");// was fine, now too_small

Closes #​3355.

⚠️ Record keys and intersections match TypeScript

A record's key schema now governs only the keys that match it, the way TypeScript treats an index signature. Intersecting an object with a pattern-keyed record no longer rejects the object's own keys. (#​6412)

z.object({name: z.string()}).and(z.record(z.string().regex(/^S_/),z.string())).parse({name: "a",S_a: "s"});// 4.4: throws invalid_key on "name"// 4.5: { name: "a", S_a: "s" }

Separately, an unrecognized_keys issue no longer aborts the schema it came from, so a strict object with an extra key and a bad value now reports both issues instead of just the first. Closes #​2200, #​2573, #​4017, #​5663.

⚠️__proto__ is always stripped

Object and record parsers now drop a __proto__ key whether it comes from the input, is declared by the schema, or is produced by a record key transform. A key that a record's key schema normalizes to __proto__ is dropped too. .strict() reports an own __proto__ input key as unrecognized_keys instead of silently swallowing it. Error formatters and both JSON Schema converters use own-property writes so a toString or constructor path segment can't walk onto Object.prototype (#​6213, #​6367, #​6346). (#​6386, #​6354, #​6355, #​6221)

⚠️ Stricter string formats

• z.ipv6() validated by handing the string to new URL(), which let ::@1\ and ::1\n through. It now checks the address alphabet directly (#​6442).
• z.ulid() restricts the first character to 0–7; anything higher overflows the 48-bit timestamp. A fixture that doesn't start with a real timestamp, such as one with a leading letter, is now rejected (#​6095).
• z.httpUrl() enforces the RFC 1035 length limits on the host, matching z.hostname() (#​6035).
• z.emoji() no longer backtracks exponentially on a failed match (#​6347).
• z.string().includes(sub, { position: N }) emits a JSON Schema pattern that allows at least N leading characters, matching String.prototype.includes (#​6024).

Commits

Zod 4.5 rolls up 155 commits. Thanks to everyone who contributed: @​dokson, @​deepshekhardas, @​zirkelc, @​francisjohnjohnston-web, @​MerlijnW70, @​codinsonn, @​oimo23, @​JSap0914, @​zelinewang, @​abhishek-chaudhary2003, @​spokodev, @​Mohammad-Faiz-Cloud-Engineer, @​hamed-bavar, @​MGPOCKY, @​ChiChuRita, @​dinwwwh, @​thristhart, @​tsmartin9, @​vedanshshetti, @​belicam, @​frastefanini, @​andersk, @​musaddiq-rafi, @​tachmyratsaparmyradov, @​arvindfroi, @​KUMachine, @​spidersouris, @​catdalfonso, @​mneetika, @​gwagjiug, @​MahinAnowar, @​MaksZhukov, @​emmayusufu, @​agcty, @​devareddy05, @​Vish05, @​yamcodes, @​mattiasahlsen, @​samchungy, @​ozzyfromspace, @​udohjeremiah, @​patrickwehbe, @​gajus, @​Harm-Nullix, @​thwbh, @​IdanGonen, @​irfanfandi, @​JuerGenie, @​marcalexiei, @​itsahmedbilal, @​DucMinhNe, @​meliharik.

• 9782f87c perf(v4): validate without building the output, and keep schemas out of dictionary mode (#​6480) by @​colinhacks
• 773a4867 refactor(v4): declare a trait's members on $constructor (#​6478) by @​colinhacks
• 68fb3f13 feat(v4): make z.compile() fall back instead of throwing (#​6479) by @​colinhacks
• 37b01501 feat(v4): add z.isValid and z.isValidAsync (#​6471) by @​colinhacks
• 749f5452 docs: add fullproduct.dev to v4 ecosystem page (#​6001) by @​codinsonn
• 24cdb7fd perf(v4): close the fastpass bindings into the compiled parser (#​6464) by @​colinhacks
• 8d896186 fix(v4): stop emitting a multipleOf that JSON Schema rejects (#​6468) by @​colinhacks
• 43f729db feat(v4): make a tuple's items optional with .partial() (#​6465) by @​colinhacks
• 97edaf7d fix(v4): don't throw from safeParse on bigint multipleOf(0n) (#​6466) by @​colinhacks
• 21a6f0cb feat(v4): let z.nanoid() take a custom length (#​4004) by @​oimo23
• 9d5b20ef fix(v4): restrict the first ULID character to [0-7] (#​6095) by @​JSap0914
• 1cf9cd09 docs: record that error maps run per parse, and how to translate at render by @​colinhacks
• 7ce3e77d fix(v4): run a wrapper's inner schema on its own payload (#​6462) by @​colinhacks
• 7b612b53 fix(v4): fold an intersection of object schemas into one object (#​6461) by @​colinhacks
• 1c43b774 docs(v4): record why the failure path is not worth compiling by @​colinhacks
• badf0b78 fix(v4): build the catch context from the input that failed (#​6192) by @​zelinewang
• a87ac366 fix(v4)!: distinguish number and bigint formats at the type level (#​6052) by @​abhishek-chaudhary2003
• 6726c1dd docs: record what z.input and z.output do with transforms and wrappers by @​colinhacks
• 7cfc0122 fix(v4): keep a wrapper's stored value only on the side it belongs to by @​colinhacks
• a825c1b0 fix(v4): empty enums and literals match nothing (#​6459) by @​colinhacks
• 7c070db9 feat(v4): expose the function schema on .implement() results (#​6267) by @​deepshekhardas
• 3a496968 fix(v4): make record input keys optional when the value can fill them (#​6460) by @​colinhacks
• 53cec2a0 fix(v4): resolve z.input past a preprocess transform by @​colinhacks
• 2125d30c fix(v4): accept exact decimal multiples in multipleOf (#​6223) by @​spokodev
• 168122fc fix(v4): carry a pipe's own checks through z.output by @​colinhacks
• 51a1368a fix(v4): let the includes(position) pattern match at or after the offset (#​6024) by @​francisjohnjohnston-web
• 72a05c4f feat(v4): expose stringbool truthy/falsy/case via _zod.bag (#​6357) by @​hamed-bavar
• 036b39f4 fix(v4)!: require seconds once a datetime carries a Z or an offset (#​6457) by @​colinhacks
• 5825605e perf(v4): skip the eager stack capture when building a ZodError (#​6450) by @​colinhacks
• d85472c4 feat(v4): support declared symbol keys in z.object() (#​6448) by @​colinhacks
• d4108872 fix(v4): correct the date/time format keywords in both JSON Schema directions (#​6452) by @​colinhacks
• 555e5f46 Add z.toZod helper (#​5913) by @​colinhacks
• e0e51a55 docs(v4): cut the compile comments down to what they explain (#​6449) by @​colinhacks
• 6574e784 fix(v4): stop catch resurrecting issues an optional already resolved (#​6440) by @​colinhacks
• 937b5d01 perf(v4): prefix issue paths in place in the object JIT failure path (#​6445) by @​colinhacks
• b63db248 fix(v4): keep a memoized node's cached issues private to the cache (#​6443) by @​colinhacks
• 6ec3d043 fix(resolution): keep pnpm's own warnings out of the attw snapshot (#​6446) by @​colinhacks
• 830ba314 fix(v4): validate the address, and return the string that was validated (#​6442) by @​colinhacks
• f101d8ca Preserve callsites in parse stack traces (#​5910) by @​colinhacks
• 6c77d028 feat: compact simple anyOf unions to type array in toJSONSchema (#​6339) by @​deepshekhardas
• 28e1ebd8 fix(v4): measure string length in Unicode code points (#​6441) by @​colinhacks
• 060bc9f3 refactor: share default when-clauses for size/length checks (#​6394) by @​zirkelc
• 2848177d docs: point the flattened/formatted error deprecations at a symbol that exists by @​colinhacks
• 3c2dee9e Add properties checks for instanceof schemas (#​5912) by @​colinhacks
• 87ffeb0f fix(v4): an absent key on the middle rung supplies nothing (#​6434) by @​colinhacks
• 7785fc82 feat(v4): add z.getDiscriminatedOption (#​5947) by @​dokson
• 0135c85a feat(v4): allow passing extra args to apply() (#​6337) by @​deepshekhardas
• ca246d26 fix(v4): drop empty alternation branch from datetime pattern (#​6439) by @​colinhacks
• e073d55b docs: z.iso.datetime() accepts a subset of ISO 8601, not all of it by @​colinhacks
• d6ca12ae fix(v4): infer recursive getter options in discriminatedUnion (#​6422) by @​colinhacks
• dc51404b Add shorn to Zod Utilities (#​6398) by @​ChiChuRita
• 580111da docs: mark AOT compilation as canary-only by @​colinhacks
• 6b0dae79 docs: note that a catch callback is not islanded by @​colinhacks
• 898c4461 refactor(v4): give the runtime and compiled code one URL implementation by @​colinhacks
• 260e5d4b fix(v4): stop islanding a catch callback, which diverged silently by @​colinhacks
• 11c9268b revert(core): drop the exactOptional parse prototype from #​6432 (#​6438) by @​colinhacks
• a38ab4a8 fix(core): an omittable discriminator claims undefined (#​6432) by @​colinhacks
• c9ec89e0 perf(core): drop the seal and the per-key WeakSet from the lazy internals (#​6435) by @​colinhacks
• 3c9ca1d9 feat(json-schema): emit a root $ref when the root schema has an id (#​6029) by @​dinwwwh
• fa77a4d7 feat(v4): z.compile — ahead-of-time schema compilation (#​6085) by @​colinhacks
• f300476d fix(v4): let a schema's error map cover its own checks' issues (#​6426) by @​colinhacks
• 9f0a3d81 fix(core): restore defineLazy semantics lost in the internals move (#​6429) by @​colinhacks
• 604464c3 fix(locales): da/nn/no/sv called an IP address a range (#​6430) by @​colinhacks
• 7378e7cd fix(locales): backfill the mac and Sizable.map gaps, and pin dictionary parity (#​6427) by @​colinhacks
• b1077f05 perf(memory): install derived internals on a per-constructor prototype (#​6415) by @​colinhacks
• ccc15144 fix(locales): add the credit_card key to the seven locales missing it (#​6424) by @​colinhacks
• 73bacbbb fix(from-json-schema): drop redundant inclusive bound for draft-04 exclusive ranges (#​6022) by @​francisjohnjohnston-web
• 86b2e6da docs: list el and hr in the supported locales (#​6423) by @​colinhacks
• 45fdeda5 fix(v4): refine optin into a three-rung ladder, retire the fallback payload flag (#​6419) by @​colinhacks
• 5b34c0ce Improve Portuguese localization and add Brazilian Portuguese (pt-BR) (#​6076) by @​thristhart
• dc1a40a5 fix(locales): improve french translation (#​6120) by @​tsmartin9
• 0175a043 feat(locales): add Hindi and Kannada locale support (#​6315) by @​vedanshshetti
• 536ee3b0 Locales: added Slovak (sk) language (#​6041) by @​belicam
• 07b0c3d8 fix: preserve explicit superRefine issue input (#​6053) by @​frastefanini
• ba98071c feat: add .exactPartial() to ZodObject (#​6065) by @​andersk
• 234c407d feat(lang): Added Bengali locale (#​5974) by @​musaddiq-rafi
• 377cd9d7 feat(locales): add turkmen (tk) locale (#​6168) by @​tachmyratsaparmyradov
• 69b6bb08 feat(locales): add Norwegian Nynorsk (nn) locale (#​6092) by @​arvindfroi
• 33d82e6b Add Central Kurdish (ckb) locale (#​6078) by @​KUMachine
• 06666fe2 fix(fr): remove hyphen in "non-optionnel" (#​5999) by @​spidersouris
• 79cfedea feat(v4): expose the owning schema on check-originated issues (#​6420) by @​colinhacks
• 436b5da8 docs: propose compiled constructor graph by @​colinhacks
• eb4682c9 fix(json-schema): resolve tuple minItems past transform and catch in input mode (#​6418) by @​colinhacks
• 4d6b5cd3 fix(json-schema): route unrepresentable default values through unrepresentable by @​colinhacks
• 2abc9e05 docs: note that the JSON Schema emitter reads static optin (#​6417) by @​colinhacks
• 578e1cd0 feat(v4): support format: "hostname" in fromJSONSchema (#​6305) by @​catdalfonso
• 942bf8cb feat(v4): parse input containing reference cycles (#​6387) by @​colinhacks
• 78b523f0 fix(json-schema): keep preprocess object properties required in input mode (#​6133) by @​MerlijnW70
• 973b1b44 fix(v4): strip output-typed catch values from the input JSON Schema (#​6409) by @​colinhacks
• 5e608851 feat(v4): add z.deepPartial and runtime z.input / z.output (#​5928) by @​dokson
• 4e1720c8 fix(v4): align record keys and intersection strictness with TypeScript (#​6412) by @​colinhacks
• 4cc4053d fix: honor loose mode for closed record key schemas (#​6157) by @​pullfrog[bot]
• 69be843f fix(v4): stop the object JIT fastpass keeping a swallowed issue's value (#​6407) by @​colinhacks
• b899cd17 perf(json-schema): make toJSONSchema(registry) linear in registry size (#​6408) by @​colinhacks
• 6074828e fix(v4): make fromJSONSchema propertyNames compose with the other object keywords (#​6411) by @​colinhacks
• d7b209f3 docs: point the Web URLs callout at z.httpUrl() (#​6410) by @​colinhacks
• 611bd762 fix(mini): make merge() take an object schema, matching classic (#​6404) by @​colinhacks
• b53e53cc fix(v4): use exact flag in English locale too_small/too_big messages (#​6177) by @​pullfrog[bot]
• 421cc9a5 fix(json-schema): unescape JSON Pointer tokens when resolving $ref (#​6402) by @​colinhacks
• 4c27fe87 fix(v4): give z.xor() a distinct error when multiple options match (#​6376) by @​colinhacks
• a106fbe7 fix(v4): make fromJSONSchema tuples open-ended by default (#​6020) by @​mneetika
• e8034eba fix(v4): make prefixItems/draft-7 items respect minItems in fromJSONSchema (#​6201) by @​pullfrog[bot]
• 784e5c26 fix(v4): let bundlers tree-shake locales out of the default import (#​6384) by @​colinhacks
• 97edd70a fix(toJSONSchema): constrain closed tuple length (#​6194) by @​pullfrog[bot]
• f150020d fix(v4): escape non-string enum values in template literal patterns (#​5934) by @​gwagjiug
• faf33a28 fix: surface @​deprecated on re-exported compat aliases (#​6072) by @​MahinAnowar
• 3956224a docs: state that metadata wins over generated JSON Schema keywords (#​6401) by @​colinhacks
• a1904fc2 fix(v4): report date origin for numeric min/max bounds (#​6129) by @​MerlijnW70
• bd18314c fix: escape JSON Pointer reserved characters in toJSONSchema $ref (closes #​6027) (#​6144) by @​MaksZhukov
• 2a5164f5 fix(v4): enforce RFC 1035 length limits in regexes.domain (#​6035) by @​emmayusufu
• 0e5bc4b1 fix(v4): respect additionalProperties:false with patternProperties in fromJSONSchema (#​6199) by @​pullfrog[bot]
• c8f06d36 fix(v4): clarify infinite number errors (#​5906) by @​colinhacks

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@nuxtjs/robots@255

commit: 3659cba

[github-actions]

📦 Package Size

✅ No notable size changes

All tracked output (10)

Package output	Gzipped	Raw
@nuxtjs/robots · dependency @fingerprintjs/botd	13 kB	55 kB	✅
@nuxtjs/robots · dependency h3	34 kB	146 kB	✅
@nuxtjs/robots · dependency nuxt-site-config	10 kB	25 kB	✅
@nuxtjs/robots · dependency nuxtseo-shared	23 kB	76 kB	✅
@nuxtjs/robots · export .	5.3 kB	20 kB	✅
@nuxtjs/robots · export ./content	292 B	503 B	✅
@nuxtjs/robots · export ./util	6.6 kB	25 kB	✅
@nuxtjs/robots · published payload	36 kB	121 kB	✅
@nuxtjs/robots · app runtime	2.5 kB	6.2 kB	✅
@nuxtjs/robots · server runtime	8.6 kB	22 kB	✅

Runtime dependencies (10)

Package	Dependency	Requested	Resolved	Cost
@nuxtjs/robots	@fingerprintjs/botd	^2.0.0	2.0.0	📦 13 kB gzip
@nuxtjs/robots	@nuxt/kit	^4.5.2	4.5.2	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	consola	^3.4.2	3.4.2	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	defu	^6.1.7	6.1.7	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	h3	^1.15.11	1.15.11	📦 34 kB gzip
@nuxtjs/robots	nuxt-site-config	^4.2.3	4.2.3	📦 10 kB gzip
@nuxtjs/robots	nuxtseo-shared	^5.3.14	5.3.14	📦 23 kB gzip
@nuxtjs/robots	pathe	^2.0.3	2.0.3	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	pkg-types	^2.3.1	2.3.1	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	ufo	^1.6.4	1.6.4	♻️ free via Nuxt 4.5.2

_{Baseline: main_@_4697167___2026-08-21 · gzip is the comparison metric · changes below 16 B gzip are ignored}

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
zod (source)	>=3 → >=4.5.4

---

Release Notes

colinhacks/zod (zod)

v4.5.4

Compare Source

Commits:

• 84e416f fix(v4): stop the cycle walk from firing a default factory (#​6500)
• e8e206f 4.5.4

v4.5.3

Compare Source

v4.5.2

Compare Source

Commits:

• a354314 fix(docs): keep blog posts out of the docs collection (#​6484)
• d378c42 ci: drop canary publishing from the release workflow (#​6487)
• 212b941 fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#​6488)
• e7576f5 docs(blog): let the page show through the navbar in dark mode (#​6489)
• fedb06f fix(docs): match the blog TOC hover bar to the 2px active indicator
• 6c932fc chore: bump devcontainer image to Node 24 (#​6470)
• 6635d9d docs(blog): soften the "method memoization" attribution
• 019ae29 fix(docs): drop ISR on the docs route so the home page hydrates
• 652bb43 chore(docs): drop the scroll log from the route-change scroller
• 571c8e8 fix(docs): render blog tabs with the stock fumadocs tab card
• 9a193aa 4.5.2

v4.5.1

Compare Source

Commits:

• 2e862db ci: gate the GitHub release and JSR publish on the version being live on npm
• 8e03380 4.5.1

v4.5.0

Compare Source

Zod 4.5 is now available.

npm install zod@latest

At a glance:

• z.compile() — the flagship feature of Zod 4.5
• z.creditCard() — 12–19 digits plus Luhn checksum
• z.properties() — the multi-property counterpart to z.property()
• z.deepPartial()/.exactPartial()
• z.validate(): boolean — a fast-path to verify input validity without a full parse (up to 16x faster on invalid data)
• 9x reduction in memory footprint
• New locales: Bengali (bn), Central Kurdish (ckb), Hindi (hi), Kannada (kn), Norwegian Nynorsk (nn), Brazilian Portuguese (pt-BR), Slovak (sk), Turkmen (tk)

z.compile()

You can now pre-compile any Zod schema using z.compile(schema). This dramatically speeds up parsing performance.

import*aszfrom"zod";constPlayer=z.object({username: z.string(),bio: z.string(),xp: z.number()});constCompiledPlayer=z.compile(Player);

A compiled schema can be used exactly like an uncompiled one. There are no special rules around compiled schemas. They're just faster.

Player.parse({ ... });CompiledPlayer.parse({ ... });// ~2x faster

On objects, arrays, and unions, this speeds up parsing by a factor of ~3–7. More complex schemas stand to benefit more than simpler ones.

Time per parse by schema type, standard parser vs compiled — lower is better (benchmark)

Below are the Moltar benchmark results comparing Zod (compiled and uncompiled) against the Moltar ParseSafe bench.

Throughput on the moltar benchmark fixture (parseSafe: returns a new object with unknown keys stripped) — higher is better (benchmark)

And the equivalent results for the Moltar AssertLoose bench. Tested against the new z.validate(schema, input) function (detailed later in the post).

Throughput on the moltar benchmark fixture (assertLoose: returns a boolean, unknown keys allowed) — higher is better (benchmark)

Zod's entire test suite runs twice—once normally and again with auto-compilation enabled globally—to ensure perfect fidelity.

How it works

Under the hood, z.compile() walks the entire schema once and produces a hyperoptimized snippet of flat, loop-free JavaScript that can validate inputs far faster than a standard runtime validator. This snippet can be executed via new Function() (effectively a more powerful eval) to serve as a fast-path validator. Schemas use this to "fast check" validity, falling back to the regular runtime logic on validation failure to provide granular error information.

Take this simple Point schema:

constPoint=z.object({x: z.number(),y: z.number()});

Here is the generated snippet for it:

constisPoint=newFunction("input",` if (typeof input !== "object" || input === null) return false; if (typeof input.x !== "number") return false; if (typeof input.y !== "number") return false; return true;`);isPoint({x: 1,y: 2});// trueisPoint({x: "1"});// false

For the large majority of inputs, the generated function validates the data with the fastest logic JavaScript can express: straight-line typeof checks and property reads, with no interpreter in between. When it can't handle an input, Zod falls back to the standard parser.

This is the function Zod generates for the Player schema above:

if(typeofinput!=="object"||input===null||Array.isArray(input))returnINVALID;constv0=input["username"];if(typeofv0!=="string")returnINVALID;constv1=input["bio"];if(typeofv1!=="string")returnINVALID;constv2=input["xp"];if(typeofv2!=="number"||!Number.isFinite(v2))returnINVALID;constv3={"username": v0,"bio": v1,"xp": v2};returnv3;

Armed with the power of new Function(), this happens in-process at runtime. There is no need to integrate with your build system.

The compiled schema is purely additive on top of the existing schema. It tacks on the pre-compiled fast path for checking valid inputs. When invalid data is detected, it returns the INVALID symbol to signal that parsing should fall back to the uncompiled parser. This structurally prevents subtle deviations in error reporting between compiled and uncompiled variants.

import "zod/compile"

To compile every schema in an application, import zod/compile once at the top of your entry point. Every schema constructed after that import is automatically compiled the first time it's used to parse data.

import"zod/compile";// must come before modules that define schemasimport*aszfrom"zod";constschema=z.object({name: z.string()});schema.parse({name: "ok"});// compiled on first parse

It also works as a Node.js CLI flag, which guarantees it runs before any module defines a schema:

node --import zod/compile app.js

Or set preload in bunfig.toml or nub.jsonc.

{
"preload": ["zod/compile"]
}

All schemas benefit to varying degrees, though complex object/tuple/array schemas benefit more than simple scalar validators.

Read the docs, or the full technical writeup: Introducing z.compile()

z.creditCard()

A new string format: 12–19 digits, optionally separated by single spaces or hyphens, with a valid Luhn checksum. (#​5931)

z.creditCard().parse("4111 1111 1111 1111");// ✅z.creditCard().parse("4111 1111 1111 1112");// ❌ bad checksum

z.properties()

The multi-property counterpart to z.property(). (#​5912)

consthttpsUrl=z.instanceof(URL).check(
...z.properties({protocol: z.literal("https:"asstring),hostname: z.string().regex(z.regexes.domain),}));httpsUrl.parse(newURL("https://example.com"));// ✅httpsUrl.parse(newURL("http://localhost"));// ❌ protocol

z.deepPartial()

Back in functional form after being removed as a method in Zod 4. (#​5928)

constPost=z.object({title: z.string(),author: z.object({name: z.string(),email: z.string()}),});constPartialPost=z.deepPartial(Post);typePartialPost=z.output<typeofPartialPost>;// => { title?: string; author?: { name?: string; email?: string }}PartialPost.parse({author: {}});// ✅

The result is still a ZodObject, so .shape and .extend() keep working.

.exactPartial()

Like .partial(), but wraps each field in z.exactOptional() instead of z.optional(): keys may be omitted, but an explicit undefined is rejected. This matches TypeScript's Partial<> under exactOptionalPropertyTypes. (#​6065)

constRecipe=z.object({title: z.string(),servings: z.number()});constPartialRecipe=Recipe.exactPartial();PartialRecipe.parse({});// ✅PartialRecipe.parse({title: undefined});// ❌

In Zod Mini it's a top-level function: z.exactPartial(Recipe).

z.validate()

Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a ZodError, which makes rejection cheap: on invalid input it is up to 16x faster than .safeParse().success. The return type is a guard on the schema's input type, and z.validateAsync() covers schemas with async refinements. (#​6471)

z.validate(z.string(),"hi");// truez.validate(z.string(),42);// false

z.input() / z.output()

Project a schema onto its input or output side. Useful for validating the two halves of a codec independently. (#​5928)

constisoDate=z.codec(z.iso.datetime(),z.date(),{decode: (s)=>newDate(s),encode: (d)=>d.toISOString(),});constEvent=z.object({name: z.string(),at: isoDate});z.input(Event).parse({name: "launch",at: "2024-01-01T00:00:00Z"});// ✅z.output(Event).parse({name: "launch",at: newDate()});// ✅

This is a no-op on schemas not containing codecs/pipes.

z.toZod<T>()

A utility to define a Zod schema that agrees exactly with a static type, often one that is handwritten or externally defined. (#​5913)

typePlayer={username: string;xp: number};constPlayer=z.toZod<Player>()(z.object({username: z.string(),xp: z.number(),}));Player.shape.username;// ZodString — the schema is returned unchanged

z.getDiscriminatedOption()

Extract a discriminated union member by discriminator value. (#​5947)

constFruit=z.object({type: z.literal("fruit"),seeds: z.boolean()});constVeg=z.object({type: z.literal("vegetable"),leafy: z.boolean()});constProduce=z.discriminatedUnion("type",[Fruit,Veg]);z.getDiscriminatedOption(Produce,"fruit");// typeof Fruitz.getDiscriminatedOption(Produce,"meat");// ❌ TypeScript error

Cyclical inputs

Zod recursive schemas now support cyclical data. For bundle size reasons, Zod Mini requires you to register a memoizer explicitly. (#​6387, #​6482)

Zod

constCategory=z.object({name: z.string(),getsubcategories(){returnz.array(Category);},});constinput: any={name: "root",subcategories: []};input.subcategories.push(input);constresult=Category.parse(input);result.subcategories[0]===result;// true

Zod Mini

// register a memoizer before defining any schemasz.config({memoizer: z.memoizer()});constresult=Category.parse(input);result.subcategories[0]===result;// true

9x reduction in schema memory footprint

In Zod 4.4 a bare z.string() retained 7.5kb of heap. In Zod 4.5 it retains 784 bytes.

Retained heap per schema instance, Zod 4.4.3 vs 4.5 (benchmark)

In Zod 4.4 and earlier, all schema methods were automatically bound to the instance itself. This allowed users to pluck methods from schemas without causing issues due to this-binding.

const{ parse }=z.string();parse("some data");

A consequence of this is that each bound method allocates space on the heap; method implementations are not shared across all instances via prototype, as you'd expect. Zod 4.5 implements a method memoization pattern that avoids allocating bound methods until they are actually accessed.

Read the deep dive: Reducing Zod's memory footprint by an order of magnitude

Faster failures

Zod .parse()/.safeParse() instantiates a JavaScript Error, which captures a stack trace. In the case of validation failures, this is often much slower than the parsing logic itself. When using .safeParse(), Zod no longer captures this stack trace, speeding up failure-path parses by a factor of ~7.5x. (#​6316, #​6450)

constresult=Player.safeParse({username: 42,bio: "hello",xp: 12});result.success;// false — ~7.5x faster than Zod 4.4

Player schema (benchmark)

Symbol keys in z.object()

A shape can now declare a symbol key. TypeScript tracks it: a const symbol infers as unique symbol, so z.infer makes the key required and checks its value type. Undeclared symbol keys are still ignored. (#​6448)

constTAG=Symbol("tag");constschema=z.object({name: z.string(),[TAG]: z.number()});schema.parse({name: "alice",[TAG]: 42});// ✅ { name: "alice", [TAG]: 42 }schema.safeParse({name: "alice"});// ❌ the symbol key is required

Bug fixes

All of these fix soundness issues, so a schema that relied on the old behavior may now reject input it used to accept.

⚠️z.iso.datetime() requires seconds

RFC 3339 mandates seconds. z.iso.datetime() and z.iso.datetime({ offset: true }) no longer accept minute-precision input like 2020-01-01T06:15Z. local: true still admits 2020-01-01T06:15, since an unqualified datetime is outside RFC 3339 either way. (#​6457)

z.iso.datetime().parse("2020-01-01T06:15:00Z");// ✅z.iso.datetime().parse("2020-01-01T06:15Z");// ❌ was accepted in 4.4

To accept both forms, union the two precisions:

z.union([z.iso.datetime(),z.iso.datetime({precision: -1})]);

⚠️ String length counts code points

.min(), .max(), and .length() counted UTF-16 code units, so z.string().max(5) rejected five emoji. They now count Unicode code points, which is what every non-JS consumer of a length bound does (Postgres, MySQL, Go, Python, and the maxLength that z.toJSONSchema() emits). .max() only loosens; .min() and .length() tighten for astral input. Graphemes are unchanged — a ZWJ sequence is still several code points. (#​6441)

z.string().max(5).parse("😀😀😀😀😀");// was too_big, now passesz.string().min(5).parse("😀😀😀");// was fine, now too_small

Closes #​3355.

⚠️ Record keys and intersections match TypeScript

A record's key schema now governs only the keys that match it, the way TypeScript treats an index signature. Intersecting an object with a pattern-keyed record no longer rejects the object's own keys. (#​6412)

z.object({name: z.string()}).and(z.record(z.string().regex(/^S_/),z.string())).parse({name: "a",S_a: "s"});// 4.4: throws invalid_key on "name"// 4.5: { name: "a", S_a: "s" }

Separately, an unrecognized_keys issue no longer aborts the schema it came from, so a strict object with an extra key and a bad value now reports both issues instead of just the first. Closes #​2200, #​2573, #​4017, #​5663.

⚠️__proto__ is always stripped

Object and record parsers now drop a __proto__ key whether it comes from the input, is declared by the schema, or is produced by a record key transform. A key that a record's key schema normalizes to __proto__ is dropped too. .strict() reports an own __proto__ input key as unrecognized_keys instead of silently swallowing it. Error formatters and both JSON Schema converters use own-property writes so a toString or constructor path segment can't walk onto Object.prototype (#​6213, #​6367, #​6346). (#​6386, #​6354, #​6355, #​6221)

⚠️ Stricter string formats

• z.ipv6() validated by handing the string to new URL(), which let ::@1\ and ::1\n through. It now checks the address alphabet directly (#​6442).
• z.ulid() restricts the first character to 0–7; anything higher overflows the 48-bit timestamp. A fixture that doesn't start with a real timestamp, such as one with a leading letter, is now rejected (#​6095).
• z.httpUrl() enforces the RFC 1035 length limits on the host, matching z.hostname() (#​6035).
• z.emoji() no longer backtracks exponentially on a failed match (#​6347).
• z.string().includes(sub, { position: N }) emits a JSON Schema pattern that allows at least N leading characters, matching String.prototype.includes (#​6024).

Commits

Zod 4.5 rolls up 155 commits. Thanks to everyone who contributed: @​dokson, @​deepshekhardas, @​zirkelc, @​francisjohnjohnston-web, @​MerlijnW70, @​codinsonn, @​oimo23, @​JSap0914, @​zelinewang, @​abhishek-chaudhary2003, @​spokodev, @​Mohammad-Faiz-Cloud-Engineer, @​hamed-bavar, @​MGPOCKY, @​ChiChuRita, @​dinwwwh, @​thristhart, @​tsmartin9, @​vedanshshetti, @​belicam, @​frastefanini, @​andersk, @​musaddiq-rafi, @​tachmyratsaparmyradov, @​arvindfroi, @​KUMachine, @​spidersouris, @​catdalfonso, @​mneetika, @​gwagjiug, @​MahinAnowar, @​MaksZhukov, @​emmayusufu, @​agcty, @​devareddy05, @​Vish05, @​yamcodes, @​mattiasahlsen, @​samchungy, @​ozzyfromspace, @​udohjeremiah, @​patrickwehbe, @​gajus, @​Harm-Nullix, @​thwbh, @​IdanGonen, @​irfanfandi, @​JuerGenie, @​marcalexiei, @​itsahmedbilal, @​DucMinhNe, @​meliharik.

• 9782f87c perf(v4): validate without building the output, and keep schemas out of dictionary mode (#​6480) by @​colinhacks
• 773a4867 refactor(v4): declare a trait's members on $constructor (#​6478) by @​colinhacks
• 68fb3f13 feat(v4): make z.compile() fall back instead of throwing (#​6479) by @​colinhacks
• 37b01501 feat(v4): add z.isValid and z.isValidAsync (#​6471) by @​colinhacks
• 749f5452 docs: add fullproduct.dev to v4 ecosystem page (#​6001) by @​codinsonn
• 24cdb7fd perf(v4): close the fastpass bindings into the compiled parser (#​6464) by @​colinhacks
• 8d896186 fix(v4): stop emitting a multipleOf that JSON Schema rejects (#​6468) by @​colinhacks
• 43f729db feat(v4): make a tuple's items optional with .partial() (#​6465) by @​colinhacks
• 97edaf7d fix(v4): don't throw from safeParse on bigint multipleOf(0n) (#​6466) by @​colinhacks
• 21a6f0cb feat(v4): let z.nanoid() take a custom length (#​4004) by @​oimo23
• 9d5b20ef fix(v4): restrict the first ULID character to [0-7] (#​6095) by @​JSap0914
• 1cf9cd09 docs: record that error maps run per parse, and how to translate at render by @​colinhacks
• 7ce3e77d fix(v4): run a wrapper's inner schema on its own payload (#​6462) by @​colinhacks
• 7b612b53 fix(v4): fold an intersection of object schemas into one object (#​6461) by @​colinhacks
• 1c43b774 docs(v4): record why the failure path is not worth compiling by @​colinhacks
• badf0b78 fix(v4): build the catch context from the input that failed (#​6192) by @​zelinewang
• a87ac366 fix(v4)!: distinguish number and bigint formats at the type level (#​6052) by @​abhishek-chaudhary2003
• 6726c1dd docs: record what z.input and z.output do with transforms and wrappers by @​colinhacks
• 7cfc0122 fix(v4): keep a wrapper's stored value only on the side it belongs to by @​colinhacks
• a825c1b0 fix(v4): empty enums and literals match nothing (#​6459) by @​colinhacks
• 7c070db9 feat(v4): expose the function schema on .implement() results (#​6267) by @​deepshekhardas
• 3a496968 fix(v4): make record input keys optional when the value can fill them (#​6460) by @​colinhacks
• 53cec2a0 fix(v4): resolve z.input past a preprocess transform by @​colinhacks
• 2125d30c fix(v4): accept exact decimal multiples in multipleOf (#​6223) by @​spokodev
• 168122fc fix(v4): carry a pipe's own checks through z.output by @​colinhacks
• 51a1368a fix(v4): let the includes(position) pattern match at or after the offset (#​6024) by @​francisjohnjohnston-web
• 72a05c4f feat(v4): expose stringbool truthy/falsy/case via _zod.bag (#​6357) by @​hamed-bavar
• 036b39f4 fix(v4)!: require seconds once a datetime carries a Z or an offset (#​6457) by @​colinhacks
• 5825605e perf(v4): skip the eager stack capture when building a ZodError (#​6450) by @​colinhacks
• d85472c4 feat(v4): support declared symbol keys in z.object() (#​6448) by @​colinhacks
• d4108872 fix(v4): correct the date/time format keywords in both JSON Schema directions (#​6452) by @​colinhacks
• 555e5f46 Add z.toZod helper (#​5913) by @​colinhacks
• e0e51a55 docs(v4): cut the compile comments down to what they explain (#​6449) by @​colinhacks
• 6574e784 fix(v4): stop catch resurrecting issues an optional already resolved (#​6440) by @​colinhacks
• 937b5d01 perf(v4): prefix issue paths in place in the object JIT failure path (#​6445) by @​colinhacks
• b63db248 fix(v4): keep a memoized node's cached issues private to the cache (#​6443) by @​colinhacks
• 6ec3d043 fix(resolution): keep pnpm's own warnings out of the attw snapshot (#​6446) by @​colinhacks
• 830ba314 fix(v4): validate the address, and return the string that was validated (#​6442) by @​colinhacks
• f101d8ca Preserve callsites in parse stack traces (#​5910) by @​colinhacks
• 6c77d028 feat: compact simple anyOf unions to type array in toJSONSchema (#​6339) by @​deepshekhardas
• 28e1ebd8 fix(v4): measure string length in Unicode code points (#​6441) by @​colinhacks
• 060bc9f3 refactor: share default when-clauses for size/length checks (#​6394) by @​zirkelc
• 2848177d docs: point the flattened/formatted error deprecations at a symbol that exists by @​colinhacks
• 3c2dee9e Add properties checks for instanceof schemas (#​5912) by @​colinhacks
• 87ffeb0f fix(v4): an absent key on the middle rung supplies nothing (#​6434) by @​colinhacks
• 7785fc82 feat(v4): add z.getDiscriminatedOption (#​5947) by @​dokson
• 0135c85a feat(v4): allow passing extra args to apply() (#​6337) by @​deepshekhardas
• ca246d26 fix(v4): drop empty alternation branch from datetime pattern (#​6439) by @​colinhacks
• e073d55b docs: z.iso.datetime() accepts a subset of ISO 8601, not all of it by @​colinhacks
• d6ca12ae fix(v4): infer recursive getter options in discriminatedUnion (#​6422) by @​colinhacks
• dc51404b Add shorn to Zod Utilities (#​6398) by @​ChiChuRita
• 580111da docs: mark AOT compilation as canary-only by @​colinhacks
• 6b0dae79 docs: note that a catch callback is not islanded by @​colinhacks
• 898c4461 refactor(v4): give the runtime and compiled code one URL implementation by @​colinhacks
• 260e5d4b fix(v4): stop islanding a catch callback, which diverged silently by @​colinhacks
• 11c9268b revert(core): drop the exactOptional parse prototype from #​6432 (#​6438) by @​colinhacks
• a38ab4a8 fix(core): an omittable discriminator claims undefined (#​6432) by @​colinhacks
• c9ec89e0 perf(core): drop the seal and the per-key WeakSet from the lazy internals (#​6435) by @​colinhacks
• 3c9ca1d9 feat(json-schema): emit a root $ref when the root schema has an id (#​6029) by @​dinwwwh
• fa77a4d7 feat(v4): z.compile — ahead-of-time schema compilation (#​6085) by @​colinhacks
• f300476d fix(v4): let a schema's error map cover its own checks' issues (#​6426) by @​colinhacks
• 9f0a3d81 fix(core): restore defineLazy semantics lost in the internals move (#​6429) by @​colinhacks
• 604464c3 fix(locales): da/nn/no/sv called an IP address a range (#​6430) by @​colinhacks
• 7378e7cd fix(locales): backfill the mac and Sizable.map gaps, and pin dictionary parity (#​6427) by @​colinhacks
• b1077f05 perf(memory): install derived internals on a per-constructor prototype (#​6415) by @​colinhacks
• ccc15144 fix(locales): add the credit_card key to the seven locales missing it (#​6424) by @​colinhacks
• 73bacbbb fix(from-json-schema): drop redundant inclusive bound for draft-04 exclusive ranges (#​6022) by @​francisjohnjohnston-web
• 86b2e6da docs: list el and hr in the supported locales (#​6423) by @​colinhacks
• 45fdeda5 fix(v4): refine optin into a three-rung ladder, retire the fallback payload flag (#​6419) by @​colinhacks
• 5b34c0ce Improve Portuguese localization and add Brazilian Portuguese (pt-BR) (#​6076) by @​thristhart
• dc1a40a5 fix(locales): improve french translation (#​6120) by @​tsmartin9
• 0175a043 feat(locales): add Hindi and Kannada locale support (#​6315) by @​vedanshshetti
• 536ee3b0 Locales: added Slovak (sk) language (#​6041) by @​belicam
• 07b0c3d8 fix: preserve explicit superRefine issue input (#​6053) by @​frastefanini
• ba98071c feat: add .exactPartial() to ZodObject (#​6065) by @​andersk
• 234c407d feat(lang): Added Bengali locale (#​5974) by @​musaddiq-rafi
• 377cd9d7 feat(locales): add turkmen (tk) locale (#​6168) by @​tachmyratsaparmyradov
• 69b6bb08 feat(locales): add Norwegian Nynorsk (nn) locale (#​6092) by @​arvindfroi
• 33d82e6b Add Central Kurdish (ckb) locale (#​6078) by @​KUMachine
• 06666fe2 fix(fr): remove hyphen in "non-optionnel" (#​5999) by @​spidersouris
• 79cfedea feat(v4): expose the owning schema on check-originated issues (#​6420) by @​colinhacks
• 436b5da8 docs: propose compiled constructor graph by @​colinhacks
• eb4682c9 fix(json-schema): resolve tuple minItems past transform and catch in input mode (#​6418) by @​colinhacks
• 4d6b5cd3 fix(json-schema): route unrepresentable default values through unrepresentable by @​colinhacks
• 2abc9e05 docs: note that the JSON Schema emitter reads static optin (#​6417) by @​colinhacks
• 578e1cd0 feat(v4): support format: "hostname" in fromJSONSchema (#​6305) by @​catdalfonso
• 942bf8cb feat(v4): parse input containing reference cycles (#​6387) by @​colinhacks
• 78b523f0 fix(json-schema): keep preprocess object properties required in input mode (#​6133) by @​MerlijnW70
• 973b1b44 fix(v4): strip output-typed catch values from the input JSON Schema (#​6409) by @​colinhacks
• 5e608851 feat(v4): add z.deepPartial and runtime z.input / z.output (#​5928) by @​dokson
• 4e1720c8 fix(v4): align record keys and intersection strictness with TypeScript (#​6412) by @​colinhacks
• 4cc4053d fix: honor loose mode for closed record key schemas (#​6157) by @​pullfrog[bot]
• 69be843f fix(v4): stop the object JIT fastpass keeping a swallowed issue's value (#​6407) by @​colinhacks
• b899cd17 perf(json-schema): make toJSONSchema(registry) linear in registry size (#​6408) by @​colinhacks
• 6074828e fix(v4): make fromJSONSchema propertyNames compose with the other object keywords (#​6411) by @​colinhacks
• d7b209f3 docs: point the Web URLs callout at z.httpUrl() (#​6410) by @​colinhacks
• 611bd762 fix(mini): make merge() take an object schema, matching classic (#​6404) by @​colinhacks
• b53e53cc fix(v4): use exact flag in English locale too_small/too_big messages (#​6177) by @​pullfrog[bot]
• 421cc9a5 fix(json-schema): unescape JSON Pointer tokens when resolving $ref (#​6402) by @​colinhacks
• 4c27fe87 fix(v4): give z.xor() a distinct error when multiple options match (#​6376) by @​colinhacks
• a106fbe7 fix(v4): make fromJSONSchema tuples open-ended by default (#​6020) by @​mneetika
• e8034eba fix(v4): make prefixItems/draft-7 items respect minItems in fromJSONSchema (#​6201) by @​pullfrog[bot]
• 784e5c26 fix(v4): let bundlers tree-shake locales out of the default import (#​6384) by @​colinhacks
• 97edd70a fix(toJSONSchema): constrain closed tuple length (#​6194) by @​pullfrog[bot]
• f150020d fix(v4): escape non-string enum values in template literal patterns (#​5934) by @​gwagjiug
• faf33a28 fix: surface @​deprecated on re-exported compat aliases (#​6072) by @​MahinAnowar
• 3956224a docs: state that metadata wins over generated JSON Schema keywords (#​6401) by @​colinhacks
• a1904fc2 fix(v4): report date origin for numeric min/max bounds (#​6129) by @​MerlijnW70
• bd18314c fix: escape JSON Pointer reserved characters in toJSONSchema $ref (closes #​6027) (#​6144) by @​MaksZhukov
• 2a5164f5 fix(v4): enforce RFC 1035 length limits in regexes.domain (#​6035) by @​emmayusufu
• 0e5bc4b1 fix(v4): respect additionalProperties:false with patternProperties in fromJSONSchema (#​6199) by @​pullfrog[bot]
• c8f06d36 fix(v4): clarify infinite number errors (#​5906) by @​colinhacks

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@nuxtjs/robots@255

commit: 3659cba

[github-actions]

📦 Package Size

✅ No notable size changes

All tracked output (10)

Package output	Gzipped	Raw
@nuxtjs/robots · dependency @fingerprintjs/botd	13 kB	55 kB	✅
@nuxtjs/robots · dependency h3	34 kB	146 kB	✅
@nuxtjs/robots · dependency nuxt-site-config	10 kB	25 kB	✅
@nuxtjs/robots · dependency nuxtseo-shared	23 kB	76 kB	✅
@nuxtjs/robots · export .	5.3 kB	20 kB	✅
@nuxtjs/robots · export ./content	292 B	503 B	✅
@nuxtjs/robots · export ./util	6.6 kB	25 kB	✅
@nuxtjs/robots · published payload	36 kB	121 kB	✅
@nuxtjs/robots · app runtime	2.5 kB	6.2 kB	✅
@nuxtjs/robots · server runtime	8.6 kB	22 kB	✅

Runtime dependencies (10)

Package	Dependency	Requested	Resolved	Cost
@nuxtjs/robots	@fingerprintjs/botd	^2.0.0	2.0.0	📦 13 kB gzip
@nuxtjs/robots	@nuxt/kit	^4.5.2	4.5.2	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	consola	^3.4.2	3.4.2	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	defu	^6.1.7	6.1.7	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	h3	^1.15.11	1.15.11	📦 34 kB gzip
@nuxtjs/robots	nuxt-site-config	^4.2.3	4.2.3	📦 10 kB gzip
@nuxtjs/robots	nuxtseo-shared	^5.3.14	5.3.14	📦 23 kB gzip
@nuxtjs/robots	pathe	^2.0.3	2.0.3	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	pkg-types	^2.3.1	2.3.1	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	ufo	^1.6.4	1.6.4	♻️ free via Nuxt 4.5.2

_{Baseline: main_@_4697167___2026-08-21 · gzip is the comparison metric · changes below 16 B gzip are ignored}

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
zod (source)	>=3 → >=4.5.4

---

Release Notes

colinhacks/zod (zod)

v4.5.4

Compare Source

Commits:

• 84e416f fix(v4): stop the cycle walk from firing a default factory (#​6500)
• e8e206f 4.5.4

v4.5.3

Compare Source

v4.5.2

Compare Source

Commits:

• a354314 fix(docs): keep blog posts out of the docs collection (#​6484)
• d378c42 ci: drop canary publishing from the release workflow (#​6487)
• 212b941 fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#​6488)
• e7576f5 docs(blog): let the page show through the navbar in dark mode (#​6489)
• fedb06f fix(docs): match the blog TOC hover bar to the 2px active indicator
• 6c932fc chore: bump devcontainer image to Node 24 (#​6470)
• 6635d9d docs(blog): soften the "method memoization" attribution
• 019ae29 fix(docs): drop ISR on the docs route so the home page hydrates
• 652bb43 chore(docs): drop the scroll log from the route-change scroller
• 571c8e8 fix(docs): render blog tabs with the stock fumadocs tab card
• 9a193aa 4.5.2

v4.5.1

Compare Source

Commits:

• 2e862db ci: gate the GitHub release and JSR publish on the version being live on npm
• 8e03380 4.5.1

v4.5.0

Compare Source

Zod 4.5 is now available.

npm install zod@latest

At a glance:

• z.compile() — the flagship feature of Zod 4.5
• z.creditCard() — 12–19 digits plus Luhn checksum
• z.properties() — the multi-property counterpart to z.property()
• z.deepPartial()/.exactPartial()
• z.validate(): boolean — a fast-path to verify input validity without a full parse (up to 16x faster on invalid data)
• 9x reduction in memory footprint
• New locales: Bengali (bn), Central Kurdish (ckb), Hindi (hi), Kannada (kn), Norwegian Nynorsk (nn), Brazilian Portuguese (pt-BR), Slovak (sk), Turkmen (tk)

z.compile()

You can now pre-compile any Zod schema using z.compile(schema). This dramatically speeds up parsing performance.

import*aszfrom"zod";constPlayer=z.object({username: z.string(),bio: z.string(),xp: z.number()});constCompiledPlayer=z.compile(Player);

A compiled schema can be used exactly like an uncompiled one. There are no special rules around compiled schemas. They're just faster.

Player.parse({ ... });CompiledPlayer.parse({ ... });// ~2x faster

On objects, arrays, and unions, this speeds up parsing by a factor of ~3–7. More complex schemas stand to benefit more than simpler ones.

Time per parse by schema type, standard parser vs compiled — lower is better (benchmark)

Below are the Moltar benchmark results comparing Zod (compiled and uncompiled) against the Moltar ParseSafe bench.

Throughput on the moltar benchmark fixture (parseSafe: returns a new object with unknown keys stripped) — higher is better (benchmark)

And the equivalent results for the Moltar AssertLoose bench. Tested against the new z.validate(schema, input) function (detailed later in the post).

Throughput on the moltar benchmark fixture (assertLoose: returns a boolean, unknown keys allowed) — higher is better (benchmark)

Zod's entire test suite runs twice—once normally and again with auto-compilation enabled globally—to ensure perfect fidelity.

How it works

Under the hood, z.compile() walks the entire schema once and produces a hyperoptimized snippet of flat, loop-free JavaScript that can validate inputs far faster than a standard runtime validator. This snippet can be executed via new Function() (effectively a more powerful eval) to serve as a fast-path validator. Schemas use this to "fast check" validity, falling back to the regular runtime logic on validation failure to provide granular error information.

Take this simple Point schema:

constPoint=z.object({x: z.number(),y: z.number()});

Here is the generated snippet for it:

constisPoint=newFunction("input",` if (typeof input !== "object" || input === null) return false; if (typeof input.x !== "number") return false; if (typeof input.y !== "number") return false; return true;`);isPoint({x: 1,y: 2});// trueisPoint({x: "1"});// false

For the large majority of inputs, the generated function validates the data with the fastest logic JavaScript can express: straight-line typeof checks and property reads, with no interpreter in between. When it can't handle an input, Zod falls back to the standard parser.

This is the function Zod generates for the Player schema above:

if(typeofinput!=="object"||input===null||Array.isArray(input))returnINVALID;constv0=input["username"];if(typeofv0!=="string")returnINVALID;constv1=input["bio"];if(typeofv1!=="string")returnINVALID;constv2=input["xp"];if(typeofv2!=="number"||!Number.isFinite(v2))returnINVALID;constv3={"username": v0,"bio": v1,"xp": v2};returnv3;

Armed with the power of new Function(), this happens in-process at runtime. There is no need to integrate with your build system.

The compiled schema is purely additive on top of the existing schema. It tacks on the pre-compiled fast path for checking valid inputs. When invalid data is detected, it returns the INVALID symbol to signal that parsing should fall back to the uncompiled parser. This structurally prevents subtle deviations in error reporting between compiled and uncompiled variants.

import "zod/compile"

To compile every schema in an application, import zod/compile once at the top of your entry point. Every schema constructed after that import is automatically compiled the first time it's used to parse data.

import"zod/compile";// must come before modules that define schemasimport*aszfrom"zod";constschema=z.object({name: z.string()});schema.parse({name: "ok"});// compiled on first parse

It also works as a Node.js CLI flag, which guarantees it runs before any module defines a schema:

node --import zod/compile app.js

Or set preload in bunfig.toml or nub.jsonc.

{
"preload": ["zod/compile"]
}

All schemas benefit to varying degrees, though complex object/tuple/array schemas benefit more than simple scalar validators.

Read the docs, or the full technical writeup: Introducing z.compile()

z.creditCard()

A new string format: 12–19 digits, optionally separated by single spaces or hyphens, with a valid Luhn checksum. (#​5931)

z.creditCard().parse("4111 1111 1111 1111");// ✅z.creditCard().parse("4111 1111 1111 1112");// ❌ bad checksum

z.properties()

The multi-property counterpart to z.property(). (#​5912)

consthttpsUrl=z.instanceof(URL).check(
...z.properties({protocol: z.literal("https:"asstring),hostname: z.string().regex(z.regexes.domain),}));httpsUrl.parse(newURL("https://example.com"));// ✅httpsUrl.parse(newURL("http://localhost"));// ❌ protocol

z.deepPartial()

Back in functional form after being removed as a method in Zod 4. (#​5928)

constPost=z.object({title: z.string(),author: z.object({name: z.string(),email: z.string()}),});constPartialPost=z.deepPartial(Post);typePartialPost=z.output<typeofPartialPost>;// => { title?: string; author?: { name?: string; email?: string }}PartialPost.parse({author: {}});// ✅

The result is still a ZodObject, so .shape and .extend() keep working.

.exactPartial()

Like .partial(), but wraps each field in z.exactOptional() instead of z.optional(): keys may be omitted, but an explicit undefined is rejected. This matches TypeScript's Partial<> under exactOptionalPropertyTypes. (#​6065)

constRecipe=z.object({title: z.string(),servings: z.number()});constPartialRecipe=Recipe.exactPartial();PartialRecipe.parse({});// ✅PartialRecipe.parse({title: undefined});// ❌

In Zod Mini it's a top-level function: z.exactPartial(Recipe).

z.validate()

Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a ZodError, which makes rejection cheap: on invalid input it is up to 16x faster than .safeParse().success. The return type is a guard on the schema's input type, and z.validateAsync() covers schemas with async refinements. (#​6471)

z.validate(z.string(),"hi");// truez.validate(z.string(),42);// false

z.input() / z.output()

Project a schema onto its input or output side. Useful for validating the two halves of a codec independently. (#​5928)

constisoDate=z.codec(z.iso.datetime(),z.date(),{decode: (s)=>newDate(s),encode: (d)=>d.toISOString(),});constEvent=z.object({name: z.string(),at: isoDate});z.input(Event).parse({name: "launch",at: "2024-01-01T00:00:00Z"});// ✅z.output(Event).parse({name: "launch",at: newDate()});// ✅

This is a no-op on schemas not containing codecs/pipes.

z.toZod<T>()

A utility to define a Zod schema that agrees exactly with a static type, often one that is handwritten or externally defined. (#​5913)

typePlayer={username: string;xp: number};constPlayer=z.toZod<Player>()(z.object({username: z.string(),xp: z.number(),}));Player.shape.username;// ZodString — the schema is returned unchanged

z.getDiscriminatedOption()

Extract a discriminated union member by discriminator value. (#​5947)

constFruit=z.object({type: z.literal("fruit"),seeds: z.boolean()});constVeg=z.object({type: z.literal("vegetable"),leafy: z.boolean()});constProduce=z.discriminatedUnion("type",[Fruit,Veg]);z.getDiscriminatedOption(Produce,"fruit");// typeof Fruitz.getDiscriminatedOption(Produce,"meat");// ❌ TypeScript error

Cyclical inputs

Zod recursive schemas now support cyclical data. For bundle size reasons, Zod Mini requires you to register a memoizer explicitly. (#​6387, #​6482)

Zod

constCategory=z.object({name: z.string(),getsubcategories(){returnz.array(Category);},});constinput: any={name: "root",subcategories: []};input.subcategories.push(input);constresult=Category.parse(input);result.subcategories[0]===result;// true

Zod Mini

// register a memoizer before defining any schemasz.config({memoizer: z.memoizer()});constresult=Category.parse(input);result.subcategories[0]===result;// true

9x reduction in schema memory footprint

In Zod 4.4 a bare z.string() retained 7.5kb of heap. In Zod 4.5 it retains 784 bytes.

Retained heap per schema instance, Zod 4.4.3 vs 4.5 (benchmark)

In Zod 4.4 and earlier, all schema methods were automatically bound to the instance itself. This allowed users to pluck methods from schemas without causing issues due to this-binding.

const{ parse }=z.string();parse("some data");

A consequence of this is that each bound method allocates space on the heap; method implementations are not shared across all instances via prototype, as you'd expect. Zod 4.5 implements a method memoization pattern that avoids allocating bound methods until they are actually accessed.

Read the deep dive: Reducing Zod's memory footprint by an order of magnitude

Faster failures

Zod .parse()/.safeParse() instantiates a JavaScript Error, which captures a stack trace. In the case of validation failures, this is often much slower than the parsing logic itself. When using .safeParse(), Zod no longer captures this stack trace, speeding up failure-path parses by a factor of ~7.5x. (#​6316, #​6450)

constresult=Player.safeParse({username: 42,bio: "hello",xp: 12});result.success;// false — ~7.5x faster than Zod 4.4

Player schema (benchmark)

Symbol keys in z.object()

A shape can now declare a symbol key. TypeScript tracks it: a const symbol infers as unique symbol, so z.infer makes the key required and checks its value type. Undeclared symbol keys are still ignored. (#​6448)

constTAG=Symbol("tag");constschema=z.object({name: z.string(),[TAG]: z.number()});schema.parse({name: "alice",[TAG]: 42});// ✅ { name: "alice", [TAG]: 42 }schema.safeParse({name: "alice"});// ❌ the symbol key is required

Bug fixes

All of these fix soundness issues, so a schema that relied on the old behavior may now reject input it used to accept.

⚠️z.iso.datetime() requires seconds

RFC 3339 mandates seconds. z.iso.datetime() and z.iso.datetime({ offset: true }) no longer accept minute-precision input like 2020-01-01T06:15Z. local: true still admits 2020-01-01T06:15, since an unqualified datetime is outside RFC 3339 either way. (#​6457)

z.iso.datetime().parse("2020-01-01T06:15:00Z");// ✅z.iso.datetime().parse("2020-01-01T06:15Z");// ❌ was accepted in 4.4

To accept both forms, union the two precisions:

z.union([z.iso.datetime(),z.iso.datetime({precision: -1})]);

⚠️ String length counts code points

.min(), .max(), and .length() counted UTF-16 code units, so z.string().max(5) rejected five emoji. They now count Unicode code points, which is what every non-JS consumer of a length bound does (Postgres, MySQL, Go, Python, and the maxLength that z.toJSONSchema() emits). .max() only loosens; .min() and .length() tighten for astral input. Graphemes are unchanged — a ZWJ sequence is still several code points. (#​6441)

z.string().max(5).parse("😀😀😀😀😀");// was too_big, now passesz.string().min(5).parse("😀😀😀");// was fine, now too_small

Closes #​3355.

⚠️ Record keys and intersections match TypeScript

A record's key schema now governs only the keys that match it, the way TypeScript treats an index signature. Intersecting an object with a pattern-keyed record no longer rejects the object's own keys. (#​6412)

z.object({name: z.string()}).and(z.record(z.string().regex(/^S_/),z.string())).parse({name: "a",S_a: "s"});// 4.4: throws invalid_key on "name"// 4.5: { name: "a", S_a: "s" }

Separately, an unrecognized_keys issue no longer aborts the schema it came from, so a strict object with an extra key and a bad value now reports both issues instead of just the first. Closes #​2200, #​2573, #​4017, #​5663.

⚠️__proto__ is always stripped

Object and record parsers now drop a __proto__ key whether it comes from the input, is declared by the schema, or is produced by a record key transform. A key that a record's key schema normalizes to __proto__ is dropped too. .strict() reports an own __proto__ input key as unrecognized_keys instead of silently swallowing it. Error formatters and both JSON Schema converters use own-property writes so a toString or constructor path segment can't walk onto Object.prototype (#​6213, #​6367, #​6346). (#​6386, #​6354, #​6355, #​6221)

⚠️ Stricter string formats

• z.ipv6() validated by handing the string to new URL(), which let ::@1\ and ::1\n through. It now checks the address alphabet directly (#​6442).
• z.ulid() restricts the first character to 0–7; anything higher overflows the 48-bit timestamp. A fixture that doesn't start with a real timestamp, such as one with a leading letter, is now rejected (#​6095).
• z.httpUrl() enforces the RFC 1035 length limits on the host, matching z.hostname() (#​6035).
• z.emoji() no longer backtracks exponentially on a failed match (#​6347).
• z.string().includes(sub, { position: N }) emits a JSON Schema pattern that allows at least N leading characters, matching String.prototype.includes (#​6024).

Commits

Zod 4.5 rolls up 155 commits. Thanks to everyone who contributed: @​dokson, @​deepshekhardas, @​zirkelc, @​francisjohnjohnston-web, @​MerlijnW70, @​codinsonn, @​oimo23, @​JSap0914, @​zelinewang, @​abhishek-chaudhary2003, @​spokodev, @​Mohammad-Faiz-Cloud-Engineer, @​hamed-bavar, @​MGPOCKY, @​ChiChuRita, @​dinwwwh, @​thristhart, @​tsmartin9, @​vedanshshetti, @​belicam, @​frastefanini, @​andersk, @​musaddiq-rafi, @​tachmyratsaparmyradov, @​arvindfroi, @​KUMachine, @​spidersouris, @​catdalfonso, @​mneetika, @​gwagjiug, @​MahinAnowar, @​MaksZhukov, @​emmayusufu, @​agcty, @​devareddy05, @​Vish05, @​yamcodes, @​mattiasahlsen, @​samchungy, @​ozzyfromspace, @​udohjeremiah, @​patrickwehbe, @​gajus, @​Harm-Nullix, @​thwbh, @​IdanGonen, @​irfanfandi, @​JuerGenie, @​marcalexiei, @​itsahmedbilal, @​DucMinhNe, @​meliharik.

• 9782f87c perf(v4): validate without building the output, and keep schemas out of dictionary mode (#​6480) by @​colinhacks
• 773a4867 refactor(v4): declare a trait's members on $constructor (#​6478) by @​colinhacks
• 68fb3f13 feat(v4): make z.compile() fall back instead of throwing (#​6479) by @​colinhacks
• 37b01501 feat(v4): add z.isValid and z.isValidAsync (#​6471) by @​colinhacks
• 749f5452 docs: add fullproduct.dev to v4 ecosystem page (#​6001) by @​codinsonn
• 24cdb7fd perf(v4): close the fastpass bindings into the compiled parser (#​6464) by @​colinhacks
• 8d896186 fix(v4): stop emitting a multipleOf that JSON Schema rejects (#​6468) by @​colinhacks
• 43f729db feat(v4): make a tuple's items optional with .partial() (#​6465) by @​colinhacks
• 97edaf7d fix(v4): don't throw from safeParse on bigint multipleOf(0n) (#​6466) by @​colinhacks
• 21a6f0cb feat(v4): let z.nanoid() take a custom length (#​4004) by @​oimo23
• 9d5b20ef fix(v4): restrict the first ULID character to [0-7] (#​6095) by @​JSap0914
• 1cf9cd09 docs: record that error maps run per parse, and how to translate at render by @​colinhacks
• 7ce3e77d fix(v4): run a wrapper's inner schema on its own payload (#​6462) by @​colinhacks
• 7b612b53 fix(v4): fold an intersection of object schemas into one object (#​6461) by @​colinhacks
• 1c43b774 docs(v4): record why the failure path is not worth compiling by @​colinhacks
• badf0b78 fix(v4): build the catch context from the input that failed (#​6192) by @​zelinewang
• a87ac366 fix(v4)!: distinguish number and bigint formats at the type level (#​6052) by @​abhishek-chaudhary2003
• 6726c1dd docs: record what z.input and z.output do with transforms and wrappers by @​colinhacks
• 7cfc0122 fix(v4): keep a wrapper's stored value only on the side it belongs to by @​colinhacks
• a825c1b0 fix(v4): empty enums and literals match nothing (#​6459) by @​colinhacks
• 7c070db9 feat(v4): expose the function schema on .implement() results (#​6267) by @​deepshekhardas
• 3a496968 fix(v4): make record input keys optional when the value can fill them (#​6460) by @​colinhacks
• 53cec2a0 fix(v4): resolve z.input past a preprocess transform by @​colinhacks
• 2125d30c fix(v4): accept exact decimal multiples in multipleOf (#​6223) by @​spokodev
• 168122fc fix(v4): carry a pipe's own checks through z.output by @​colinhacks
• 51a1368a fix(v4): let the includes(position) pattern match at or after the offset (#​6024) by @​francisjohnjohnston-web
• 72a05c4f feat(v4): expose stringbool truthy/falsy/case via _zod.bag (#​6357) by @​hamed-bavar
• 036b39f4 fix(v4)!: require seconds once a datetime carries a Z or an offset (#​6457) by @​colinhacks
• 5825605e perf(v4): skip the eager stack capture when building a ZodError (#​6450) by @​colinhacks
• d85472c4 feat(v4): support declared symbol keys in z.object() (#​6448) by @​colinhacks
• d4108872 fix(v4): correct the date/time format keywords in both JSON Schema directions (#​6452) by @​colinhacks
• 555e5f46 Add z.toZod helper (#​5913) by @​colinhacks
• e0e51a55 docs(v4): cut the compile comments down to what they explain (#​6449) by @​colinhacks
• 6574e784 fix(v4): stop catch resurrecting issues an optional already resolved (#​6440) by @​colinhacks
• 937b5d01 perf(v4): prefix issue paths in place in the object JIT failure path (#​6445) by @​colinhacks
• b63db248 fix(v4): keep a memoized node's cached issues private to the cache (#​6443) by @​colinhacks
• 6ec3d043 fix(resolution): keep pnpm's own warnings out of the attw snapshot (#​6446) by @​colinhacks
• 830ba314 fix(v4): validate the address, and return the string that was validated (#​6442) by @​colinhacks
• f101d8ca Preserve callsites in parse stack traces (#​5910) by @​colinhacks
• 6c77d028 feat: compact simple anyOf unions to type array in toJSONSchema (#​6339) by @​deepshekhardas
• 28e1ebd8 fix(v4): measure string length in Unicode code points (#​6441) by @​colinhacks
• 060bc9f3 refactor: share default when-clauses for size/length checks (#​6394) by @​zirkelc
• 2848177d docs: point the flattened/formatted error deprecations at a symbol that exists by @​colinhacks
• 3c2dee9e Add properties checks for instanceof schemas (#​5912) by @​colinhacks
• 87ffeb0f fix(v4): an absent key on the middle rung supplies nothing (#​6434) by @​colinhacks
• 7785fc82 feat(v4): add z.getDiscriminatedOption (#​5947) by @​dokson
• 0135c85a feat(v4): allow passing extra args to apply() (#​6337) by @​deepshekhardas
• ca246d26 fix(v4): drop empty alternation branch from datetime pattern (#​6439) by @​colinhacks
• e073d55b docs: z.iso.datetime() accepts a subset of ISO 8601, not all of it by @​colinhacks
• d6ca12ae fix(v4): infer recursive getter options in discriminatedUnion (#​6422) by @​colinhacks
• dc51404b Add shorn to Zod Utilities (#​6398) by @​ChiChuRita
• 580111da docs: mark AOT compilation as canary-only by @​colinhacks
• 6b0dae79 docs: note that a catch callback is not islanded by @​colinhacks
• 898c4461 refactor(v4): give the runtime and compiled code one URL implementation by @​colinhacks
• 260e5d4b fix(v4): stop islanding a catch callback, which diverged silently by @​colinhacks
• 11c9268b revert(core): drop the exactOptional parse prototype from #​6432 (#​6438) by @​colinhacks
• a38ab4a8 fix(core): an omittable discriminator claims undefined (#​6432) by @​colinhacks
• c9ec89e0 perf(core): drop the seal and the per-key WeakSet from the lazy internals (#​6435) by @​colinhacks
• 3c9ca1d9 feat(json-schema): emit a root $ref when the root schema has an id (#​6029) by @​dinwwwh
• fa77a4d7 feat(v4): z.compile — ahead-of-time schema compilation (#​6085) by @​colinhacks
• f300476d fix(v4): let a schema's error map cover its own checks' issues (#​6426) by @​colinhacks
• 9f0a3d81 fix(core): restore defineLazy semantics lost in the internals move (#​6429) by @​colinhacks
• 604464c3 fix(locales): da/nn/no/sv called an IP address a range (#​6430) by @​colinhacks
• 7378e7cd fix(locales): backfill the mac and Sizable.map gaps, and pin dictionary parity (#​6427) by @​colinhacks
• b1077f05 perf(memory): install derived internals on a per-constructor prototype (#​6415) by @​colinhacks
• ccc15144 fix(locales): add the credit_card key to the seven locales missing it (#​6424) by @​colinhacks
• 73bacbbb fix(from-json-schema): drop redundant inclusive bound for draft-04 exclusive ranges (#​6022) by @​francisjohnjohnston-web
• 86b2e6da docs: list el and hr in the supported locales (#​6423) by @​colinhacks
• 45fdeda5 fix(v4): refine optin into a three-rung ladder, retire the fallback payload flag (#​6419) by @​colinhacks
• 5b34c0ce Improve Portuguese localization and add Brazilian Portuguese (pt-BR) (#​6076) by @​thristhart
• dc1a40a5 fix(locales): improve french translation (#​6120) by @​tsmartin9
• 0175a043 feat(locales): add Hindi and Kannada locale support (#​6315) by @​vedanshshetti
• 536ee3b0 Locales: added Slovak (sk) language (#​6041) by @​belicam
• 07b0c3d8 fix: preserve explicit superRefine issue input (#​6053) by @​frastefanini
• ba98071c feat: add .exactPartial() to ZodObject (#​6065) by @​andersk
• 234c407d feat(lang): Added Bengali locale (#​5974) by @​musaddiq-rafi
• 377cd9d7 feat(locales): add turkmen (tk) locale (#​6168) by @​tachmyratsaparmyradov
• 69b6bb08 feat(locales): add Norwegian Nynorsk (nn) locale (#​6092) by @​arvindfroi
• 33d82e6b Add Central Kurdish (ckb) locale (#​6078) by @​KUMachine
• 06666fe2 fix(fr): remove hyphen in "non-optionnel" (#​5999) by @​spidersouris
• 79cfedea feat(v4): expose the owning schema on check-originated issues (#​6420) by @​colinhacks
• 436b5da8 docs: propose compiled constructor graph by @​colinhacks
• eb4682c9 fix(json-schema): resolve tuple minItems past transform and catch in input mode (#​6418) by @​colinhacks
• 4d6b5cd3 fix(json-schema): route unrepresentable default values through unrepresentable by @​colinhacks
• 2abc9e05 docs: note that the JSON Schema emitter reads static optin (#​6417) by @​colinhacks
• 578e1cd0 feat(v4): support format: "hostname" in fromJSONSchema (#​6305) by @​catdalfonso
• 942bf8cb feat(v4): parse input containing reference cycles (#​6387) by @​colinhacks
• 78b523f0 fix(json-schema): keep preprocess object properties required in input mode (#​6133) by @​MerlijnW70
• 973b1b44 fix(v4): strip output-typed catch values from the input JSON Schema (#​6409) by @​colinhacks
• 5e608851 feat(v4): add z.deepPartial and runtime z.input / z.output (#​5928) by @​dokson
• 4e1720c8 fix(v4): align record keys and intersection strictness with TypeScript (#​6412) by @​colinhacks
• 4cc4053d fix: honor loose mode for closed record key schemas (#​6157) by @​pullfrog[bot]
• 69be843f fix(v4): stop the object JIT fastpass keeping a swallowed issue's value (#​6407) by @​colinhacks
• b899cd17 perf(json-schema): make toJSONSchema(registry) linear in registry size (#​6408) by @​colinhacks
• 6074828e fix(v4): make fromJSONSchema propertyNames compose with the other object keywords (#​6411) by @​colinhacks
• d7b209f3 docs: point the Web URLs callout at z.httpUrl() (#​6410) by @​colinhacks
• 611bd762 fix(mini): make merge() take an object schema, matching classic (#​6404) by @​colinhacks
• b53e53cc fix(v4): use exact flag in English locale too_small/too_big messages (#​6177) by @​pullfrog[bot]
• 421cc9a5 fix(json-schema): unescape JSON Pointer tokens when resolving $ref (#​6402) by @​colinhacks
• 4c27fe87 fix(v4): give z.xor() a distinct error when multiple options match (#​6376) by @​colinhacks
• a106fbe7 fix(v4): make fromJSONSchema tuples open-ended by default (#​6020) by @​mneetika
• e8034eba fix(v4): make prefixItems/draft-7 items respect minItems in fromJSONSchema (#​6201) by @​pullfrog[bot]
• 784e5c26 fix(v4): let bundlers tree-shake locales out of the default import (#​6384) by @​colinhacks
• 97edd70a fix(toJSONSchema): constrain closed tuple length (#​6194) by @​pullfrog[bot]
• f150020d fix(v4): escape non-string enum values in template literal patterns (#​5934) by @​gwagjiug
• faf33a28 fix: surface @​deprecated on re-exported compat aliases (#​6072) by @​MahinAnowar
• 3956224a docs: state that metadata wins over generated JSON Schema keywords (#​6401) by @​colinhacks
• a1904fc2 fix(v4): report date origin for numeric min/max bounds (#​6129) by @​MerlijnW70
• bd18314c fix: escape JSON Pointer reserved characters in toJSONSchema $ref (closes #​6027) (#​6144) by @​MaksZhukov
• 2a5164f5 fix(v4): enforce RFC 1035 length limits in regexes.domain (#​6035) by @​emmayusufu
• 0e5bc4b1 fix(v4): respect additionalProperties:false with patternProperties in fromJSONSchema (#​6199) by @​pullfrog[bot]
• c8f06d36 fix(v4): clarify infinite number errors (#​5906) by @​colinhacks

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@nuxtjs/robots@255

commit: 3659cba

[github-actions]

📦 Package Size

✅ No notable size changes

All tracked output (10)

Package output	Gzipped	Raw
@nuxtjs/robots · dependency @fingerprintjs/botd	13 kB	55 kB	✅
@nuxtjs/robots · dependency h3	34 kB	146 kB	✅
@nuxtjs/robots · dependency nuxt-site-config	10 kB	25 kB	✅
@nuxtjs/robots · dependency nuxtseo-shared	23 kB	76 kB	✅
@nuxtjs/robots · export .	5.3 kB	20 kB	✅
@nuxtjs/robots · export ./content	292 B	503 B	✅
@nuxtjs/robots · export ./util	6.6 kB	25 kB	✅
@nuxtjs/robots · published payload	36 kB	121 kB	✅
@nuxtjs/robots · app runtime	2.5 kB	6.2 kB	✅
@nuxtjs/robots · server runtime	8.6 kB	22 kB	✅

Runtime dependencies (10)

Package	Dependency	Requested	Resolved	Cost
@nuxtjs/robots	@fingerprintjs/botd	^2.0.0	2.0.0	📦 13 kB gzip
@nuxtjs/robots	@nuxt/kit	^4.5.2	4.5.2	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	consola	^3.4.2	3.4.2	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	defu	^6.1.7	6.1.7	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	h3	^1.15.11	1.15.11	📦 34 kB gzip
@nuxtjs/robots	nuxt-site-config	^4.2.3	4.2.3	📦 10 kB gzip
@nuxtjs/robots	nuxtseo-shared	^5.3.14	5.3.14	📦 23 kB gzip
@nuxtjs/robots	pathe	^2.0.3	2.0.3	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	pkg-types	^2.3.1	2.3.1	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	ufo	^1.6.4	1.6.4	♻️ free via Nuxt 4.5.2

_{Baseline: main_@_4697167___2026-08-21 · gzip is the comparison metric · changes below 16 B gzip are ignored}

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
zod (source)	>=3 → >=4.5.4

---

Release Notes

colinhacks/zod (zod)

v4.5.4

Compare Source

Commits:

• 84e416f fix(v4): stop the cycle walk from firing a default factory (#​6500)
• e8e206f 4.5.4

v4.5.3

Compare Source

v4.5.2

Compare Source

Commits:

• a354314 fix(docs): keep blog posts out of the docs collection (#​6484)
• d378c42 ci: drop canary publishing from the release workflow (#​6487)
• 212b941 fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#​6488)
• e7576f5 docs(blog): let the page show through the navbar in dark mode (#​6489)
• fedb06f fix(docs): match the blog TOC hover bar to the 2px active indicator
• 6c932fc chore: bump devcontainer image to Node 24 (#​6470)
• 6635d9d docs(blog): soften the "method memoization" attribution
• 019ae29 fix(docs): drop ISR on the docs route so the home page hydrates
• 652bb43 chore(docs): drop the scroll log from the route-change scroller
• 571c8e8 fix(docs): render blog tabs with the stock fumadocs tab card
• 9a193aa 4.5.2

v4.5.1

Compare Source

Commits:

• 2e862db ci: gate the GitHub release and JSR publish on the version being live on npm
• 8e03380 4.5.1

v4.5.0

Compare Source

Zod 4.5 is now available.

npm install zod@latest

At a glance:

• z.compile() — the flagship feature of Zod 4.5
• z.creditCard() — 12–19 digits plus Luhn checksum
• z.properties() — the multi-property counterpart to z.property()
• z.deepPartial()/.exactPartial()
• z.validate(): boolean — a fast-path to verify input validity without a full parse (up to 16x faster on invalid data)
• 9x reduction in memory footprint
• New locales: Bengali (bn), Central Kurdish (ckb), Hindi (hi), Kannada (kn), Norwegian Nynorsk (nn), Brazilian Portuguese (pt-BR), Slovak (sk), Turkmen (tk)

z.compile()

You can now pre-compile any Zod schema using z.compile(schema). This dramatically speeds up parsing performance.

import*aszfrom"zod";constPlayer=z.object({username: z.string(),bio: z.string(),xp: z.number()});constCompiledPlayer=z.compile(Player);

A compiled schema can be used exactly like an uncompiled one. There are no special rules around compiled schemas. They're just faster.

Player.parse({ ... });CompiledPlayer.parse({ ... });// ~2x faster

On objects, arrays, and unions, this speeds up parsing by a factor of ~3–7. More complex schemas stand to benefit more than simpler ones.

Time per parse by schema type, standard parser vs compiled — lower is better (benchmark)

Below are the Moltar benchmark results comparing Zod (compiled and uncompiled) against the Moltar ParseSafe bench.

Throughput on the moltar benchmark fixture (parseSafe: returns a new object with unknown keys stripped) — higher is better (benchmark)

And the equivalent results for the Moltar AssertLoose bench. Tested against the new z.validate(schema, input) function (detailed later in the post).

Throughput on the moltar benchmark fixture (assertLoose: returns a boolean, unknown keys allowed) — higher is better (benchmark)

Zod's entire test suite runs twice—once normally and again with auto-compilation enabled globally—to ensure perfect fidelity.

How it works

Under the hood, z.compile() walks the entire schema once and produces a hyperoptimized snippet of flat, loop-free JavaScript that can validate inputs far faster than a standard runtime validator. This snippet can be executed via new Function() (effectively a more powerful eval) to serve as a fast-path validator. Schemas use this to "fast check" validity, falling back to the regular runtime logic on validation failure to provide granular error information.

Take this simple Point schema:

constPoint=z.object({x: z.number(),y: z.number()});

Here is the generated snippet for it:

constisPoint=newFunction("input",` if (typeof input !== "object" || input === null) return false; if (typeof input.x !== "number") return false; if (typeof input.y !== "number") return false; return true;`);isPoint({x: 1,y: 2});// trueisPoint({x: "1"});// false

For the large majority of inputs, the generated function validates the data with the fastest logic JavaScript can express: straight-line typeof checks and property reads, with no interpreter in between. When it can't handle an input, Zod falls back to the standard parser.

This is the function Zod generates for the Player schema above:

if(typeofinput!=="object"||input===null||Array.isArray(input))returnINVALID;constv0=input["username"];if(typeofv0!=="string")returnINVALID;constv1=input["bio"];if(typeofv1!=="string")returnINVALID;constv2=input["xp"];if(typeofv2!=="number"||!Number.isFinite(v2))returnINVALID;constv3={"username": v0,"bio": v1,"xp": v2};returnv3;

Armed with the power of new Function(), this happens in-process at runtime. There is no need to integrate with your build system.

The compiled schema is purely additive on top of the existing schema. It tacks on the pre-compiled fast path for checking valid inputs. When invalid data is detected, it returns the INVALID symbol to signal that parsing should fall back to the uncompiled parser. This structurally prevents subtle deviations in error reporting between compiled and uncompiled variants.

import "zod/compile"

To compile every schema in an application, import zod/compile once at the top of your entry point. Every schema constructed after that import is automatically compiled the first time it's used to parse data.

import"zod/compile";// must come before modules that define schemasimport*aszfrom"zod";constschema=z.object({name: z.string()});schema.parse({name: "ok"});// compiled on first parse

It also works as a Node.js CLI flag, which guarantees it runs before any module defines a schema:

node --import zod/compile app.js

Or set preload in bunfig.toml or nub.jsonc.

{
"preload": ["zod/compile"]
}

All schemas benefit to varying degrees, though complex object/tuple/array schemas benefit more than simple scalar validators.

Read the docs, or the full technical writeup: Introducing z.compile()

z.creditCard()

A new string format: 12–19 digits, optionally separated by single spaces or hyphens, with a valid Luhn checksum. (#​5931)

z.creditCard().parse("4111 1111 1111 1111");// ✅z.creditCard().parse("4111 1111 1111 1112");// ❌ bad checksum

z.properties()

The multi-property counterpart to z.property(). (#​5912)

consthttpsUrl=z.instanceof(URL).check(
...z.properties({protocol: z.literal("https:"asstring),hostname: z.string().regex(z.regexes.domain),}));httpsUrl.parse(newURL("https://example.com"));// ✅httpsUrl.parse(newURL("http://localhost"));// ❌ protocol

z.deepPartial()

Back in functional form after being removed as a method in Zod 4. (#​5928)

constPost=z.object({title: z.string(),author: z.object({name: z.string(),email: z.string()}),});constPartialPost=z.deepPartial(Post);typePartialPost=z.output<typeofPartialPost>;// => { title?: string; author?: { name?: string; email?: string }}PartialPost.parse({author: {}});// ✅

The result is still a ZodObject, so .shape and .extend() keep working.

.exactPartial()

Like .partial(), but wraps each field in z.exactOptional() instead of z.optional(): keys may be omitted, but an explicit undefined is rejected. This matches TypeScript's Partial<> under exactOptionalPropertyTypes. (#​6065)

constRecipe=z.object({title: z.string(),servings: z.number()});constPartialRecipe=Recipe.exactPartial();PartialRecipe.parse({});// ✅PartialRecipe.parse({title: undefined});// ❌

In Zod Mini it's a top-level function: z.exactPartial(Recipe).

z.validate()

Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a ZodError, which makes rejection cheap: on invalid input it is up to 16x faster than .safeParse().success. The return type is a guard on the schema's input type, and z.validateAsync() covers schemas with async refinements. (#​6471)

z.validate(z.string(),"hi");// truez.validate(z.string(),42);// false

z.input() / z.output()

Project a schema onto its input or output side. Useful for validating the two halves of a codec independently. (#​5928)

constisoDate=z.codec(z.iso.datetime(),z.date(),{decode: (s)=>newDate(s),encode: (d)=>d.toISOString(),});constEvent=z.object({name: z.string(),at: isoDate});z.input(Event).parse({name: "launch",at: "2024-01-01T00:00:00Z"});// ✅z.output(Event).parse({name: "launch",at: newDate()});// ✅

This is a no-op on schemas not containing codecs/pipes.

z.toZod<T>()

A utility to define a Zod schema that agrees exactly with a static type, often one that is handwritten or externally defined. (#​5913)

typePlayer={username: string;xp: number};constPlayer=z.toZod<Player>()(z.object({username: z.string(),xp: z.number(),}));Player.shape.username;// ZodString — the schema is returned unchanged

z.getDiscriminatedOption()

Extract a discriminated union member by discriminator value. (#​5947)

constFruit=z.object({type: z.literal("fruit"),seeds: z.boolean()});constVeg=z.object({type: z.literal("vegetable"),leafy: z.boolean()});constProduce=z.discriminatedUnion("type",[Fruit,Veg]);z.getDiscriminatedOption(Produce,"fruit");// typeof Fruitz.getDiscriminatedOption(Produce,"meat");// ❌ TypeScript error

Cyclical inputs

Zod recursive schemas now support cyclical data. For bundle size reasons, Zod Mini requires you to register a memoizer explicitly. (#​6387, #​6482)

Zod

constCategory=z.object({name: z.string(),getsubcategories(){returnz.array(Category);},});constinput: any={name: "root",subcategories: []};input.subcategories.push(input);constresult=Category.parse(input);result.subcategories[0]===result;// true

Zod Mini

// register a memoizer before defining any schemasz.config({memoizer: z.memoizer()});constresult=Category.parse(input);result.subcategories[0]===result;// true

9x reduction in schema memory footprint

In Zod 4.4 a bare z.string() retained 7.5kb of heap. In Zod 4.5 it retains 784 bytes.

Retained heap per schema instance, Zod 4.4.3 vs 4.5 (benchmark)

In Zod 4.4 and earlier, all schema methods were automatically bound to the instance itself. This allowed users to pluck methods from schemas without causing issues due to this-binding.

const{ parse }=z.string();parse("some data");

A consequence of this is that each bound method allocates space on the heap; method implementations are not shared across all instances via prototype, as you'd expect. Zod 4.5 implements a method memoization pattern that avoids allocating bound methods until they are actually accessed.

Read the deep dive: Reducing Zod's memory footprint by an order of magnitude

Faster failures

Zod .parse()/.safeParse() instantiates a JavaScript Error, which captures a stack trace. In the case of validation failures, this is often much slower than the parsing logic itself. When using .safeParse(), Zod no longer captures this stack trace, speeding up failure-path parses by a factor of ~7.5x. (#​6316, #​6450)

constresult=Player.safeParse({username: 42,bio: "hello",xp: 12});result.success;// false — ~7.5x faster than Zod 4.4

Player schema (benchmark)

Symbol keys in z.object()

A shape can now declare a symbol key. TypeScript tracks it: a const symbol infers as unique symbol, so z.infer makes the key required and checks its value type. Undeclared symbol keys are still ignored. (#​6448)

constTAG=Symbol("tag");constschema=z.object({name: z.string(),[TAG]: z.number()});schema.parse({name: "alice",[TAG]: 42});// ✅ { name: "alice", [TAG]: 42 }schema.safeParse({name: "alice"});// ❌ the symbol key is required

Bug fixes

All of these fix soundness issues, so a schema that relied on the old behavior may now reject input it used to accept.

⚠️z.iso.datetime() requires seconds

RFC 3339 mandates seconds. z.iso.datetime() and z.iso.datetime({ offset: true }) no longer accept minute-precision input like 2020-01-01T06:15Z. local: true still admits 2020-01-01T06:15, since an unqualified datetime is outside RFC 3339 either way. (#​6457)

z.iso.datetime().parse("2020-01-01T06:15:00Z");// ✅z.iso.datetime().parse("2020-01-01T06:15Z");// ❌ was accepted in 4.4

To accept both forms, union the two precisions:

z.union([z.iso.datetime(),z.iso.datetime({precision: -1})]);

⚠️ String length counts code points

.min(), .max(), and .length() counted UTF-16 code units, so z.string().max(5) rejected five emoji. They now count Unicode code points, which is what every non-JS consumer of a length bound does (Postgres, MySQL, Go, Python, and the maxLength that z.toJSONSchema() emits). .max() only loosens; .min() and .length() tighten for astral input. Graphemes are unchanged — a ZWJ sequence is still several code points. (#​6441)

z.string().max(5).parse("😀😀😀😀😀");// was too_big, now passesz.string().min(5).parse("😀😀😀");// was fine, now too_small

Closes #​3355.

⚠️ Record keys and intersections match TypeScript

A record's key schema now governs only the keys that match it, the way TypeScript treats an index signature. Intersecting an object with a pattern-keyed record no longer rejects the object's own keys. (#​6412)

z.object({name: z.string()}).and(z.record(z.string().regex(/^S_/),z.string())).parse({name: "a",S_a: "s"});// 4.4: throws invalid_key on "name"// 4.5: { name: "a", S_a: "s" }

Separately, an unrecognized_keys issue no longer aborts the schema it came from, so a strict object with an extra key and a bad value now reports both issues instead of just the first. Closes #​2200, #​2573, #​4017, #​5663.

⚠️__proto__ is always stripped

Object and record parsers now drop a __proto__ key whether it comes from the input, is declared by the schema, or is produced by a record key transform. A key that a record's key schema normalizes to __proto__ is dropped too. .strict() reports an own __proto__ input key as unrecognized_keys instead of silently swallowing it. Error formatters and both JSON Schema converters use own-property writes so a toString or constructor path segment can't walk onto Object.prototype (#​6213, #​6367, #​6346). (#​6386, #​6354, #​6355, #​6221)

⚠️ Stricter string formats

• z.ipv6() validated by handing the string to new URL(), which let ::@1\ and ::1\n through. It now checks the address alphabet directly (#​6442).
• z.ulid() restricts the first character to 0–7; anything higher overflows the 48-bit timestamp. A fixture that doesn't start with a real timestamp, such as one with a leading letter, is now rejected (#​6095).
• z.httpUrl() enforces the RFC 1035 length limits on the host, matching z.hostname() (#​6035).
• z.emoji() no longer backtracks exponentially on a failed match (#​6347).
• z.string().includes(sub, { position: N }) emits a JSON Schema pattern that allows at least N leading characters, matching String.prototype.includes (#​6024).

Commits

Zod 4.5 rolls up 155 commits. Thanks to everyone who contributed: @​dokson, @​deepshekhardas, @​zirkelc, @​francisjohnjohnston-web, @​MerlijnW70, @​codinsonn, @​oimo23, @​JSap0914, @​zelinewang, @​abhishek-chaudhary2003, @​spokodev, @​Mohammad-Faiz-Cloud-Engineer, @​hamed-bavar, @​MGPOCKY, @​ChiChuRita, @​dinwwwh, @​thristhart, @​tsmartin9, @​vedanshshetti, @​belicam, @​frastefanini, @​andersk, @​musaddiq-rafi, @​tachmyratsaparmyradov, @​arvindfroi, @​KUMachine, @​spidersouris, @​catdalfonso, @​mneetika, @​gwagjiug, @​MahinAnowar, @​MaksZhukov, @​emmayusufu, @​agcty, @​devareddy05, @​Vish05, @​yamcodes, @​mattiasahlsen, @​samchungy, @​ozzyfromspace, @​udohjeremiah, @​patrickwehbe, @​gajus, @​Harm-Nullix, @​thwbh, @​IdanGonen, @​irfanfandi, @​JuerGenie, @​marcalexiei, @​itsahmedbilal, @​DucMinhNe, @​meliharik.

• 9782f87c perf(v4): validate without building the output, and keep schemas out of dictionary mode (#​6480) by @​colinhacks
• 773a4867 refactor(v4): declare a trait's members on $constructor (#​6478) by @​colinhacks
• 68fb3f13 feat(v4): make z.compile() fall back instead of throwing (#​6479) by @​colinhacks
• 37b01501 feat(v4): add z.isValid and z.isValidAsync (#​6471) by @​colinhacks
• 749f5452 docs: add fullproduct.dev to v4 ecosystem page (#​6001) by @​codinsonn
• 24cdb7fd perf(v4): close the fastpass bindings into the compiled parser (#​6464) by @​colinhacks
• 8d896186 fix(v4): stop emitting a multipleOf that JSON Schema rejects (#​6468) by @​colinhacks
• 43f729db feat(v4): make a tuple's items optional with .partial() (#​6465) by @​colinhacks
• 97edaf7d fix(v4): don't throw from safeParse on bigint multipleOf(0n) (#​6466) by @​colinhacks
• 21a6f0cb feat(v4): let z.nanoid() take a custom length (#​4004) by @​oimo23
• 9d5b20ef fix(v4): restrict the first ULID character to [0-7] (#​6095) by @​JSap0914
• 1cf9cd09 docs: record that error maps run per parse, and how to translate at render by @​colinhacks
• 7ce3e77d fix(v4): run a wrapper's inner schema on its own payload (#​6462) by @​colinhacks
• 7b612b53 fix(v4): fold an intersection of object schemas into one object (#​6461) by @​colinhacks
• 1c43b774 docs(v4): record why the failure path is not worth compiling by @​colinhacks
• badf0b78 fix(v4): build the catch context from the input that failed (#​6192) by @​zelinewang
• a87ac366 fix(v4)!: distinguish number and bigint formats at the type level (#​6052) by @​abhishek-chaudhary2003
• 6726c1dd docs: record what z.input and z.output do with transforms and wrappers by @​colinhacks
• 7cfc0122 fix(v4): keep a wrapper's stored value only on the side it belongs to by @​colinhacks
• a825c1b0 fix(v4): empty enums and literals match nothing (#​6459) by @​colinhacks
• 7c070db9 feat(v4): expose the function schema on .implement() results (#​6267) by @​deepshekhardas
• 3a496968 fix(v4): make record input keys optional when the value can fill them (#​6460) by @​colinhacks
• 53cec2a0 fix(v4): resolve z.input past a preprocess transform by @​colinhacks
• 2125d30c fix(v4): accept exact decimal multiples in multipleOf (#​6223) by @​spokodev
• 168122fc fix(v4): carry a pipe's own checks through z.output by @​colinhacks
• 51a1368a fix(v4): let the includes(position) pattern match at or after the offset (#​6024) by @​francisjohnjohnston-web
• 72a05c4f feat(v4): expose stringbool truthy/falsy/case via _zod.bag (#​6357) by @​hamed-bavar
• 036b39f4 fix(v4)!: require seconds once a datetime carries a Z or an offset (#​6457) by @​colinhacks
• 5825605e perf(v4): skip the eager stack capture when building a ZodError (#​6450) by @​colinhacks
• d85472c4 feat(v4): support declared symbol keys in z.object() (#​6448) by @​colinhacks
• d4108872 fix(v4): correct the date/time format keywords in both JSON Schema directions (#​6452) by @​colinhacks
• 555e5f46 Add z.toZod helper (#​5913) by @​colinhacks
• e0e51a55 docs(v4): cut the compile comments down to what they explain (#​6449) by @​colinhacks
• 6574e784 fix(v4): stop catch resurrecting issues an optional already resolved (#​6440) by @​colinhacks
• 937b5d01 perf(v4): prefix issue paths in place in the object JIT failure path (#​6445) by @​colinhacks
• b63db248 fix(v4): keep a memoized node's cached issues private to the cache (#​6443) by @​colinhacks
• 6ec3d043 fix(resolution): keep pnpm's own warnings out of the attw snapshot (#​6446) by @​colinhacks
• 830ba314 fix(v4): validate the address, and return the string that was validated (#​6442) by @​colinhacks
• f101d8ca Preserve callsites in parse stack traces (#​5910) by @​colinhacks
• 6c77d028 feat: compact simple anyOf unions to type array in toJSONSchema (#​6339) by @​deepshekhardas
• 28e1ebd8 fix(v4): measure string length in Unicode code points (#​6441) by @​colinhacks
• 060bc9f3 refactor: share default when-clauses for size/length checks (#​6394) by @​zirkelc
• 2848177d docs: point the flattened/formatted error deprecations at a symbol that exists by @​colinhacks
• 3c2dee9e Add properties checks for instanceof schemas (#​5912) by @​colinhacks
• 87ffeb0f fix(v4): an absent key on the middle rung supplies nothing (#​6434) by @​colinhacks
• 7785fc82 feat(v4): add z.getDiscriminatedOption (#​5947) by @​dokson
• 0135c85a feat(v4): allow passing extra args to apply() (#​6337) by @​deepshekhardas
• ca246d26 fix(v4): drop empty alternation branch from datetime pattern (#​6439) by @​colinhacks
• e073d55b docs: z.iso.datetime() accepts a subset of ISO 8601, not all of it by @​colinhacks
• d6ca12ae fix(v4): infer recursive getter options in discriminatedUnion (#​6422) by @​colinhacks
• dc51404b Add shorn to Zod Utilities (#​6398) by @​ChiChuRita
• 580111da docs: mark AOT compilation as canary-only by @​colinhacks
• 6b0dae79 docs: note that a catch callback is not islanded by @​colinhacks
• 898c4461 refactor(v4): give the runtime and compiled code one URL implementation by @​colinhacks
• 260e5d4b fix(v4): stop islanding a catch callback, which diverged silently by @​colinhacks
• 11c9268b revert(core): drop the exactOptional parse prototype from #​6432 (#​6438) by @​colinhacks
• a38ab4a8 fix(core): an omittable discriminator claims undefined (#​6432) by @​colinhacks
• c9ec89e0 perf(core): drop the seal and the per-key WeakSet from the lazy internals (#​6435) by @​colinhacks
• 3c9ca1d9 feat(json-schema): emit a root $ref when the root schema has an id (#​6029) by @​dinwwwh
• fa77a4d7 feat(v4): z.compile — ahead-of-time schema compilation (#​6085) by @​colinhacks
• f300476d fix(v4): let a schema's error map cover its own checks' issues (#​6426) by @​colinhacks
• 9f0a3d81 fix(core): restore defineLazy semantics lost in the internals move (#​6429) by @​colinhacks
• 604464c3 fix(locales): da/nn/no/sv called an IP address a range (#​6430) by @​colinhacks
• 7378e7cd fix(locales): backfill the mac and Sizable.map gaps, and pin dictionary parity (#​6427) by @​colinhacks
• b1077f05 perf(memory): install derived internals on a per-constructor prototype (#​6415) by @​colinhacks
• ccc15144 fix(locales): add the credit_card key to the seven locales missing it (#​6424) by @​colinhacks
• 73bacbbb fix(from-json-schema): drop redundant inclusive bound for draft-04 exclusive ranges (#​6022) by @​francisjohnjohnston-web
• 86b2e6da docs: list el and hr in the supported locales (#​6423) by @​colinhacks
• 45fdeda5 fix(v4): refine optin into a three-rung ladder, retire the fallback payload flag (#​6419) by @​colinhacks
• 5b34c0ce Improve Portuguese localization and add Brazilian Portuguese (pt-BR) (#​6076) by @​thristhart
• dc1a40a5 fix(locales): improve french translation (#​6120) by @​tsmartin9
• 0175a043 feat(locales): add Hindi and Kannada locale support (#​6315) by @​vedanshshetti
• 536ee3b0 Locales: added Slovak (sk) language (#​6041) by @​belicam
• 07b0c3d8 fix: preserve explicit superRefine issue input (#​6053) by @​frastefanini
• ba98071c feat: add .exactPartial() to ZodObject (#​6065) by @​andersk
• 234c407d feat(lang): Added Bengali locale (#​5974) by @​musaddiq-rafi
• 377cd9d7 feat(locales): add turkmen (tk) locale (#​6168) by @​tachmyratsaparmyradov
• 69b6bb08 feat(locales): add Norwegian Nynorsk (nn) locale (#​6092) by @​arvindfroi
• 33d82e6b Add Central Kurdish (ckb) locale (#​6078) by @​KUMachine
• 06666fe2 fix(fr): remove hyphen in "non-optionnel" (#​5999) by @​spidersouris
• 79cfedea feat(v4): expose the owning schema on check-originated issues (#​6420) by @​colinhacks
• 436b5da8 docs: propose compiled constructor graph by @​colinhacks
• eb4682c9 fix(json-schema): resolve tuple minItems past transform and catch in input mode (#​6418) by @​colinhacks
• 4d6b5cd3 fix(json-schema): route unrepresentable default values through unrepresentable by @​colinhacks
• 2abc9e05 docs: note that the JSON Schema emitter reads static optin (#​6417) by @​colinhacks
• 578e1cd0 feat(v4): support format: "hostname" in fromJSONSchema (#​6305) by @​catdalfonso
• 942bf8cb feat(v4): parse input containing reference cycles (#​6387) by @​colinhacks
• 78b523f0 fix(json-schema): keep preprocess object properties required in input mode (#​6133) by @​MerlijnW70
• 973b1b44 fix(v4): strip output-typed catch values from the input JSON Schema (#​6409) by @​colinhacks
• 5e608851 feat(v4): add z.deepPartial and runtime z.input / z.output (#​5928) by @​dokson
• 4e1720c8 fix(v4): align record keys and intersection strictness with TypeScript (#​6412) by @​colinhacks
• 4cc4053d fix: honor loose mode for closed record key schemas (#​6157) by @​pullfrog[bot]
• 69be843f fix(v4): stop the object JIT fastpass keeping a swallowed issue's value (#​6407) by @​colinhacks
• b899cd17 perf(json-schema): make toJSONSchema(registry) linear in registry size (#​6408) by @​colinhacks
• 6074828e fix(v4): make fromJSONSchema propertyNames compose with the other object keywords (#​6411) by @​colinhacks
• d7b209f3 docs: point the Web URLs callout at z.httpUrl() (#​6410) by @​colinhacks
• 611bd762 fix(mini): make merge() take an object schema, matching classic (#​6404) by @​colinhacks
• b53e53cc fix(v4): use exact flag in English locale too_small/too_big messages (#​6177) by @​pullfrog[bot]
• 421cc9a5 fix(json-schema): unescape JSON Pointer tokens when resolving $ref (#​6402) by @​colinhacks
• 4c27fe87 fix(v4): give z.xor() a distinct error when multiple options match (#​6376) by @​colinhacks
• a106fbe7 fix(v4): make fromJSONSchema tuples open-ended by default (#​6020) by @​mneetika
• e8034eba fix(v4): make prefixItems/draft-7 items respect minItems in fromJSONSchema (#​6201) by @​pullfrog[bot]
• 784e5c26 fix(v4): let bundlers tree-shake locales out of the default import (#​6384) by @​colinhacks
• 97edd70a fix(toJSONSchema): constrain closed tuple length (#​6194) by @​pullfrog[bot]
• f150020d fix(v4): escape non-string enum values in template literal patterns (#​5934) by @​gwagjiug
• faf33a28 fix: surface @​deprecated on re-exported compat aliases (#​6072) by @​MahinAnowar
• 3956224a docs: state that metadata wins over generated JSON Schema keywords (#​6401) by @​colinhacks
• a1904fc2 fix(v4): report date origin for numeric min/max bounds (#​6129) by @​MerlijnW70
• bd18314c fix: escape JSON Pointer reserved characters in toJSONSchema $ref (closes #​6027) (#​6144) by @​MaksZhukov
• 2a5164f5 fix(v4): enforce RFC 1035 length limits in regexes.domain (#​6035) by @​emmayusufu
• 0e5bc4b1 fix(v4): respect additionalProperties:false with patternProperties in fromJSONSchema (#​6199) by @​pullfrog[bot]
• c8f06d36 fix(v4): clarify infinite number errors (#​5906) by @​colinhacks

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@nuxtjs/robots@255

commit: 3659cba

[github-actions]

📦 Package Size

✅ No notable size changes

All tracked output (10)

Package output	Gzipped	Raw
@nuxtjs/robots · dependency @fingerprintjs/botd	13 kB	55 kB	✅
@nuxtjs/robots · dependency h3	34 kB	146 kB	✅
@nuxtjs/robots · dependency nuxt-site-config	10 kB	25 kB	✅
@nuxtjs/robots · dependency nuxtseo-shared	23 kB	76 kB	✅
@nuxtjs/robots · export .	5.3 kB	20 kB	✅
@nuxtjs/robots · export ./content	292 B	503 B	✅
@nuxtjs/robots · export ./util	6.6 kB	25 kB	✅
@nuxtjs/robots · published payload	36 kB	121 kB	✅
@nuxtjs/robots · app runtime	2.5 kB	6.2 kB	✅
@nuxtjs/robots · server runtime	8.6 kB	22 kB	✅

Runtime dependencies (10)

Package	Dependency	Requested	Resolved	Cost
@nuxtjs/robots	@fingerprintjs/botd	^2.0.0	2.0.0	📦 13 kB gzip
@nuxtjs/robots	@nuxt/kit	^4.5.2	4.5.2	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	consola	^3.4.2	3.4.2	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	defu	^6.1.7	6.1.7	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	h3	^1.15.11	1.15.11	📦 34 kB gzip
@nuxtjs/robots	nuxt-site-config	^4.2.3	4.2.3	📦 10 kB gzip
@nuxtjs/robots	nuxtseo-shared	^5.3.14	5.3.14	📦 23 kB gzip
@nuxtjs/robots	pathe	^2.0.3	2.0.3	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	pkg-types	^2.3.1	2.3.1	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	ufo	^1.6.4	1.6.4	♻️ free via Nuxt 4.5.2

_{Baseline: main_@_4697167___2026-08-21 · gzip is the comparison metric · changes below 16 B gzip are ignored}

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
zod (source)	>=3 → >=4.5.4

---

Release Notes

colinhacks/zod (zod)

v4.5.4

Compare Source

Commits:

• 84e416f fix(v4): stop the cycle walk from firing a default factory (#​6500)
• e8e206f 4.5.4

v4.5.3

Compare Source

v4.5.2

Compare Source

Commits:

• a354314 fix(docs): keep blog posts out of the docs collection (#​6484)
• d378c42 ci: drop canary publishing from the release workflow (#​6487)
• 212b941 fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#​6488)
• e7576f5 docs(blog): let the page show through the navbar in dark mode (#​6489)
• fedb06f fix(docs): match the blog TOC hover bar to the 2px active indicator
• 6c932fc chore: bump devcontainer image to Node 24 (#​6470)
• 6635d9d docs(blog): soften the "method memoization" attribution
• 019ae29 fix(docs): drop ISR on the docs route so the home page hydrates
• 652bb43 chore(docs): drop the scroll log from the route-change scroller
• 571c8e8 fix(docs): render blog tabs with the stock fumadocs tab card
• 9a193aa 4.5.2

v4.5.1

Compare Source

Commits:

• 2e862db ci: gate the GitHub release and JSR publish on the version being live on npm
• 8e03380 4.5.1

v4.5.0

Compare Source

Zod 4.5 is now available.

npm install zod@latest

At a glance:

• z.compile() — the flagship feature of Zod 4.5
• z.creditCard() — 12–19 digits plus Luhn checksum
• z.properties() — the multi-property counterpart to z.property()
• z.deepPartial()/.exactPartial()
• z.validate(): boolean — a fast-path to verify input validity without a full parse (up to 16x faster on invalid data)
• 9x reduction in memory footprint
• New locales: Bengali (bn), Central Kurdish (ckb), Hindi (hi), Kannada (kn), Norwegian Nynorsk (nn), Brazilian Portuguese (pt-BR), Slovak (sk), Turkmen (tk)

z.compile()

You can now pre-compile any Zod schema using z.compile(schema). This dramatically speeds up parsing performance.

import*aszfrom"zod";constPlayer=z.object({username: z.string(),bio: z.string(),xp: z.number()});constCompiledPlayer=z.compile(Player);

A compiled schema can be used exactly like an uncompiled one. There are no special rules around compiled schemas. They're just faster.

Player.parse({ ... });CompiledPlayer.parse({ ... });// ~2x faster

On objects, arrays, and unions, this speeds up parsing by a factor of ~3–7. More complex schemas stand to benefit more than simpler ones.

Time per parse by schema type, standard parser vs compiled — lower is better (benchmark)

Below are the Moltar benchmark results comparing Zod (compiled and uncompiled) against the Moltar ParseSafe bench.

Throughput on the moltar benchmark fixture (parseSafe: returns a new object with unknown keys stripped) — higher is better (benchmark)

And the equivalent results for the Moltar AssertLoose bench. Tested against the new z.validate(schema, input) function (detailed later in the post).

Throughput on the moltar benchmark fixture (assertLoose: returns a boolean, unknown keys allowed) — higher is better (benchmark)

Zod's entire test suite runs twice—once normally and again with auto-compilation enabled globally—to ensure perfect fidelity.

How it works

Under the hood, z.compile() walks the entire schema once and produces a hyperoptimized snippet of flat, loop-free JavaScript that can validate inputs far faster than a standard runtime validator. This snippet can be executed via new Function() (effectively a more powerful eval) to serve as a fast-path validator. Schemas use this to "fast check" validity, falling back to the regular runtime logic on validation failure to provide granular error information.

Take this simple Point schema:

constPoint=z.object({x: z.number(),y: z.number()});

Here is the generated snippet for it:

constisPoint=newFunction("input",` if (typeof input !== "object" || input === null) return false; if (typeof input.x !== "number") return false; if (typeof input.y !== "number") return false; return true;`);isPoint({x: 1,y: 2});// trueisPoint({x: "1"});// false

For the large majority of inputs, the generated function validates the data with the fastest logic JavaScript can express: straight-line typeof checks and property reads, with no interpreter in between. When it can't handle an input, Zod falls back to the standard parser.

This is the function Zod generates for the Player schema above:

if(typeofinput!=="object"||input===null||Array.isArray(input))returnINVALID;constv0=input["username"];if(typeofv0!=="string")returnINVALID;constv1=input["bio"];if(typeofv1!=="string")returnINVALID;constv2=input["xp"];if(typeofv2!=="number"||!Number.isFinite(v2))returnINVALID;constv3={"username": v0,"bio": v1,"xp": v2};returnv3;

Armed with the power of new Function(), this happens in-process at runtime. There is no need to integrate with your build system.

The compiled schema is purely additive on top of the existing schema. It tacks on the pre-compiled fast path for checking valid inputs. When invalid data is detected, it returns the INVALID symbol to signal that parsing should fall back to the uncompiled parser. This structurally prevents subtle deviations in error reporting between compiled and uncompiled variants.

import "zod/compile"

To compile every schema in an application, import zod/compile once at the top of your entry point. Every schema constructed after that import is automatically compiled the first time it's used to parse data.

import"zod/compile";// must come before modules that define schemasimport*aszfrom"zod";constschema=z.object({name: z.string()});schema.parse({name: "ok"});// compiled on first parse

It also works as a Node.js CLI flag, which guarantees it runs before any module defines a schema:

node --import zod/compile app.js

Or set preload in bunfig.toml or nub.jsonc.

{
"preload": ["zod/compile"]
}

All schemas benefit to varying degrees, though complex object/tuple/array schemas benefit more than simple scalar validators.

Read the docs, or the full technical writeup: Introducing z.compile()

z.creditCard()

A new string format: 12–19 digits, optionally separated by single spaces or hyphens, with a valid Luhn checksum. (#​5931)

z.creditCard().parse("4111 1111 1111 1111");// ✅z.creditCard().parse("4111 1111 1111 1112");// ❌ bad checksum

z.properties()

The multi-property counterpart to z.property(). (#​5912)

consthttpsUrl=z.instanceof(URL).check(
...z.properties({protocol: z.literal("https:"asstring),hostname: z.string().regex(z.regexes.domain),}));httpsUrl.parse(newURL("https://example.com"));// ✅httpsUrl.parse(newURL("http://localhost"));// ❌ protocol

z.deepPartial()

Back in functional form after being removed as a method in Zod 4. (#​5928)

constPost=z.object({title: z.string(),author: z.object({name: z.string(),email: z.string()}),});constPartialPost=z.deepPartial(Post);typePartialPost=z.output<typeofPartialPost>;// => { title?: string; author?: { name?: string; email?: string }}PartialPost.parse({author: {}});// ✅

The result is still a ZodObject, so .shape and .extend() keep working.

.exactPartial()

Like .partial(), but wraps each field in z.exactOptional() instead of z.optional(): keys may be omitted, but an explicit undefined is rejected. This matches TypeScript's Partial<> under exactOptionalPropertyTypes. (#​6065)

constRecipe=z.object({title: z.string(),servings: z.number()});constPartialRecipe=Recipe.exactPartial();PartialRecipe.parse({});// ✅PartialRecipe.parse({title: undefined});// ❌

In Zod Mini it's a top-level function: z.exactPartial(Recipe).

z.validate()

Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a ZodError, which makes rejection cheap: on invalid input it is up to 16x faster than .safeParse().success. The return type is a guard on the schema's input type, and z.validateAsync() covers schemas with async refinements. (#​6471)

z.validate(z.string(),"hi");// truez.validate(z.string(),42);// false

z.input() / z.output()

Project a schema onto its input or output side. Useful for validating the two halves of a codec independently. (#​5928)

constisoDate=z.codec(z.iso.datetime(),z.date(),{decode: (s)=>newDate(s),encode: (d)=>d.toISOString(),});constEvent=z.object({name: z.string(),at: isoDate});z.input(Event).parse({name: "launch",at: "2024-01-01T00:00:00Z"});// ✅z.output(Event).parse({name: "launch",at: newDate()});// ✅

This is a no-op on schemas not containing codecs/pipes.

z.toZod<T>()

A utility to define a Zod schema that agrees exactly with a static type, often one that is handwritten or externally defined. (#​5913)

typePlayer={username: string;xp: number};constPlayer=z.toZod<Player>()(z.object({username: z.string(),xp: z.number(),}));Player.shape.username;// ZodString — the schema is returned unchanged

z.getDiscriminatedOption()

Extract a discriminated union member by discriminator value. (#​5947)

constFruit=z.object({type: z.literal("fruit"),seeds: z.boolean()});constVeg=z.object({type: z.literal("vegetable"),leafy: z.boolean()});constProduce=z.discriminatedUnion("type",[Fruit,Veg]);z.getDiscriminatedOption(Produce,"fruit");// typeof Fruitz.getDiscriminatedOption(Produce,"meat");// ❌ TypeScript error

Cyclical inputs

Zod recursive schemas now support cyclical data. For bundle size reasons, Zod Mini requires you to register a memoizer explicitly. (#​6387, #​6482)

Zod

constCategory=z.object({name: z.string(),getsubcategories(){returnz.array(Category);},});constinput: any={name: "root",subcategories: []};input.subcategories.push(input);constresult=Category.parse(input);result.subcategories[0]===result;// true

Zod Mini

// register a memoizer before defining any schemasz.config({memoizer: z.memoizer()});constresult=Category.parse(input);result.subcategories[0]===result;// true

9x reduction in schema memory footprint

In Zod 4.4 a bare z.string() retained 7.5kb of heap. In Zod 4.5 it retains 784 bytes.

Retained heap per schema instance, Zod 4.4.3 vs 4.5 (benchmark)

In Zod 4.4 and earlier, all schema methods were automatically bound to the instance itself. This allowed users to pluck methods from schemas without causing issues due to this-binding.

const{ parse }=z.string();parse("some data");

A consequence of this is that each bound method allocates space on the heap; method implementations are not shared across all instances via prototype, as you'd expect. Zod 4.5 implements a method memoization pattern that avoids allocating bound methods until they are actually accessed.

Read the deep dive: Reducing Zod's memory footprint by an order of magnitude

Faster failures

Zod .parse()/.safeParse() instantiates a JavaScript Error, which captures a stack trace. In the case of validation failures, this is often much slower than the parsing logic itself. When using .safeParse(), Zod no longer captures this stack trace, speeding up failure-path parses by a factor of ~7.5x. (#​6316, #​6450)

constresult=Player.safeParse({username: 42,bio: "hello",xp: 12});result.success;// false — ~7.5x faster than Zod 4.4

Player schema (benchmark)

Symbol keys in z.object()

A shape can now declare a symbol key. TypeScript tracks it: a const symbol infers as unique symbol, so z.infer makes the key required and checks its value type. Undeclared symbol keys are still ignored. (#​6448)

constTAG=Symbol("tag");constschema=z.object({name: z.string(),[TAG]: z.number()});schema.parse({name: "alice",[TAG]: 42});// ✅ { name: "alice", [TAG]: 42 }schema.safeParse({name: "alice"});// ❌ the symbol key is required

Bug fixes

All of these fix soundness issues, so a schema that relied on the old behavior may now reject input it used to accept.

⚠️z.iso.datetime() requires seconds

RFC 3339 mandates seconds. z.iso.datetime() and z.iso.datetime({ offset: true }) no longer accept minute-precision input like 2020-01-01T06:15Z. local: true still admits 2020-01-01T06:15, since an unqualified datetime is outside RFC 3339 either way. (#​6457)

z.iso.datetime().parse("2020-01-01T06:15:00Z");// ✅z.iso.datetime().parse("2020-01-01T06:15Z");// ❌ was accepted in 4.4

To accept both forms, union the two precisions:

z.union([z.iso.datetime(),z.iso.datetime({precision: -1})]);

⚠️ String length counts code points

.min(), .max(), and .length() counted UTF-16 code units, so z.string().max(5) rejected five emoji. They now count Unicode code points, which is what every non-JS consumer of a length bound does (Postgres, MySQL, Go, Python, and the maxLength that z.toJSONSchema() emits). .max() only loosens; .min() and .length() tighten for astral input. Graphemes are unchanged — a ZWJ sequence is still several code points. (#​6441)

z.string().max(5).parse("😀😀😀😀😀");// was too_big, now passesz.string().min(5).parse("😀😀😀");// was fine, now too_small

Closes #​3355.

⚠️ Record keys and intersections match TypeScript

A record's key schema now governs only the keys that match it, the way TypeScript treats an index signature. Intersecting an object with a pattern-keyed record no longer rejects the object's own keys. (#​6412)

z.object({name: z.string()}).and(z.record(z.string().regex(/^S_/),z.string())).parse({name: "a",S_a: "s"});// 4.4: throws invalid_key on "name"// 4.5: { name: "a", S_a: "s" }

Separately, an unrecognized_keys issue no longer aborts the schema it came from, so a strict object with an extra key and a bad value now reports both issues instead of just the first. Closes #​2200, #​2573, #​4017, #​5663.

⚠️__proto__ is always stripped

Object and record parsers now drop a __proto__ key whether it comes from the input, is declared by the schema, or is produced by a record key transform. A key that a record's key schema normalizes to __proto__ is dropped too. .strict() reports an own __proto__ input key as unrecognized_keys instead of silently swallowing it. Error formatters and both JSON Schema converters use own-property writes so a toString or constructor path segment can't walk onto Object.prototype (#​6213, #​6367, #​6346). (#​6386, #​6354, #​6355, #​6221)

⚠️ Stricter string formats

• z.ipv6() validated by handing the string to new URL(), which let ::@1\ and ::1\n through. It now checks the address alphabet directly (#​6442).
• z.ulid() restricts the first character to 0–7; anything higher overflows the 48-bit timestamp. A fixture that doesn't start with a real timestamp, such as one with a leading letter, is now rejected (#​6095).
• z.httpUrl() enforces the RFC 1035 length limits on the host, matching z.hostname() (#​6035).
• z.emoji() no longer backtracks exponentially on a failed match (#​6347).
• z.string().includes(sub, { position: N }) emits a JSON Schema pattern that allows at least N leading characters, matching String.prototype.includes (#​6024).

Commits

Zod 4.5 rolls up 155 commits. Thanks to everyone who contributed: @​dokson, @​deepshekhardas, @​zirkelc, @​francisjohnjohnston-web, @​MerlijnW70, @​codinsonn, @​oimo23, @​JSap0914, @​zelinewang, @​abhishek-chaudhary2003, @​spokodev, @​Mohammad-Faiz-Cloud-Engineer, @​hamed-bavar, @​MGPOCKY, @​ChiChuRita, @​dinwwwh, @​thristhart, @​tsmartin9, @​vedanshshetti, @​belicam, @​frastefanini, @​andersk, @​musaddiq-rafi, @​tachmyratsaparmyradov, @​arvindfroi, @​KUMachine, @​spidersouris, @​catdalfonso, @​mneetika, @​gwagjiug, @​MahinAnowar, @​MaksZhukov, @​emmayusufu, @​agcty, @​devareddy05, @​Vish05, @​yamcodes, @​mattiasahlsen, @​samchungy, @​ozzyfromspace, @​udohjeremiah, @​patrickwehbe, @​gajus, @​Harm-Nullix, @​thwbh, @​IdanGonen, @​irfanfandi, @​JuerGenie, @​marcalexiei, @​itsahmedbilal, @​DucMinhNe, @​meliharik.

• 9782f87c perf(v4): validate without building the output, and keep schemas out of dictionary mode (#​6480) by @​colinhacks
• 773a4867 refactor(v4): declare a trait's members on $constructor (#​6478) by @​colinhacks
• 68fb3f13 feat(v4): make z.compile() fall back instead of throwing (#​6479) by @​colinhacks
• 37b01501 feat(v4): add z.isValid and z.isValidAsync (#​6471) by @​colinhacks
• 749f5452 docs: add fullproduct.dev to v4 ecosystem page (#​6001) by @​codinsonn
• 24cdb7fd perf(v4): close the fastpass bindings into the compiled parser (#​6464) by @​colinhacks
• 8d896186 fix(v4): stop emitting a multipleOf that JSON Schema rejects (#​6468) by @​colinhacks
• 43f729db feat(v4): make a tuple's items optional with .partial() (#​6465) by @​colinhacks
• 97edaf7d fix(v4): don't throw from safeParse on bigint multipleOf(0n) (#​6466) by @​colinhacks
• 21a6f0cb feat(v4): let z.nanoid() take a custom length (#​4004) by @​oimo23
• 9d5b20ef fix(v4): restrict the first ULID character to [0-7] (#​6095) by @​JSap0914
• 1cf9cd09 docs: record that error maps run per parse, and how to translate at render by @​colinhacks
• 7ce3e77d fix(v4): run a wrapper's inner schema on its own payload (#​6462) by @​colinhacks
• 7b612b53 fix(v4): fold an intersection of object schemas into one object (#​6461) by @​colinhacks
• 1c43b774 docs(v4): record why the failure path is not worth compiling by @​colinhacks
• badf0b78 fix(v4): build the catch context from the input that failed (#​6192) by @​zelinewang
• a87ac366 fix(v4)!: distinguish number and bigint formats at the type level (#​6052) by @​abhishek-chaudhary2003
• 6726c1dd docs: record what z.input and z.output do with transforms and wrappers by @​colinhacks
• 7cfc0122 fix(v4): keep a wrapper's stored value only on the side it belongs to by @​colinhacks
• a825c1b0 fix(v4): empty enums and literals match nothing (#​6459) by @​colinhacks
• 7c070db9 feat(v4): expose the function schema on .implement() results (#​6267) by @​deepshekhardas
• 3a496968 fix(v4): make record input keys optional when the value can fill them (#​6460) by @​colinhacks
• 53cec2a0 fix(v4): resolve z.input past a preprocess transform by @​colinhacks
• 2125d30c fix(v4): accept exact decimal multiples in multipleOf (#​6223) by @​spokodev
• 168122fc fix(v4): carry a pipe's own checks through z.output by @​colinhacks
• 51a1368a fix(v4): let the includes(position) pattern match at or after the offset (#​6024) by @​francisjohnjohnston-web
• 72a05c4f feat(v4): expose stringbool truthy/falsy/case via _zod.bag (#​6357) by @​hamed-bavar
• 036b39f4 fix(v4)!: require seconds once a datetime carries a Z or an offset (#​6457) by @​colinhacks
• 5825605e perf(v4): skip the eager stack capture when building a ZodError (#​6450) by @​colinhacks
• d85472c4 feat(v4): support declared symbol keys in z.object() (#​6448) by @​colinhacks
• d4108872 fix(v4): correct the date/time format keywords in both JSON Schema directions (#​6452) by @​colinhacks
• 555e5f46 Add z.toZod helper (#​5913) by @​colinhacks
• e0e51a55 docs(v4): cut the compile comments down to what they explain (#​6449) by @​colinhacks
• 6574e784 fix(v4): stop catch resurrecting issues an optional already resolved (#​6440) by @​colinhacks
• 937b5d01 perf(v4): prefix issue paths in place in the object JIT failure path (#​6445) by @​colinhacks
• b63db248 fix(v4): keep a memoized node's cached issues private to the cache (#​6443) by @​colinhacks
• 6ec3d043 fix(resolution): keep pnpm's own warnings out of the attw snapshot (#​6446) by @​colinhacks
• 830ba314 fix(v4): validate the address, and return the string that was validated (#​6442) by @​colinhacks
• f101d8ca Preserve callsites in parse stack traces (#​5910) by @​colinhacks
• 6c77d028 feat: compact simple anyOf unions to type array in toJSONSchema (#​6339) by @​deepshekhardas
• 28e1ebd8 fix(v4): measure string length in Unicode code points (#​6441) by @​colinhacks
• 060bc9f3 refactor: share default when-clauses for size/length checks (#​6394) by @​zirkelc
• 2848177d docs: point the flattened/formatted error deprecations at a symbol that exists by @​colinhacks
• 3c2dee9e Add properties checks for instanceof schemas (#​5912) by @​colinhacks
• 87ffeb0f fix(v4): an absent key on the middle rung supplies nothing (#​6434) by @​colinhacks
• 7785fc82 feat(v4): add z.getDiscriminatedOption (#​5947) by @​dokson
• 0135c85a feat(v4): allow passing extra args to apply() (#​6337) by @​deepshekhardas
• ca246d26 fix(v4): drop empty alternation branch from datetime pattern (#​6439) by @​colinhacks
• e073d55b docs: z.iso.datetime() accepts a subset of ISO 8601, not all of it by @​colinhacks
• d6ca12ae fix(v4): infer recursive getter options in discriminatedUnion (#​6422) by @​colinhacks
• dc51404b Add shorn to Zod Utilities (#​6398) by @​ChiChuRita
• 580111da docs: mark AOT compilation as canary-only by @​colinhacks
• 6b0dae79 docs: note that a catch callback is not islanded by @​colinhacks
• 898c4461 refactor(v4): give the runtime and compiled code one URL implementation by @​colinhacks
• 260e5d4b fix(v4): stop islanding a catch callback, which diverged silently by @​colinhacks
• 11c9268b revert(core): drop the exactOptional parse prototype from #​6432 (#​6438) by @​colinhacks
• a38ab4a8 fix(core): an omittable discriminator claims undefined (#​6432) by @​colinhacks
• c9ec89e0 perf(core): drop the seal and the per-key WeakSet from the lazy internals (#​6435) by @​colinhacks
• 3c9ca1d9 feat(json-schema): emit a root $ref when the root schema has an id (#​6029) by @​dinwwwh
• fa77a4d7 feat(v4): z.compile — ahead-of-time schema compilation (#​6085) by @​colinhacks
• f300476d fix(v4): let a schema's error map cover its own checks' issues (#​6426) by @​colinhacks
• 9f0a3d81 fix(core): restore defineLazy semantics lost in the internals move (#​6429) by @​colinhacks
• 604464c3 fix(locales): da/nn/no/sv called an IP address a range (#​6430) by @​colinhacks
• 7378e7cd fix(locales): backfill the mac and Sizable.map gaps, and pin dictionary parity (#​6427) by @​colinhacks
• b1077f05 perf(memory): install derived internals on a per-constructor prototype (#​6415) by @​colinhacks
• ccc15144 fix(locales): add the credit_card key to the seven locales missing it (#​6424) by @​colinhacks
• 73bacbbb fix(from-json-schema): drop redundant inclusive bound for draft-04 exclusive ranges (#​6022) by @​francisjohnjohnston-web
• 86b2e6da docs: list el and hr in the supported locales (#​6423) by @​colinhacks
• 45fdeda5 fix(v4): refine optin into a three-rung ladder, retire the fallback payload flag (#​6419) by @​colinhacks
• 5b34c0ce Improve Portuguese localization and add Brazilian Portuguese (pt-BR) (#​6076) by @​thristhart
• dc1a40a5 fix(locales): improve french translation (#​6120) by @​tsmartin9
• 0175a043 feat(locales): add Hindi and Kannada locale support (#​6315) by @​vedanshshetti
• 536ee3b0 Locales: added Slovak (sk) language (#​6041) by @​belicam
• 07b0c3d8 fix: preserve explicit superRefine issue input (#​6053) by @​frastefanini
• ba98071c feat: add .exactPartial() to ZodObject (#​6065) by @​andersk
• 234c407d feat(lang): Added Bengali locale (#​5974) by @​musaddiq-rafi
• 377cd9d7 feat(locales): add turkmen (tk) locale (#​6168) by @​tachmyratsaparmyradov
• 69b6bb08 feat(locales): add Norwegian Nynorsk (nn) locale (#​6092) by @​arvindfroi
• 33d82e6b Add Central Kurdish (ckb) locale (#​6078) by @​KUMachine
• 06666fe2 fix(fr): remove hyphen in "non-optionnel" (#​5999) by @​spidersouris
• 79cfedea feat(v4): expose the owning schema on check-originated issues (#​6420) by @​colinhacks
• 436b5da8 docs: propose compiled constructor graph by @​colinhacks
• eb4682c9 fix(json-schema): resolve tuple minItems past transform and catch in input mode (#​6418) by @​colinhacks
• 4d6b5cd3 fix(json-schema): route unrepresentable default values through unrepresentable by @​colinhacks
• 2abc9e05 docs: note that the JSON Schema emitter reads static optin (#​6417) by @​colinhacks
• 578e1cd0 feat(v4): support format: "hostname" in fromJSONSchema (#​6305) by @​catdalfonso
• 942bf8cb feat(v4): parse input containing reference cycles (#​6387) by @​colinhacks
• 78b523f0 fix(json-schema): keep preprocess object properties required in input mode (#​6133) by @​MerlijnW70
• 973b1b44 fix(v4): strip output-typed catch values from the input JSON Schema (#​6409) by @​colinhacks
• 5e608851 feat(v4): add z.deepPartial and runtime z.input / z.output (#​5928) by @​dokson
• 4e1720c8 fix(v4): align record keys and intersection strictness with TypeScript (#​6412) by @​colinhacks
• 4cc4053d fix: honor loose mode for closed record key schemas (#​6157) by @​pullfrog[bot]
• 69be843f fix(v4): stop the object JIT fastpass keeping a swallowed issue's value (#​6407) by @​colinhacks
• b899cd17 perf(json-schema): make toJSONSchema(registry) linear in registry size (#​6408) by @​colinhacks
• 6074828e fix(v4): make fromJSONSchema propertyNames compose with the other object keywords (#​6411) by @​colinhacks
• d7b209f3 docs: point the Web URLs callout at z.httpUrl() (#​6410) by @​colinhacks
• 611bd762 fix(mini): make merge() take an object schema, matching classic (#​6404) by @​colinhacks
• b53e53cc fix(v4): use exact flag in English locale too_small/too_big messages (#​6177) by @​pullfrog[bot]
• 421cc9a5 fix(json-schema): unescape JSON Pointer tokens when resolving $ref (#​6402) by @​colinhacks
• 4c27fe87 fix(v4): give z.xor() a distinct error when multiple options match (#​6376) by @​colinhacks
• a106fbe7 fix(v4): make fromJSONSchema tuples open-ended by default (#​6020) by @​mneetika
• e8034eba fix(v4): make prefixItems/draft-7 items respect minItems in fromJSONSchema (#​6201) by @​pullfrog[bot]
• 784e5c26 fix(v4): let bundlers tree-shake locales out of the default import (#​6384) by @​colinhacks
• 97edd70a fix(toJSONSchema): constrain closed tuple length (#​6194) by @​pullfrog[bot]
• f150020d fix(v4): escape non-string enum values in template literal patterns (#​5934) by @​gwagjiug
• faf33a28 fix: surface @​deprecated on re-exported compat aliases (#​6072) by @​MahinAnowar
• 3956224a docs: state that metadata wins over generated JSON Schema keywords (#​6401) by @​colinhacks
• a1904fc2 fix(v4): report date origin for numeric min/max bounds (#​6129) by @​MerlijnW70
• bd18314c fix: escape JSON Pointer reserved characters in toJSONSchema $ref (closes #​6027) (#​6144) by @​MaksZhukov
• 2a5164f5 fix(v4): enforce RFC 1035 length limits in regexes.domain (#​6035) by @​emmayusufu
• 0e5bc4b1 fix(v4): respect additionalProperties:false with patternProperties in fromJSONSchema (#​6199) by @​pullfrog[bot]
• c8f06d36 fix(v4): clarify infinite number errors (#​5906) by @​colinhacks

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@nuxtjs/robots@255

commit: 3659cba

[github-actions]

📦 Package Size

✅ No notable size changes

All tracked output (10)

Package output	Gzipped	Raw
@nuxtjs/robots · dependency @fingerprintjs/botd	13 kB	55 kB	✅
@nuxtjs/robots · dependency h3	34 kB	146 kB	✅
@nuxtjs/robots · dependency nuxt-site-config	10 kB	25 kB	✅
@nuxtjs/robots · dependency nuxtseo-shared	23 kB	76 kB	✅
@nuxtjs/robots · export .	5.3 kB	20 kB	✅
@nuxtjs/robots · export ./content	292 B	503 B	✅
@nuxtjs/robots · export ./util	6.6 kB	25 kB	✅
@nuxtjs/robots · published payload	36 kB	121 kB	✅
@nuxtjs/robots · app runtime	2.5 kB	6.2 kB	✅
@nuxtjs/robots · server runtime	8.6 kB	22 kB	✅

Runtime dependencies (10)

Package	Dependency	Requested	Resolved	Cost
@nuxtjs/robots	@fingerprintjs/botd	^2.0.0	2.0.0	📦 13 kB gzip
@nuxtjs/robots	@nuxt/kit	^4.5.2	4.5.2	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	consola	^3.4.2	3.4.2	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	defu	^6.1.7	6.1.7	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	h3	^1.15.11	1.15.11	📦 34 kB gzip
@nuxtjs/robots	nuxt-site-config	^4.2.3	4.2.3	📦 10 kB gzip
@nuxtjs/robots	nuxtseo-shared	^5.3.14	5.3.14	📦 23 kB gzip
@nuxtjs/robots	pathe	^2.0.3	2.0.3	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	pkg-types	^2.3.1	2.3.1	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	ufo	^1.6.4	1.6.4	♻️ free via Nuxt 4.5.2

_{Baseline: main_@_4697167___2026-08-21 · gzip is the comparison metric · changes below 16 B gzip are ignored}

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
zod (source)	>=3 → >=4.5.4

---

Release Notes

colinhacks/zod (zod)

v4.5.4

Compare Source

Commits:

• 84e416f fix(v4): stop the cycle walk from firing a default factory (#​6500)
• e8e206f 4.5.4

v4.5.3

Compare Source

v4.5.2

Compare Source

Commits:

• a354314 fix(docs): keep blog posts out of the docs collection (#​6484)
• d378c42 ci: drop canary publishing from the release workflow (#​6487)
• 212b941 fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#​6488)
• e7576f5 docs(blog): let the page show through the navbar in dark mode (#​6489)
• fedb06f fix(docs): match the blog TOC hover bar to the 2px active indicator
• 6c932fc chore: bump devcontainer image to Node 24 (#​6470)
• 6635d9d docs(blog): soften the "method memoization" attribution
• 019ae29 fix(docs): drop ISR on the docs route so the home page hydrates
• 652bb43 chore(docs): drop the scroll log from the route-change scroller
• 571c8e8 fix(docs): render blog tabs with the stock fumadocs tab card
• 9a193aa 4.5.2

v4.5.1

Compare Source

Commits:

• 2e862db ci: gate the GitHub release and JSR publish on the version being live on npm
• 8e03380 4.5.1

v4.5.0

Compare Source

Zod 4.5 is now available.

npm install zod@latest

At a glance:

• z.compile() — the flagship feature of Zod 4.5
• z.creditCard() — 12–19 digits plus Luhn checksum
• z.properties() — the multi-property counterpart to z.property()
• z.deepPartial()/.exactPartial()
• z.validate(): boolean — a fast-path to verify input validity without a full parse (up to 16x faster on invalid data)
• 9x reduction in memory footprint
• New locales: Bengali (bn), Central Kurdish (ckb), Hindi (hi), Kannada (kn), Norwegian Nynorsk (nn), Brazilian Portuguese (pt-BR), Slovak (sk), Turkmen (tk)

z.compile()

You can now pre-compile any Zod schema using z.compile(schema). This dramatically speeds up parsing performance.

import*aszfrom"zod";constPlayer=z.object({username: z.string(),bio: z.string(),xp: z.number()});constCompiledPlayer=z.compile(Player);

A compiled schema can be used exactly like an uncompiled one. There are no special rules around compiled schemas. They're just faster.

Player.parse({ ... });CompiledPlayer.parse({ ... });// ~2x faster

On objects, arrays, and unions, this speeds up parsing by a factor of ~3–7. More complex schemas stand to benefit more than simpler ones.

Time per parse by schema type, standard parser vs compiled — lower is better (benchmark)

Below are the Moltar benchmark results comparing Zod (compiled and uncompiled) against the Moltar ParseSafe bench.

Throughput on the moltar benchmark fixture (parseSafe: returns a new object with unknown keys stripped) — higher is better (benchmark)

And the equivalent results for the Moltar AssertLoose bench. Tested against the new z.validate(schema, input) function (detailed later in the post).

Throughput on the moltar benchmark fixture (assertLoose: returns a boolean, unknown keys allowed) — higher is better (benchmark)

Zod's entire test suite runs twice—once normally and again with auto-compilation enabled globally—to ensure perfect fidelity.

How it works

Under the hood, z.compile() walks the entire schema once and produces a hyperoptimized snippet of flat, loop-free JavaScript that can validate inputs far faster than a standard runtime validator. This snippet can be executed via new Function() (effectively a more powerful eval) to serve as a fast-path validator. Schemas use this to "fast check" validity, falling back to the regular runtime logic on validation failure to provide granular error information.

Take this simple Point schema:

constPoint=z.object({x: z.number(),y: z.number()});

Here is the generated snippet for it:

constisPoint=newFunction("input",` if (typeof input !== "object" || input === null) return false; if (typeof input.x !== "number") return false; if (typeof input.y !== "number") return false; return true;`);isPoint({x: 1,y: 2});// trueisPoint({x: "1"});// false

For the large majority of inputs, the generated function validates the data with the fastest logic JavaScript can express: straight-line typeof checks and property reads, with no interpreter in between. When it can't handle an input, Zod falls back to the standard parser.

This is the function Zod generates for the Player schema above:

if(typeofinput!=="object"||input===null||Array.isArray(input))returnINVALID;constv0=input["username"];if(typeofv0!=="string")returnINVALID;constv1=input["bio"];if(typeofv1!=="string")returnINVALID;constv2=input["xp"];if(typeofv2!=="number"||!Number.isFinite(v2))returnINVALID;constv3={"username": v0,"bio": v1,"xp": v2};returnv3;

Armed with the power of new Function(), this happens in-process at runtime. There is no need to integrate with your build system.

The compiled schema is purely additive on top of the existing schema. It tacks on the pre-compiled fast path for checking valid inputs. When invalid data is detected, it returns the INVALID symbol to signal that parsing should fall back to the uncompiled parser. This structurally prevents subtle deviations in error reporting between compiled and uncompiled variants.

import "zod/compile"

To compile every schema in an application, import zod/compile once at the top of your entry point. Every schema constructed after that import is automatically compiled the first time it's used to parse data.

import"zod/compile";// must come before modules that define schemasimport*aszfrom"zod";constschema=z.object({name: z.string()});schema.parse({name: "ok"});// compiled on first parse

It also works as a Node.js CLI flag, which guarantees it runs before any module defines a schema:

node --import zod/compile app.js

Or set preload in bunfig.toml or nub.jsonc.

{
"preload": ["zod/compile"]
}

All schemas benefit to varying degrees, though complex object/tuple/array schemas benefit more than simple scalar validators.

Read the docs, or the full technical writeup: Introducing z.compile()

z.creditCard()

A new string format: 12–19 digits, optionally separated by single spaces or hyphens, with a valid Luhn checksum. (#​5931)

z.creditCard().parse("4111 1111 1111 1111");// ✅z.creditCard().parse("4111 1111 1111 1112");// ❌ bad checksum

z.properties()

The multi-property counterpart to z.property(). (#​5912)

consthttpsUrl=z.instanceof(URL).check(
...z.properties({protocol: z.literal("https:"asstring),hostname: z.string().regex(z.regexes.domain),}));httpsUrl.parse(newURL("https://example.com"));// ✅httpsUrl.parse(newURL("http://localhost"));// ❌ protocol

z.deepPartial()

Back in functional form after being removed as a method in Zod 4. (#​5928)

constPost=z.object({title: z.string(),author: z.object({name: z.string(),email: z.string()}),});constPartialPost=z.deepPartial(Post);typePartialPost=z.output<typeofPartialPost>;// => { title?: string; author?: { name?: string; email?: string }}PartialPost.parse({author: {}});// ✅

The result is still a ZodObject, so .shape and .extend() keep working.

.exactPartial()

Like .partial(), but wraps each field in z.exactOptional() instead of z.optional(): keys may be omitted, but an explicit undefined is rejected. This matches TypeScript's Partial<> under exactOptionalPropertyTypes. (#​6065)

constRecipe=z.object({title: z.string(),servings: z.number()});constPartialRecipe=Recipe.exactPartial();PartialRecipe.parse({});// ✅PartialRecipe.parse({title: undefined});// ❌

In Zod Mini it's a top-level function: z.exactPartial(Recipe).

z.validate()

Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a ZodError, which makes rejection cheap: on invalid input it is up to 16x faster than .safeParse().success. The return type is a guard on the schema's input type, and z.validateAsync() covers schemas with async refinements. (#​6471)

z.validate(z.string(),"hi");// truez.validate(z.string(),42);// false

z.input() / z.output()

Project a schema onto its input or output side. Useful for validating the two halves of a codec independently. (#​5928)

constisoDate=z.codec(z.iso.datetime(),z.date(),{decode: (s)=>newDate(s),encode: (d)=>d.toISOString(),});constEvent=z.object({name: z.string(),at: isoDate});z.input(Event).parse({name: "launch",at: "2024-01-01T00:00:00Z"});// ✅z.output(Event).parse({name: "launch",at: newDate()});// ✅

This is a no-op on schemas not containing codecs/pipes.

z.toZod<T>()

A utility to define a Zod schema that agrees exactly with a static type, often one that is handwritten or externally defined. (#​5913)

typePlayer={username: string;xp: number};constPlayer=z.toZod<Player>()(z.object({username: z.string(),xp: z.number(),}));Player.shape.username;// ZodString — the schema is returned unchanged

z.getDiscriminatedOption()

Extract a discriminated union member by discriminator value. (#​5947)

constFruit=z.object({type: z.literal("fruit"),seeds: z.boolean()});constVeg=z.object({type: z.literal("vegetable"),leafy: z.boolean()});constProduce=z.discriminatedUnion("type",[Fruit,Veg]);z.getDiscriminatedOption(Produce,"fruit");// typeof Fruitz.getDiscriminatedOption(Produce,"meat");// ❌ TypeScript error

Cyclical inputs

Zod recursive schemas now support cyclical data. For bundle size reasons, Zod Mini requires you to register a memoizer explicitly. (#​6387, #​6482)

Zod

constCategory=z.object({name: z.string(),getsubcategories(){returnz.array(Category);},});constinput: any={name: "root",subcategories: []};input.subcategories.push(input);constresult=Category.parse(input);result.subcategories[0]===result;// true

Zod Mini

// register a memoizer before defining any schemasz.config({memoizer: z.memoizer()});constresult=Category.parse(input);result.subcategories[0]===result;// true

9x reduction in schema memory footprint

In Zod 4.4 a bare z.string() retained 7.5kb of heap. In Zod 4.5 it retains 784 bytes.

Retained heap per schema instance, Zod 4.4.3 vs 4.5 (benchmark)

In Zod 4.4 and earlier, all schema methods were automatically bound to the instance itself. This allowed users to pluck methods from schemas without causing issues due to this-binding.

const{ parse }=z.string();parse("some data");

A consequence of this is that each bound method allocates space on the heap; method implementations are not shared across all instances via prototype, as you'd expect. Zod 4.5 implements a method memoization pattern that avoids allocating bound methods until they are actually accessed.

Read the deep dive: Reducing Zod's memory footprint by an order of magnitude

Faster failures

Zod .parse()/.safeParse() instantiates a JavaScript Error, which captures a stack trace. In the case of validation failures, this is often much slower than the parsing logic itself. When using .safeParse(), Zod no longer captures this stack trace, speeding up failure-path parses by a factor of ~7.5x. (#​6316, #​6450)

constresult=Player.safeParse({username: 42,bio: "hello",xp: 12});result.success;// false — ~7.5x faster than Zod 4.4

Player schema (benchmark)

Symbol keys in z.object()

A shape can now declare a symbol key. TypeScript tracks it: a const symbol infers as unique symbol, so z.infer makes the key required and checks its value type. Undeclared symbol keys are still ignored. (#​6448)

constTAG=Symbol("tag");constschema=z.object({name: z.string(),[TAG]: z.number()});schema.parse({name: "alice",[TAG]: 42});// ✅ { name: "alice", [TAG]: 42 }schema.safeParse({name: "alice"});// ❌ the symbol key is required

Bug fixes

All of these fix soundness issues, so a schema that relied on the old behavior may now reject input it used to accept.

⚠️z.iso.datetime() requires seconds

RFC 3339 mandates seconds. z.iso.datetime() and z.iso.datetime({ offset: true }) no longer accept minute-precision input like 2020-01-01T06:15Z. local: true still admits 2020-01-01T06:15, since an unqualified datetime is outside RFC 3339 either way. (#​6457)

z.iso.datetime().parse("2020-01-01T06:15:00Z");// ✅z.iso.datetime().parse("2020-01-01T06:15Z");// ❌ was accepted in 4.4

To accept both forms, union the two precisions:

z.union([z.iso.datetime(),z.iso.datetime({precision: -1})]);

⚠️ String length counts code points

.min(), .max(), and .length() counted UTF-16 code units, so z.string().max(5) rejected five emoji. They now count Unicode code points, which is what every non-JS consumer of a length bound does (Postgres, MySQL, Go, Python, and the maxLength that z.toJSONSchema() emits). .max() only loosens; .min() and .length() tighten for astral input. Graphemes are unchanged — a ZWJ sequence is still several code points. (#​6441)

z.string().max(5).parse("😀😀😀😀😀");// was too_big, now passesz.string().min(5).parse("😀😀😀");// was fine, now too_small

Closes #​3355.

⚠️ Record keys and intersections match TypeScript

A record's key schema now governs only the keys that match it, the way TypeScript treats an index signature. Intersecting an object with a pattern-keyed record no longer rejects the object's own keys. (#​6412)

z.object({name: z.string()}).and(z.record(z.string().regex(/^S_/),z.string())).parse({name: "a",S_a: "s"});// 4.4: throws invalid_key on "name"// 4.5: { name: "a", S_a: "s" }

Separately, an unrecognized_keys issue no longer aborts the schema it came from, so a strict object with an extra key and a bad value now reports both issues instead of just the first. Closes #​2200, #​2573, #​4017, #​5663.

⚠️__proto__ is always stripped

Object and record parsers now drop a __proto__ key whether it comes from the input, is declared by the schema, or is produced by a record key transform. A key that a record's key schema normalizes to __proto__ is dropped too. .strict() reports an own __proto__ input key as unrecognized_keys instead of silently swallowing it. Error formatters and both JSON Schema converters use own-property writes so a toString or constructor path segment can't walk onto Object.prototype (#​6213, #​6367, #​6346). (#​6386, #​6354, #​6355, #​6221)

⚠️ Stricter string formats

• z.ipv6() validated by handing the string to new URL(), which let ::@1\ and ::1\n through. It now checks the address alphabet directly (#​6442).
• z.ulid() restricts the first character to 0–7; anything higher overflows the 48-bit timestamp. A fixture that doesn't start with a real timestamp, such as one with a leading letter, is now rejected (#​6095).
• z.httpUrl() enforces the RFC 1035 length limits on the host, matching z.hostname() (#​6035).
• z.emoji() no longer backtracks exponentially on a failed match (#​6347).
• z.string().includes(sub, { position: N }) emits a JSON Schema pattern that allows at least N leading characters, matching String.prototype.includes (#​6024).

Commits

Zod 4.5 rolls up 155 commits. Thanks to everyone who contributed: @​dokson, @​deepshekhardas, @​zirkelc, @​francisjohnjohnston-web, @​MerlijnW70, @​codinsonn, @​oimo23, @​JSap0914, @​zelinewang, @​abhishek-chaudhary2003, @​spokodev, @​Mohammad-Faiz-Cloud-Engineer, @​hamed-bavar, @​MGPOCKY, @​ChiChuRita, @​dinwwwh, @​thristhart, @​tsmartin9, @​vedanshshetti, @​belicam, @​frastefanini, @​andersk, @​musaddiq-rafi, @​tachmyratsaparmyradov, @​arvindfroi, @​KUMachine, @​spidersouris, @​catdalfonso, @​mneetika, @​gwagjiug, @​MahinAnowar, @​MaksZhukov, @​emmayusufu, @​agcty, @​devareddy05, @​Vish05, @​yamcodes, @​mattiasahlsen, @​samchungy, @​ozzyfromspace, @​udohjeremiah, @​patrickwehbe, @​gajus, @​Harm-Nullix, @​thwbh, @​IdanGonen, @​irfanfandi, @​JuerGenie, @​marcalexiei, @​itsahmedbilal, @​DucMinhNe, @​meliharik.

• 9782f87c perf(v4): validate without building the output, and keep schemas out of dictionary mode (#​6480) by @​colinhacks
• 773a4867 refactor(v4): declare a trait's members on $constructor (#​6478) by @​colinhacks
• 68fb3f13 feat(v4): make z.compile() fall back instead of throwing (#​6479) by @​colinhacks
• 37b01501 feat(v4): add z.isValid and z.isValidAsync (#​6471) by @​colinhacks
• 749f5452 docs: add fullproduct.dev to v4 ecosystem page (#​6001) by @​codinsonn
• 24cdb7fd perf(v4): close the fastpass bindings into the compiled parser (#​6464) by @​colinhacks
• 8d896186 fix(v4): stop emitting a multipleOf that JSON Schema rejects (#​6468) by @​colinhacks
• 43f729db feat(v4): make a tuple's items optional with .partial() (#​6465) by @​colinhacks
• 97edaf7d fix(v4): don't throw from safeParse on bigint multipleOf(0n) (#​6466) by @​colinhacks
• 21a6f0cb feat(v4): let z.nanoid() take a custom length (#​4004) by @​oimo23
• 9d5b20ef fix(v4): restrict the first ULID character to [0-7] (#​6095) by @​JSap0914
• 1cf9cd09 docs: record that error maps run per parse, and how to translate at render by @​colinhacks
• 7ce3e77d fix(v4): run a wrapper's inner schema on its own payload (#​6462) by @​colinhacks
• 7b612b53 fix(v4): fold an intersection of object schemas into one object (#​6461) by @​colinhacks
• 1c43b774 docs(v4): record why the failure path is not worth compiling by @​colinhacks
• badf0b78 fix(v4): build the catch context from the input that failed (#​6192) by @​zelinewang
• a87ac366 fix(v4)!: distinguish number and bigint formats at the type level (#​6052) by @​abhishek-chaudhary2003
• 6726c1dd docs: record what z.input and z.output do with transforms and wrappers by @​colinhacks
• 7cfc0122 fix(v4): keep a wrapper's stored value only on the side it belongs to by @​colinhacks
• a825c1b0 fix(v4): empty enums and literals match nothing (#​6459) by @​colinhacks
• 7c070db9 feat(v4): expose the function schema on .implement() results (#​6267) by @​deepshekhardas
• 3a496968 fix(v4): make record input keys optional when the value can fill them (#​6460) by @​colinhacks
• 53cec2a0 fix(v4): resolve z.input past a preprocess transform by @​colinhacks
• 2125d30c fix(v4): accept exact decimal multiples in multipleOf (#​6223) by @​spokodev
• 168122fc fix(v4): carry a pipe's own checks through z.output by @​colinhacks
• 51a1368a fix(v4): let the includes(position) pattern match at or after the offset (#​6024) by @​francisjohnjohnston-web
• 72a05c4f feat(v4): expose stringbool truthy/falsy/case via _zod.bag (#​6357) by @​hamed-bavar
• 036b39f4 fix(v4)!: require seconds once a datetime carries a Z or an offset (#​6457) by @​colinhacks
• 5825605e perf(v4): skip the eager stack capture when building a ZodError (#​6450) by @​colinhacks
• d85472c4 feat(v4): support declared symbol keys in z.object() (#​6448) by @​colinhacks
• d4108872 fix(v4): correct the date/time format keywords in both JSON Schema directions (#​6452) by @​colinhacks
• 555e5f46 Add z.toZod helper (#​5913) by @​colinhacks
• e0e51a55 docs(v4): cut the compile comments down to what they explain (#​6449) by @​colinhacks
• 6574e784 fix(v4): stop catch resurrecting issues an optional already resolved (#​6440) by @​colinhacks
• 937b5d01 perf(v4): prefix issue paths in place in the object JIT failure path (#​6445) by @​colinhacks
• b63db248 fix(v4): keep a memoized node's cached issues private to the cache (#​6443) by @​colinhacks
• 6ec3d043 fix(resolution): keep pnpm's own warnings out of the attw snapshot (#​6446) by @​colinhacks
• 830ba314 fix(v4): validate the address, and return the string that was validated (#​6442) by @​colinhacks
• f101d8ca Preserve callsites in parse stack traces (#​5910) by @​colinhacks
• 6c77d028 feat: compact simple anyOf unions to type array in toJSONSchema (#​6339) by @​deepshekhardas
• 28e1ebd8 fix(v4): measure string length in Unicode code points (#​6441) by @​colinhacks
• 060bc9f3 refactor: share default when-clauses for size/length checks (#​6394) by @​zirkelc
• 2848177d docs: point the flattened/formatted error deprecations at a symbol that exists by @​colinhacks
• 3c2dee9e Add properties checks for instanceof schemas (#​5912) by @​colinhacks
• 87ffeb0f fix(v4): an absent key on the middle rung supplies nothing (#​6434) by @​colinhacks
• 7785fc82 feat(v4): add z.getDiscriminatedOption (#​5947) by @​dokson
• 0135c85a feat(v4): allow passing extra args to apply() (#​6337) by @​deepshekhardas
• ca246d26 fix(v4): drop empty alternation branch from datetime pattern (#​6439) by @​colinhacks
• e073d55b docs: z.iso.datetime() accepts a subset of ISO 8601, not all of it by @​colinhacks
• d6ca12ae fix(v4): infer recursive getter options in discriminatedUnion (#​6422) by @​colinhacks
• dc51404b Add shorn to Zod Utilities (#​6398) by @​ChiChuRita
• 580111da docs: mark AOT compilation as canary-only by @​colinhacks
• 6b0dae79 docs: note that a catch callback is not islanded by @​colinhacks
• 898c4461 refactor(v4): give the runtime and compiled code one URL implementation by @​colinhacks
• 260e5d4b fix(v4): stop islanding a catch callback, which diverged silently by @​colinhacks
• 11c9268b revert(core): drop the exactOptional parse prototype from #​6432 (#​6438) by @​colinhacks
• a38ab4a8 fix(core): an omittable discriminator claims undefined (#​6432) by @​colinhacks
• c9ec89e0 perf(core): drop the seal and the per-key WeakSet from the lazy internals (#​6435) by @​colinhacks
• 3c9ca1d9 feat(json-schema): emit a root $ref when the root schema has an id (#​6029) by @​dinwwwh
• fa77a4d7 feat(v4): z.compile — ahead-of-time schema compilation (#​6085) by @​colinhacks
• f300476d fix(v4): let a schema's error map cover its own checks' issues (#​6426) by @​colinhacks
• 9f0a3d81 fix(core): restore defineLazy semantics lost in the internals move (#​6429) by @​colinhacks
• 604464c3 fix(locales): da/nn/no/sv called an IP address a range (#​6430) by @​colinhacks
• 7378e7cd fix(locales): backfill the mac and Sizable.map gaps, and pin dictionary parity (#​6427) by @​colinhacks
• b1077f05 perf(memory): install derived internals on a per-constructor prototype (#​6415) by @​colinhacks
• ccc15144 fix(locales): add the credit_card key to the seven locales missing it (#​6424) by @​colinhacks
• 73bacbbb fix(from-json-schema): drop redundant inclusive bound for draft-04 exclusive ranges (#​6022) by @​francisjohnjohnston-web
• 86b2e6da docs: list el and hr in the supported locales (#​6423) by @​colinhacks
• 45fdeda5 fix(v4): refine optin into a three-rung ladder, retire the fallback payload flag (#​6419) by @​colinhacks
• 5b34c0ce Improve Portuguese localization and add Brazilian Portuguese (pt-BR) (#​6076) by @​thristhart
• dc1a40a5 fix(locales): improve french translation (#​6120) by @​tsmartin9
• 0175a043 feat(locales): add Hindi and Kannada locale support (#​6315) by @​vedanshshetti
• 536ee3b0 Locales: added Slovak (sk) language (#​6041) by @​belicam
• 07b0c3d8 fix: preserve explicit superRefine issue input (#​6053) by @​frastefanini
• ba98071c feat: add .exactPartial() to ZodObject (#​6065) by @​andersk
• 234c407d feat(lang): Added Bengali locale (#​5974) by @​musaddiq-rafi
• 377cd9d7 feat(locales): add turkmen (tk) locale (#​6168) by @​tachmyratsaparmyradov
• 69b6bb08 feat(locales): add Norwegian Nynorsk (nn) locale (#​6092) by @​arvindfroi
• 33d82e6b Add Central Kurdish (ckb) locale (#​6078) by @​KUMachine
• 06666fe2 fix(fr): remove hyphen in "non-optionnel" (#​5999) by @​spidersouris
• 79cfedea feat(v4): expose the owning schema on check-originated issues (#​6420) by @​colinhacks
• 436b5da8 docs: propose compiled constructor graph by @​colinhacks
• eb4682c9 fix(json-schema): resolve tuple minItems past transform and catch in input mode (#​6418) by @​colinhacks
• 4d6b5cd3 fix(json-schema): route unrepresentable default values through unrepresentable by @​colinhacks
• 2abc9e05 docs: note that the JSON Schema emitter reads static optin (#​6417) by @​colinhacks
• 578e1cd0 feat(v4): support format: "hostname" in fromJSONSchema (#​6305) by @​catdalfonso
• 942bf8cb feat(v4): parse input containing reference cycles (#​6387) by @​colinhacks
• 78b523f0 fix(json-schema): keep preprocess object properties required in input mode (#​6133) by @​MerlijnW70
• 973b1b44 fix(v4): strip output-typed catch values from the input JSON Schema (#​6409) by @​colinhacks
• 5e608851 feat(v4): add z.deepPartial and runtime z.input / z.output (#​5928) by @​dokson
• 4e1720c8 fix(v4): align record keys and intersection strictness with TypeScript (#​6412) by @​colinhacks
• 4cc4053d fix: honor loose mode for closed record key schemas (#​6157) by @​pullfrog[bot]
• 69be843f fix(v4): stop the object JIT fastpass keeping a swallowed issue's value (#​6407) by @​colinhacks
• b899cd17 perf(json-schema): make toJSONSchema(registry) linear in registry size (#​6408) by @​colinhacks
• 6074828e fix(v4): make fromJSONSchema propertyNames compose with the other object keywords (#​6411) by @​colinhacks
• d7b209f3 docs: point the Web URLs callout at z.httpUrl() (#​6410) by @​colinhacks
• 611bd762 fix(mini): make merge() take an object schema, matching classic (#​6404) by @​colinhacks
• b53e53cc fix(v4): use exact flag in English locale too_small/too_big messages (#​6177) by @​pullfrog[bot]
• 421cc9a5 fix(json-schema): unescape JSON Pointer tokens when resolving $ref (#​6402) by @​colinhacks
• 4c27fe87 fix(v4): give z.xor() a distinct error when multiple options match (#​6376) by @​colinhacks
• a106fbe7 fix(v4): make fromJSONSchema tuples open-ended by default (#​6020) by @​mneetika
• e8034eba fix(v4): make prefixItems/draft-7 items respect minItems in fromJSONSchema (#​6201) by @​pullfrog[bot]
• 784e5c26 fix(v4): let bundlers tree-shake locales out of the default import (#​6384) by @​colinhacks
• 97edd70a fix(toJSONSchema): constrain closed tuple length (#​6194) by @​pullfrog[bot]
• f150020d fix(v4): escape non-string enum values in template literal patterns (#​5934) by @​gwagjiug
• faf33a28 fix: surface @​deprecated on re-exported compat aliases (#​6072) by @​MahinAnowar
• 3956224a docs: state that metadata wins over generated JSON Schema keywords (#​6401) by @​colinhacks
• a1904fc2 fix(v4): report date origin for numeric min/max bounds (#​6129) by @​MerlijnW70
• bd18314c fix: escape JSON Pointer reserved characters in toJSONSchema $ref (closes #​6027) (#​6144) by @​MaksZhukov
• 2a5164f5 fix(v4): enforce RFC 1035 length limits in regexes.domain (#​6035) by @​emmayusufu
• 0e5bc4b1 fix(v4): respect additionalProperties:false with patternProperties in fromJSONSchema (#​6199) by @​pullfrog[bot]
• c8f06d36 fix(v4): clarify infinite number errors (#​5906) by @​colinhacks

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@nuxtjs/robots@255

commit: 3659cba

[github-actions]

📦 Package Size

✅ No notable size changes

All tracked output (10)

Package output	Gzipped	Raw
@nuxtjs/robots · dependency @fingerprintjs/botd	13 kB	55 kB	✅
@nuxtjs/robots · dependency h3	34 kB	146 kB	✅
@nuxtjs/robots · dependency nuxt-site-config	10 kB	25 kB	✅
@nuxtjs/robots · dependency nuxtseo-shared	23 kB	76 kB	✅
@nuxtjs/robots · export .	5.3 kB	20 kB	✅
@nuxtjs/robots · export ./content	292 B	503 B	✅
@nuxtjs/robots · export ./util	6.6 kB	25 kB	✅
@nuxtjs/robots · published payload	36 kB	121 kB	✅
@nuxtjs/robots · app runtime	2.5 kB	6.2 kB	✅
@nuxtjs/robots · server runtime	8.6 kB	22 kB	✅

Runtime dependencies (10)

Package	Dependency	Requested	Resolved	Cost
@nuxtjs/robots	@fingerprintjs/botd	^2.0.0	2.0.0	📦 13 kB gzip
@nuxtjs/robots	@nuxt/kit	^4.5.2	4.5.2	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	consola	^3.4.2	3.4.2	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	defu	^6.1.7	6.1.7	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	h3	^1.15.11	1.15.11	📦 34 kB gzip
@nuxtjs/robots	nuxt-site-config	^4.2.3	4.2.3	📦 10 kB gzip
@nuxtjs/robots	nuxtseo-shared	^5.3.14	5.3.14	📦 23 kB gzip
@nuxtjs/robots	pathe	^2.0.3	2.0.3	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	pkg-types	^2.3.1	2.3.1	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	ufo	^1.6.4	1.6.4	♻️ free via Nuxt 4.5.2

_{Baseline: main_@_4697167___2026-08-21 · gzip is the comparison metric · changes below 16 B gzip are ignored}

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
zod (source)	>=3 → >=4.5.4

---

Release Notes

colinhacks/zod (zod)

v4.5.4

Compare Source

Commits:

• 84e416f fix(v4): stop the cycle walk from firing a default factory (#​6500)
• e8e206f 4.5.4

v4.5.3

Compare Source

v4.5.2

Compare Source

Commits:

• a354314 fix(docs): keep blog posts out of the docs collection (#​6484)
• d378c42 ci: drop canary publishing from the release workflow (#​6487)
• 212b941 fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#​6488)
• e7576f5 docs(blog): let the page show through the navbar in dark mode (#​6489)
• fedb06f fix(docs): match the blog TOC hover bar to the 2px active indicator
• 6c932fc chore: bump devcontainer image to Node 24 (#​6470)
• 6635d9d docs(blog): soften the "method memoization" attribution
• 019ae29 fix(docs): drop ISR on the docs route so the home page hydrates
• 652bb43 chore(docs): drop the scroll log from the route-change scroller
• 571c8e8 fix(docs): render blog tabs with the stock fumadocs tab card
• 9a193aa 4.5.2

v4.5.1

Compare Source

Commits:

• 2e862db ci: gate the GitHub release and JSR publish on the version being live on npm
• 8e03380 4.5.1

v4.5.0

Compare Source

Zod 4.5 is now available.

npm install zod@latest

At a glance:

• z.compile() — the flagship feature of Zod 4.5
• z.creditCard() — 12–19 digits plus Luhn checksum
• z.properties() — the multi-property counterpart to z.property()
• z.deepPartial()/.exactPartial()
• z.validate(): boolean — a fast-path to verify input validity without a full parse (up to 16x faster on invalid data)
• 9x reduction in memory footprint
• New locales: Bengali (bn), Central Kurdish (ckb), Hindi (hi), Kannada (kn), Norwegian Nynorsk (nn), Brazilian Portuguese (pt-BR), Slovak (sk), Turkmen (tk)

z.compile()

You can now pre-compile any Zod schema using z.compile(schema). This dramatically speeds up parsing performance.

import*aszfrom"zod";constPlayer=z.object({username: z.string(),bio: z.string(),xp: z.number()});constCompiledPlayer=z.compile(Player);

A compiled schema can be used exactly like an uncompiled one. There are no special rules around compiled schemas. They're just faster.

Player.parse({ ... });CompiledPlayer.parse({ ... });// ~2x faster

On objects, arrays, and unions, this speeds up parsing by a factor of ~3–7. More complex schemas stand to benefit more than simpler ones.

Time per parse by schema type, standard parser vs compiled — lower is better (benchmark)

Below are the Moltar benchmark results comparing Zod (compiled and uncompiled) against the Moltar ParseSafe bench.

Throughput on the moltar benchmark fixture (parseSafe: returns a new object with unknown keys stripped) — higher is better (benchmark)

And the equivalent results for the Moltar AssertLoose bench. Tested against the new z.validate(schema, input) function (detailed later in the post).

Throughput on the moltar benchmark fixture (assertLoose: returns a boolean, unknown keys allowed) — higher is better (benchmark)

Zod's entire test suite runs twice—once normally and again with auto-compilation enabled globally—to ensure perfect fidelity.

How it works

Under the hood, z.compile() walks the entire schema once and produces a hyperoptimized snippet of flat, loop-free JavaScript that can validate inputs far faster than a standard runtime validator. This snippet can be executed via new Function() (effectively a more powerful eval) to serve as a fast-path validator. Schemas use this to "fast check" validity, falling back to the regular runtime logic on validation failure to provide granular error information.

Take this simple Point schema:

constPoint=z.object({x: z.number(),y: z.number()});

Here is the generated snippet for it:

constisPoint=newFunction("input",` if (typeof input !== "object" || input === null) return false; if (typeof input.x !== "number") return false; if (typeof input.y !== "number") return false; return true;`);isPoint({x: 1,y: 2});// trueisPoint({x: "1"});// false

For the large majority of inputs, the generated function validates the data with the fastest logic JavaScript can express: straight-line typeof checks and property reads, with no interpreter in between. When it can't handle an input, Zod falls back to the standard parser.

This is the function Zod generates for the Player schema above:

if(typeofinput!=="object"||input===null||Array.isArray(input))returnINVALID;constv0=input["username"];if(typeofv0!=="string")returnINVALID;constv1=input["bio"];if(typeofv1!=="string")returnINVALID;constv2=input["xp"];if(typeofv2!=="number"||!Number.isFinite(v2))returnINVALID;constv3={"username": v0,"bio": v1,"xp": v2};returnv3;

Armed with the power of new Function(), this happens in-process at runtime. There is no need to integrate with your build system.

The compiled schema is purely additive on top of the existing schema. It tacks on the pre-compiled fast path for checking valid inputs. When invalid data is detected, it returns the INVALID symbol to signal that parsing should fall back to the uncompiled parser. This structurally prevents subtle deviations in error reporting between compiled and uncompiled variants.

import "zod/compile"

To compile every schema in an application, import zod/compile once at the top of your entry point. Every schema constructed after that import is automatically compiled the first time it's used to parse data.

import"zod/compile";// must come before modules that define schemasimport*aszfrom"zod";constschema=z.object({name: z.string()});schema.parse({name: "ok"});// compiled on first parse

It also works as a Node.js CLI flag, which guarantees it runs before any module defines a schema:

node --import zod/compile app.js

Or set preload in bunfig.toml or nub.jsonc.

{
"preload": ["zod/compile"]
}

All schemas benefit to varying degrees, though complex object/tuple/array schemas benefit more than simple scalar validators.

Read the docs, or the full technical writeup: Introducing z.compile()

z.creditCard()

A new string format: 12–19 digits, optionally separated by single spaces or hyphens, with a valid Luhn checksum. (#​5931)

z.creditCard().parse("4111 1111 1111 1111");// ✅z.creditCard().parse("4111 1111 1111 1112");// ❌ bad checksum

z.properties()

The multi-property counterpart to z.property(). (#​5912)

consthttpsUrl=z.instanceof(URL).check(
...z.properties({protocol: z.literal("https:"asstring),hostname: z.string().regex(z.regexes.domain),}));httpsUrl.parse(newURL("https://example.com"));// ✅httpsUrl.parse(newURL("http://localhost"));// ❌ protocol

z.deepPartial()

Back in functional form after being removed as a method in Zod 4. (#​5928)

constPost=z.object({title: z.string(),author: z.object({name: z.string(),email: z.string()}),});constPartialPost=z.deepPartial(Post);typePartialPost=z.output<typeofPartialPost>;// => { title?: string; author?: { name?: string; email?: string }}PartialPost.parse({author: {}});// ✅

The result is still a ZodObject, so .shape and .extend() keep working.

.exactPartial()

Like .partial(), but wraps each field in z.exactOptional() instead of z.optional(): keys may be omitted, but an explicit undefined is rejected. This matches TypeScript's Partial<> under exactOptionalPropertyTypes. (#​6065)

constRecipe=z.object({title: z.string(),servings: z.number()});constPartialRecipe=Recipe.exactPartial();PartialRecipe.parse({});// ✅PartialRecipe.parse({title: undefined});// ❌

In Zod Mini it's a top-level function: z.exactPartial(Recipe).

z.validate()

Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a ZodError, which makes rejection cheap: on invalid input it is up to 16x faster than .safeParse().success. The return type is a guard on the schema's input type, and z.validateAsync() covers schemas with async refinements. (#​6471)

z.validate(z.string(),"hi");// truez.validate(z.string(),42);// false

z.input() / z.output()

Project a schema onto its input or output side. Useful for validating the two halves of a codec independently. (#​5928)

constisoDate=z.codec(z.iso.datetime(),z.date(),{decode: (s)=>newDate(s),encode: (d)=>d.toISOString(),});constEvent=z.object({name: z.string(),at: isoDate});z.input(Event).parse({name: "launch",at: "2024-01-01T00:00:00Z"});// ✅z.output(Event).parse({name: "launch",at: newDate()});// ✅

This is a no-op on schemas not containing codecs/pipes.

z.toZod<T>()

A utility to define a Zod schema that agrees exactly with a static type, often one that is handwritten or externally defined. (#​5913)

typePlayer={username: string;xp: number};constPlayer=z.toZod<Player>()(z.object({username: z.string(),xp: z.number(),}));Player.shape.username;// ZodString — the schema is returned unchanged

z.getDiscriminatedOption()

Extract a discriminated union member by discriminator value. (#​5947)

constFruit=z.object({type: z.literal("fruit"),seeds: z.boolean()});constVeg=z.object({type: z.literal("vegetable"),leafy: z.boolean()});constProduce=z.discriminatedUnion("type",[Fruit,Veg]);z.getDiscriminatedOption(Produce,"fruit");// typeof Fruitz.getDiscriminatedOption(Produce,"meat");// ❌ TypeScript error

Cyclical inputs

Zod recursive schemas now support cyclical data. For bundle size reasons, Zod Mini requires you to register a memoizer explicitly. (#​6387, #​6482)

Zod

constCategory=z.object({name: z.string(),getsubcategories(){returnz.array(Category);},});constinput: any={name: "root",subcategories: []};input.subcategories.push(input);constresult=Category.parse(input);result.subcategories[0]===result;// true

Zod Mini

// register a memoizer before defining any schemasz.config({memoizer: z.memoizer()});constresult=Category.parse(input);result.subcategories[0]===result;// true

9x reduction in schema memory footprint

In Zod 4.4 a bare z.string() retained 7.5kb of heap. In Zod 4.5 it retains 784 bytes.

Retained heap per schema instance, Zod 4.4.3 vs 4.5 (benchmark)

In Zod 4.4 and earlier, all schema methods were automatically bound to the instance itself. This allowed users to pluck methods from schemas without causing issues due to this-binding.

const{ parse }=z.string();parse("some data");

A consequence of this is that each bound method allocates space on the heap; method implementations are not shared across all instances via prototype, as you'd expect. Zod 4.5 implements a method memoization pattern that avoids allocating bound methods until they are actually accessed.

Read the deep dive: Reducing Zod's memory footprint by an order of magnitude

Faster failures

Zod .parse()/.safeParse() instantiates a JavaScript Error, which captures a stack trace. In the case of validation failures, this is often much slower than the parsing logic itself. When using .safeParse(), Zod no longer captures this stack trace, speeding up failure-path parses by a factor of ~7.5x. (#​6316, #​6450)

constresult=Player.safeParse({username: 42,bio: "hello",xp: 12});result.success;// false — ~7.5x faster than Zod 4.4

Player schema (benchmark)

Symbol keys in z.object()

A shape can now declare a symbol key. TypeScript tracks it: a const symbol infers as unique symbol, so z.infer makes the key required and checks its value type. Undeclared symbol keys are still ignored. (#​6448)

constTAG=Symbol("tag");constschema=z.object({name: z.string(),[TAG]: z.number()});schema.parse({name: "alice",[TAG]: 42});// ✅ { name: "alice", [TAG]: 42 }schema.safeParse({name: "alice"});// ❌ the symbol key is required

Bug fixes

All of these fix soundness issues, so a schema that relied on the old behavior may now reject input it used to accept.

⚠️z.iso.datetime() requires seconds

RFC 3339 mandates seconds. z.iso.datetime() and z.iso.datetime({ offset: true }) no longer accept minute-precision input like 2020-01-01T06:15Z. local: true still admits 2020-01-01T06:15, since an unqualified datetime is outside RFC 3339 either way. (#​6457)

z.iso.datetime().parse("2020-01-01T06:15:00Z");// ✅z.iso.datetime().parse("2020-01-01T06:15Z");// ❌ was accepted in 4.4

To accept both forms, union the two precisions:

z.union([z.iso.datetime(),z.iso.datetime({precision: -1})]);

⚠️ String length counts code points

.min(), .max(), and .length() counted UTF-16 code units, so z.string().max(5) rejected five emoji. They now count Unicode code points, which is what every non-JS consumer of a length bound does (Postgres, MySQL, Go, Python, and the maxLength that z.toJSONSchema() emits). .max() only loosens; .min() and .length() tighten for astral input. Graphemes are unchanged — a ZWJ sequence is still several code points. (#​6441)

z.string().max(5).parse("😀😀😀😀😀");// was too_big, now passesz.string().min(5).parse("😀😀😀");// was fine, now too_small

Closes #​3355.

⚠️ Record keys and intersections match TypeScript

A record's key schema now governs only the keys that match it, the way TypeScript treats an index signature. Intersecting an object with a pattern-keyed record no longer rejects the object's own keys. (#​6412)

z.object({name: z.string()}).and(z.record(z.string().regex(/^S_/),z.string())).parse({name: "a",S_a: "s"});// 4.4: throws invalid_key on "name"// 4.5: { name: "a", S_a: "s" }

Separately, an unrecognized_keys issue no longer aborts the schema it came from, so a strict object with an extra key and a bad value now reports both issues instead of just the first. Closes #​2200, #​2573, #​4017, #​5663.

⚠️__proto__ is always stripped

Object and record parsers now drop a __proto__ key whether it comes from the input, is declared by the schema, or is produced by a record key transform. A key that a record's key schema normalizes to __proto__ is dropped too. .strict() reports an own __proto__ input key as unrecognized_keys instead of silently swallowing it. Error formatters and both JSON Schema converters use own-property writes so a toString or constructor path segment can't walk onto Object.prototype (#​6213, #​6367, #​6346). (#​6386, #​6354, #​6355, #​6221)

⚠️ Stricter string formats

• z.ipv6() validated by handing the string to new URL(), which let ::@1\ and ::1\n through. It now checks the address alphabet directly (#​6442).
• z.ulid() restricts the first character to 0–7; anything higher overflows the 48-bit timestamp. A fixture that doesn't start with a real timestamp, such as one with a leading letter, is now rejected (#​6095).
• z.httpUrl() enforces the RFC 1035 length limits on the host, matching z.hostname() (#​6035).
• z.emoji() no longer backtracks exponentially on a failed match (#​6347).
• z.string().includes(sub, { position: N }) emits a JSON Schema pattern that allows at least N leading characters, matching String.prototype.includes (#​6024).

Commits

Zod 4.5 rolls up 155 commits. Thanks to everyone who contributed: @​dokson, @​deepshekhardas, @​zirkelc, @​francisjohnjohnston-web, @​MerlijnW70, @​codinsonn, @​oimo23, @​JSap0914, @​zelinewang, @​abhishek-chaudhary2003, @​spokodev, @​Mohammad-Faiz-Cloud-Engineer, @​hamed-bavar, @​MGPOCKY, @​ChiChuRita, @​dinwwwh, @​thristhart, @​tsmartin9, @​vedanshshetti, @​belicam, @​frastefanini, @​andersk, @​musaddiq-rafi, @​tachmyratsaparmyradov, @​arvindfroi, @​KUMachine, @​spidersouris, @​catdalfonso, @​mneetika, @​gwagjiug, @​MahinAnowar, @​MaksZhukov, @​emmayusufu, @​agcty, @​devareddy05, @​Vish05, @​yamcodes, @​mattiasahlsen, @​samchungy, @​ozzyfromspace, @​udohjeremiah, @​patrickwehbe, @​gajus, @​Harm-Nullix, @​thwbh, @​IdanGonen, @​irfanfandi, @​JuerGenie, @​marcalexiei, @​itsahmedbilal, @​DucMinhNe, @​meliharik.

• 9782f87c perf(v4): validate without building the output, and keep schemas out of dictionary mode (#​6480) by @​colinhacks
• 773a4867 refactor(v4): declare a trait's members on $constructor (#​6478) by @​colinhacks
• 68fb3f13 feat(v4): make z.compile() fall back instead of throwing (#​6479) by @​colinhacks
• 37b01501 feat(v4): add z.isValid and z.isValidAsync (#​6471) by @​colinhacks
• 749f5452 docs: add fullproduct.dev to v4 ecosystem page (#​6001) by @​codinsonn
• 24cdb7fd perf(v4): close the fastpass bindings into the compiled parser (#​6464) by @​colinhacks
• 8d896186 fix(v4): stop emitting a multipleOf that JSON Schema rejects (#​6468) by @​colinhacks
• 43f729db feat(v4): make a tuple's items optional with .partial() (#​6465) by @​colinhacks
• 97edaf7d fix(v4): don't throw from safeParse on bigint multipleOf(0n) (#​6466) by @​colinhacks
• 21a6f0cb feat(v4): let z.nanoid() take a custom length (#​4004) by @​oimo23
• 9d5b20ef fix(v4): restrict the first ULID character to [0-7] (#​6095) by @​JSap0914
• 1cf9cd09 docs: record that error maps run per parse, and how to translate at render by @​colinhacks
• 7ce3e77d fix(v4): run a wrapper's inner schema on its own payload (#​6462) by @​colinhacks
• 7b612b53 fix(v4): fold an intersection of object schemas into one object (#​6461) by @​colinhacks
• 1c43b774 docs(v4): record why the failure path is not worth compiling by @​colinhacks
• badf0b78 fix(v4): build the catch context from the input that failed (#​6192) by @​zelinewang
• a87ac366 fix(v4)!: distinguish number and bigint formats at the type level (#​6052) by @​abhishek-chaudhary2003
• 6726c1dd docs: record what z.input and z.output do with transforms and wrappers by @​colinhacks
• 7cfc0122 fix(v4): keep a wrapper's stored value only on the side it belongs to by @​colinhacks
• a825c1b0 fix(v4): empty enums and literals match nothing (#​6459) by @​colinhacks
• 7c070db9 feat(v4): expose the function schema on .implement() results (#​6267) by @​deepshekhardas
• 3a496968 fix(v4): make record input keys optional when the value can fill them (#​6460) by @​colinhacks
• 53cec2a0 fix(v4): resolve z.input past a preprocess transform by @​colinhacks
• 2125d30c fix(v4): accept exact decimal multiples in multipleOf (#​6223) by @​spokodev
• 168122fc fix(v4): carry a pipe's own checks through z.output by @​colinhacks
• 51a1368a fix(v4): let the includes(position) pattern match at or after the offset (#​6024) by @​francisjohnjohnston-web
• 72a05c4f feat(v4): expose stringbool truthy/falsy/case via _zod.bag (#​6357) by @​hamed-bavar
• 036b39f4 fix(v4)!: require seconds once a datetime carries a Z or an offset (#​6457) by @​colinhacks
• 5825605e perf(v4): skip the eager stack capture when building a ZodError (#​6450) by @​colinhacks
• d85472c4 feat(v4): support declared symbol keys in z.object() (#​6448) by @​colinhacks
• d4108872 fix(v4): correct the date/time format keywords in both JSON Schema directions (#​6452) by @​colinhacks
• 555e5f46 Add z.toZod helper (#​5913) by @​colinhacks
• e0e51a55 docs(v4): cut the compile comments down to what they explain (#​6449) by @​colinhacks
• 6574e784 fix(v4): stop catch resurrecting issues an optional already resolved (#​6440) by @​colinhacks
• 937b5d01 perf(v4): prefix issue paths in place in the object JIT failure path (#​6445) by @​colinhacks
• b63db248 fix(v4): keep a memoized node's cached issues private to the cache (#​6443) by @​colinhacks
• 6ec3d043 fix(resolution): keep pnpm's own warnings out of the attw snapshot (#​6446) by @​colinhacks
• 830ba314 fix(v4): validate the address, and return the string that was validated (#​6442) by @​colinhacks
• f101d8ca Preserve callsites in parse stack traces (#​5910) by @​colinhacks
• 6c77d028 feat: compact simple anyOf unions to type array in toJSONSchema (#​6339) by @​deepshekhardas
• 28e1ebd8 fix(v4): measure string length in Unicode code points (#​6441) by @​colinhacks
• 060bc9f3 refactor: share default when-clauses for size/length checks (#​6394) by @​zirkelc
• 2848177d docs: point the flattened/formatted error deprecations at a symbol that exists by @​colinhacks
• 3c2dee9e Add properties checks for instanceof schemas (#​5912) by @​colinhacks
• 87ffeb0f fix(v4): an absent key on the middle rung supplies nothing (#​6434) by @​colinhacks
• 7785fc82 feat(v4): add z.getDiscriminatedOption (#​5947) by @​dokson
• 0135c85a feat(v4): allow passing extra args to apply() (#​6337) by @​deepshekhardas
• ca246d26 fix(v4): drop empty alternation branch from datetime pattern (#​6439) by @​colinhacks
• e073d55b docs: z.iso.datetime() accepts a subset of ISO 8601, not all of it by @​colinhacks
• d6ca12ae fix(v4): infer recursive getter options in discriminatedUnion (#​6422) by @​colinhacks
• dc51404b Add shorn to Zod Utilities (#​6398) by @​ChiChuRita
• 580111da docs: mark AOT compilation as canary-only by @​colinhacks
• 6b0dae79 docs: note that a catch callback is not islanded by @​colinhacks
• 898c4461 refactor(v4): give the runtime and compiled code one URL implementation by @​colinhacks
• 260e5d4b fix(v4): stop islanding a catch callback, which diverged silently by @​colinhacks
• 11c9268b revert(core): drop the exactOptional parse prototype from #​6432 (#​6438) by @​colinhacks
• a38ab4a8 fix(core): an omittable discriminator claims undefined (#​6432) by @​colinhacks
• c9ec89e0 perf(core): drop the seal and the per-key WeakSet from the lazy internals (#​6435) by @​colinhacks
• 3c9ca1d9 feat(json-schema): emit a root $ref when the root schema has an id (#​6029) by @​dinwwwh
• fa77a4d7 feat(v4): z.compile — ahead-of-time schema compilation (#​6085) by @​colinhacks
• f300476d fix(v4): let a schema's error map cover its own checks' issues (#​6426) by @​colinhacks
• 9f0a3d81 fix(core): restore defineLazy semantics lost in the internals move (#​6429) by @​colinhacks
• 604464c3 fix(locales): da/nn/no/sv called an IP address a range (#​6430) by @​colinhacks
• 7378e7cd fix(locales): backfill the mac and Sizable.map gaps, and pin dictionary parity (#​6427) by @​colinhacks
• b1077f05 perf(memory): install derived internals on a per-constructor prototype (#​6415) by @​colinhacks
• ccc15144 fix(locales): add the credit_card key to the seven locales missing it (#​6424) by @​colinhacks
• 73bacbbb fix(from-json-schema): drop redundant inclusive bound for draft-04 exclusive ranges (#​6022) by @​francisjohnjohnston-web
• 86b2e6da docs: list el and hr in the supported locales (#​6423) by @​colinhacks
• 45fdeda5 fix(v4): refine optin into a three-rung ladder, retire the fallback payload flag (#​6419) by @​colinhacks
• 5b34c0ce Improve Portuguese localization and add Brazilian Portuguese (pt-BR) (#​6076) by @​thristhart
• dc1a40a5 fix(locales): improve french translation (#​6120) by @​tsmartin9
• 0175a043 feat(locales): add Hindi and Kannada locale support (#​6315) by @​vedanshshetti
• 536ee3b0 Locales: added Slovak (sk) language (#​6041) by @​belicam
• 07b0c3d8 fix: preserve explicit superRefine issue input (#​6053) by @​frastefanini
• ba98071c feat: add .exactPartial() to ZodObject (#​6065) by @​andersk
• 234c407d feat(lang): Added Bengali locale (#​5974) by @​musaddiq-rafi
• 377cd9d7 feat(locales): add turkmen (tk) locale (#​6168) by @​tachmyratsaparmyradov
• 69b6bb08 feat(locales): add Norwegian Nynorsk (nn) locale (#​6092) by @​arvindfroi
• 33d82e6b Add Central Kurdish (ckb) locale (#​6078) by @​KUMachine
• 06666fe2 fix(fr): remove hyphen in "non-optionnel" (#​5999) by @​spidersouris
• 79cfedea feat(v4): expose the owning schema on check-originated issues (#​6420) by @​colinhacks
• 436b5da8 docs: propose compiled constructor graph by @​colinhacks
• eb4682c9 fix(json-schema): resolve tuple minItems past transform and catch in input mode (#​6418) by @​colinhacks
• 4d6b5cd3 fix(json-schema): route unrepresentable default values through unrepresentable by @​colinhacks
• 2abc9e05 docs: note that the JSON Schema emitter reads static optin (#​6417) by @​colinhacks
• 578e1cd0 feat(v4): support format: "hostname" in fromJSONSchema (#​6305) by @​catdalfonso
• 942bf8cb feat(v4): parse input containing reference cycles (#​6387) by @​colinhacks
• 78b523f0 fix(json-schema): keep preprocess object properties required in input mode (#​6133) by @​MerlijnW70
• 973b1b44 fix(v4): strip output-typed catch values from the input JSON Schema (#​6409) by @​colinhacks
• 5e608851 feat(v4): add z.deepPartial and runtime z.input / z.output (#​5928) by @​dokson
• 4e1720c8 fix(v4): align record keys and intersection strictness with TypeScript (#​6412) by @​colinhacks
• 4cc4053d fix: honor loose mode for closed record key schemas (#​6157) by @​pullfrog[bot]
• 69be843f fix(v4): stop the object JIT fastpass keeping a swallowed issue's value (#​6407) by @​colinhacks
• b899cd17 perf(json-schema): make toJSONSchema(registry) linear in registry size (#​6408) by @​colinhacks
• 6074828e fix(v4): make fromJSONSchema propertyNames compose with the other object keywords (#​6411) by @​colinhacks
• d7b209f3 docs: point the Web URLs callout at z.httpUrl() (#​6410) by @​colinhacks
• 611bd762 fix(mini): make merge() take an object schema, matching classic (#​6404) by @​colinhacks
• b53e53cc fix(v4): use exact flag in English locale too_small/too_big messages (#​6177) by @​pullfrog[bot]
• 421cc9a5 fix(json-schema): unescape JSON Pointer tokens when resolving $ref (#​6402) by @​colinhacks
• 4c27fe87 fix(v4): give z.xor() a distinct error when multiple options match (#​6376) by @​colinhacks
• a106fbe7 fix(v4): make fromJSONSchema tuples open-ended by default (#​6020) by @​mneetika
• e8034eba fix(v4): make prefixItems/draft-7 items respect minItems in fromJSONSchema (#​6201) by @​pullfrog[bot]
• 784e5c26 fix(v4): let bundlers tree-shake locales out of the default import (#​6384) by @​colinhacks
• 97edd70a fix(toJSONSchema): constrain closed tuple length (#​6194) by @​pullfrog[bot]
• f150020d fix(v4): escape non-string enum values in template literal patterns (#​5934) by @​gwagjiug
• faf33a28 fix: surface @​deprecated on re-exported compat aliases (#​6072) by @​MahinAnowar
• 3956224a docs: state that metadata wins over generated JSON Schema keywords (#​6401) by @​colinhacks
• a1904fc2 fix(v4): report date origin for numeric min/max bounds (#​6129) by @​MerlijnW70
• bd18314c fix: escape JSON Pointer reserved characters in toJSONSchema $ref (closes #​6027) (#​6144) by @​MaksZhukov
• 2a5164f5 fix(v4): enforce RFC 1035 length limits in regexes.domain (#​6035) by @​emmayusufu
• 0e5bc4b1 fix(v4): respect additionalProperties:false with patternProperties in fromJSONSchema (#​6199) by @​pullfrog[bot]
• c8f06d36 fix(v4): clarify infinite number errors (#​5906) by @​colinhacks

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@nuxtjs/robots@255

commit: 3659cba

[github-actions]

📦 Package Size

✅ No notable size changes

All tracked output (10)

Package output	Gzipped	Raw
@nuxtjs/robots · dependency @fingerprintjs/botd	13 kB	55 kB	✅
@nuxtjs/robots · dependency h3	34 kB	146 kB	✅
@nuxtjs/robots · dependency nuxt-site-config	10 kB	25 kB	✅
@nuxtjs/robots · dependency nuxtseo-shared	23 kB	76 kB	✅
@nuxtjs/robots · export .	5.3 kB	20 kB	✅
@nuxtjs/robots · export ./content	292 B	503 B	✅
@nuxtjs/robots · export ./util	6.6 kB	25 kB	✅
@nuxtjs/robots · published payload	36 kB	121 kB	✅
@nuxtjs/robots · app runtime	2.5 kB	6.2 kB	✅
@nuxtjs/robots · server runtime	8.6 kB	22 kB	✅

Runtime dependencies (10)

Package	Dependency	Requested	Resolved	Cost
@nuxtjs/robots	@fingerprintjs/botd	^2.0.0	2.0.0	📦 13 kB gzip
@nuxtjs/robots	@nuxt/kit	^4.5.2	4.5.2	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	consola	^3.4.2	3.4.2	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	defu	^6.1.7	6.1.7	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	h3	^1.15.11	1.15.11	📦 34 kB gzip
@nuxtjs/robots	nuxt-site-config	^4.2.3	4.2.3	📦 10 kB gzip
@nuxtjs/robots	nuxtseo-shared	^5.3.14	5.3.14	📦 23 kB gzip
@nuxtjs/robots	pathe	^2.0.3	2.0.3	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	pkg-types	^2.3.1	2.3.1	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	ufo	^1.6.4	1.6.4	♻️ free via Nuxt 4.5.2

_{Baseline: main_@_4697167___2026-08-21 · gzip is the comparison metric · changes below 16 B gzip are ignored}

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
zod (source)	>=3 → >=4.5.4

---

Release Notes

colinhacks/zod (zod)

v4.5.4

Compare Source

Commits:

• 84e416f fix(v4): stop the cycle walk from firing a default factory (#​6500)
• e8e206f 4.5.4

v4.5.3

Compare Source

v4.5.2

Compare Source

Commits:

• a354314 fix(docs): keep blog posts out of the docs collection (#​6484)
• d378c42 ci: drop canary publishing from the release workflow (#​6487)
• 212b941 fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#​6488)
• e7576f5 docs(blog): let the page show through the navbar in dark mode (#​6489)
• fedb06f fix(docs): match the blog TOC hover bar to the 2px active indicator
• 6c932fc chore: bump devcontainer image to Node 24 (#​6470)
• 6635d9d docs(blog): soften the "method memoization" attribution
• 019ae29 fix(docs): drop ISR on the docs route so the home page hydrates
• 652bb43 chore(docs): drop the scroll log from the route-change scroller
• 571c8e8 fix(docs): render blog tabs with the stock fumadocs tab card
• 9a193aa 4.5.2

v4.5.1

Compare Source

Commits:

• 2e862db ci: gate the GitHub release and JSR publish on the version being live on npm
• 8e03380 4.5.1

v4.5.0

Compare Source

Zod 4.5 is now available.

npm install zod@latest

At a glance:

• z.compile() — the flagship feature of Zod 4.5
• z.creditCard() — 12–19 digits plus Luhn checksum
• z.properties() — the multi-property counterpart to z.property()
• z.deepPartial()/.exactPartial()
• z.validate(): boolean — a fast-path to verify input validity without a full parse (up to 16x faster on invalid data)
• 9x reduction in memory footprint
• New locales: Bengali (bn), Central Kurdish (ckb), Hindi (hi), Kannada (kn), Norwegian Nynorsk (nn), Brazilian Portuguese (pt-BR), Slovak (sk), Turkmen (tk)

z.compile()

You can now pre-compile any Zod schema using z.compile(schema). This dramatically speeds up parsing performance.

import*aszfrom"zod";constPlayer=z.object({username: z.string(),bio: z.string(),xp: z.number()});constCompiledPlayer=z.compile(Player);

A compiled schema can be used exactly like an uncompiled one. There are no special rules around compiled schemas. They're just faster.

Player.parse({ ... });CompiledPlayer.parse({ ... });// ~2x faster

On objects, arrays, and unions, this speeds up parsing by a factor of ~3–7. More complex schemas stand to benefit more than simpler ones.

Time per parse by schema type, standard parser vs compiled — lower is better (benchmark)

Below are the Moltar benchmark results comparing Zod (compiled and uncompiled) against the Moltar ParseSafe bench.

Throughput on the moltar benchmark fixture (parseSafe: returns a new object with unknown keys stripped) — higher is better (benchmark)

And the equivalent results for the Moltar AssertLoose bench. Tested against the new z.validate(schema, input) function (detailed later in the post).

Throughput on the moltar benchmark fixture (assertLoose: returns a boolean, unknown keys allowed) — higher is better (benchmark)

Zod's entire test suite runs twice—once normally and again with auto-compilation enabled globally—to ensure perfect fidelity.

How it works

Under the hood, z.compile() walks the entire schema once and produces a hyperoptimized snippet of flat, loop-free JavaScript that can validate inputs far faster than a standard runtime validator. This snippet can be executed via new Function() (effectively a more powerful eval) to serve as a fast-path validator. Schemas use this to "fast check" validity, falling back to the regular runtime logic on validation failure to provide granular error information.

Take this simple Point schema:

constPoint=z.object({x: z.number(),y: z.number()});

Here is the generated snippet for it:

constisPoint=newFunction("input",` if (typeof input !== "object" || input === null) return false; if (typeof input.x !== "number") return false; if (typeof input.y !== "number") return false; return true;`);isPoint({x: 1,y: 2});// trueisPoint({x: "1"});// false

For the large majority of inputs, the generated function validates the data with the fastest logic JavaScript can express: straight-line typeof checks and property reads, with no interpreter in between. When it can't handle an input, Zod falls back to the standard parser.

This is the function Zod generates for the Player schema above:

if(typeofinput!=="object"||input===null||Array.isArray(input))returnINVALID;constv0=input["username"];if(typeofv0!=="string")returnINVALID;constv1=input["bio"];if(typeofv1!=="string")returnINVALID;constv2=input["xp"];if(typeofv2!=="number"||!Number.isFinite(v2))returnINVALID;constv3={"username": v0,"bio": v1,"xp": v2};returnv3;

Armed with the power of new Function(), this happens in-process at runtime. There is no need to integrate with your build system.

The compiled schema is purely additive on top of the existing schema. It tacks on the pre-compiled fast path for checking valid inputs. When invalid data is detected, it returns the INVALID symbol to signal that parsing should fall back to the uncompiled parser. This structurally prevents subtle deviations in error reporting between compiled and uncompiled variants.

import "zod/compile"

To compile every schema in an application, import zod/compile once at the top of your entry point. Every schema constructed after that import is automatically compiled the first time it's used to parse data.

import"zod/compile";// must come before modules that define schemasimport*aszfrom"zod";constschema=z.object({name: z.string()});schema.parse({name: "ok"});// compiled on first parse

It also works as a Node.js CLI flag, which guarantees it runs before any module defines a schema:

node --import zod/compile app.js

Or set preload in bunfig.toml or nub.jsonc.

{
"preload": ["zod/compile"]
}

All schemas benefit to varying degrees, though complex object/tuple/array schemas benefit more than simple scalar validators.

Read the docs, or the full technical writeup: Introducing z.compile()

z.creditCard()

A new string format: 12–19 digits, optionally separated by single spaces or hyphens, with a valid Luhn checksum. (#​5931)

z.creditCard().parse("4111 1111 1111 1111");// ✅z.creditCard().parse("4111 1111 1111 1112");// ❌ bad checksum

z.properties()

The multi-property counterpart to z.property(). (#​5912)

consthttpsUrl=z.instanceof(URL).check(
...z.properties({protocol: z.literal("https:"asstring),hostname: z.string().regex(z.regexes.domain),}));httpsUrl.parse(newURL("https://example.com"));// ✅httpsUrl.parse(newURL("http://localhost"));// ❌ protocol

z.deepPartial()

Back in functional form after being removed as a method in Zod 4. (#​5928)

constPost=z.object({title: z.string(),author: z.object({name: z.string(),email: z.string()}),});constPartialPost=z.deepPartial(Post);typePartialPost=z.output<typeofPartialPost>;// => { title?: string; author?: { name?: string; email?: string }}PartialPost.parse({author: {}});// ✅

The result is still a ZodObject, so .shape and .extend() keep working.

.exactPartial()

Like .partial(), but wraps each field in z.exactOptional() instead of z.optional(): keys may be omitted, but an explicit undefined is rejected. This matches TypeScript's Partial<> under exactOptionalPropertyTypes. (#​6065)

constRecipe=z.object({title: z.string(),servings: z.number()});constPartialRecipe=Recipe.exactPartial();PartialRecipe.parse({});// ✅PartialRecipe.parse({title: undefined});// ❌

In Zod Mini it's a top-level function: z.exactPartial(Recipe).

z.validate()

Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a ZodError, which makes rejection cheap: on invalid input it is up to 16x faster than .safeParse().success. The return type is a guard on the schema's input type, and z.validateAsync() covers schemas with async refinements. (#​6471)

z.validate(z.string(),"hi");// truez.validate(z.string(),42);// false

z.input() / z.output()

Project a schema onto its input or output side. Useful for validating the two halves of a codec independently. (#​5928)

constisoDate=z.codec(z.iso.datetime(),z.date(),{decode: (s)=>newDate(s),encode: (d)=>d.toISOString(),});constEvent=z.object({name: z.string(),at: isoDate});z.input(Event).parse({name: "launch",at: "2024-01-01T00:00:00Z"});// ✅z.output(Event).parse({name: "launch",at: newDate()});// ✅

This is a no-op on schemas not containing codecs/pipes.

z.toZod<T>()

A utility to define a Zod schema that agrees exactly with a static type, often one that is handwritten or externally defined. (#​5913)

typePlayer={username: string;xp: number};constPlayer=z.toZod<Player>()(z.object({username: z.string(),xp: z.number(),}));Player.shape.username;// ZodString — the schema is returned unchanged

z.getDiscriminatedOption()

Extract a discriminated union member by discriminator value. (#​5947)

constFruit=z.object({type: z.literal("fruit"),seeds: z.boolean()});constVeg=z.object({type: z.literal("vegetable"),leafy: z.boolean()});constProduce=z.discriminatedUnion("type",[Fruit,Veg]);z.getDiscriminatedOption(Produce,"fruit");// typeof Fruitz.getDiscriminatedOption(Produce,"meat");// ❌ TypeScript error

Cyclical inputs

Zod recursive schemas now support cyclical data. For bundle size reasons, Zod Mini requires you to register a memoizer explicitly. (#​6387, #​6482)

Zod

constCategory=z.object({name: z.string(),getsubcategories(){returnz.array(Category);},});constinput: any={name: "root",subcategories: []};input.subcategories.push(input);constresult=Category.parse(input);result.subcategories[0]===result;// true

Zod Mini

// register a memoizer before defining any schemasz.config({memoizer: z.memoizer()});constresult=Category.parse(input);result.subcategories[0]===result;// true

9x reduction in schema memory footprint

In Zod 4.4 a bare z.string() retained 7.5kb of heap. In Zod 4.5 it retains 784 bytes.

Retained heap per schema instance, Zod 4.4.3 vs 4.5 (benchmark)

In Zod 4.4 and earlier, all schema methods were automatically bound to the instance itself. This allowed users to pluck methods from schemas without causing issues due to this-binding.

const{ parse }=z.string();parse("some data");

A consequence of this is that each bound method allocates space on the heap; method implementations are not shared across all instances via prototype, as you'd expect. Zod 4.5 implements a method memoization pattern that avoids allocating bound methods until they are actually accessed.

Read the deep dive: Reducing Zod's memory footprint by an order of magnitude

Faster failures

Zod .parse()/.safeParse() instantiates a JavaScript Error, which captures a stack trace. In the case of validation failures, this is often much slower than the parsing logic itself. When using .safeParse(), Zod no longer captures this stack trace, speeding up failure-path parses by a factor of ~7.5x. (#​6316, #​6450)

constresult=Player.safeParse({username: 42,bio: "hello",xp: 12});result.success;// false — ~7.5x faster than Zod 4.4

Player schema (benchmark)

Symbol keys in z.object()

A shape can now declare a symbol key. TypeScript tracks it: a const symbol infers as unique symbol, so z.infer makes the key required and checks its value type. Undeclared symbol keys are still ignored. (#​6448)

constTAG=Symbol("tag");constschema=z.object({name: z.string(),[TAG]: z.number()});schema.parse({name: "alice",[TAG]: 42});// ✅ { name: "alice", [TAG]: 42 }schema.safeParse({name: "alice"});// ❌ the symbol key is required

Bug fixes

All of these fix soundness issues, so a schema that relied on the old behavior may now reject input it used to accept.

⚠️z.iso.datetime() requires seconds

RFC 3339 mandates seconds. z.iso.datetime() and z.iso.datetime({ offset: true }) no longer accept minute-precision input like 2020-01-01T06:15Z. local: true still admits 2020-01-01T06:15, since an unqualified datetime is outside RFC 3339 either way. (#​6457)

z.iso.datetime().parse("2020-01-01T06:15:00Z");// ✅z.iso.datetime().parse("2020-01-01T06:15Z");// ❌ was accepted in 4.4

To accept both forms, union the two precisions:

z.union([z.iso.datetime(),z.iso.datetime({precision: -1})]);

⚠️ String length counts code points

.min(), .max(), and .length() counted UTF-16 code units, so z.string().max(5) rejected five emoji. They now count Unicode code points, which is what every non-JS consumer of a length bound does (Postgres, MySQL, Go, Python, and the maxLength that z.toJSONSchema() emits). .max() only loosens; .min() and .length() tighten for astral input. Graphemes are unchanged — a ZWJ sequence is still several code points. (#​6441)

z.string().max(5).parse("😀😀😀😀😀");// was too_big, now passesz.string().min(5).parse("😀😀😀");// was fine, now too_small

Closes #​3355.

⚠️ Record keys and intersections match TypeScript

A record's key schema now governs only the keys that match it, the way TypeScript treats an index signature. Intersecting an object with a pattern-keyed record no longer rejects the object's own keys. (#​6412)

z.object({name: z.string()}).and(z.record(z.string().regex(/^S_/),z.string())).parse({name: "a",S_a: "s"});// 4.4: throws invalid_key on "name"// 4.5: { name: "a", S_a: "s" }

Separately, an unrecognized_keys issue no longer aborts the schema it came from, so a strict object with an extra key and a bad value now reports both issues instead of just the first. Closes #​2200, #​2573, #​4017, #​5663.

⚠️__proto__ is always stripped

Object and record parsers now drop a __proto__ key whether it comes from the input, is declared by the schema, or is produced by a record key transform. A key that a record's key schema normalizes to __proto__ is dropped too. .strict() reports an own __proto__ input key as unrecognized_keys instead of silently swallowing it. Error formatters and both JSON Schema converters use own-property writes so a toString or constructor path segment can't walk onto Object.prototype (#​6213, #​6367, #​6346). (#​6386, #​6354, #​6355, #​6221)

⚠️ Stricter string formats

• z.ipv6() validated by handing the string to new URL(), which let ::@1\ and ::1\n through. It now checks the address alphabet directly (#​6442).
• z.ulid() restricts the first character to 0–7; anything higher overflows the 48-bit timestamp. A fixture that doesn't start with a real timestamp, such as one with a leading letter, is now rejected (#​6095).
• z.httpUrl() enforces the RFC 1035 length limits on the host, matching z.hostname() (#​6035).
• z.emoji() no longer backtracks exponentially on a failed match (#​6347).
• z.string().includes(sub, { position: N }) emits a JSON Schema pattern that allows at least N leading characters, matching String.prototype.includes (#​6024).

Commits

Zod 4.5 rolls up 155 commits. Thanks to everyone who contributed: @​dokson, @​deepshekhardas, @​zirkelc, @​francisjohnjohnston-web, @​MerlijnW70, @​codinsonn, @​oimo23, @​JSap0914, @​zelinewang, @​abhishek-chaudhary2003, @​spokodev, @​Mohammad-Faiz-Cloud-Engineer, @​hamed-bavar, @​MGPOCKY, @​ChiChuRita, @​dinwwwh, @​thristhart, @​tsmartin9, @​vedanshshetti, @​belicam, @​frastefanini, @​andersk, @​musaddiq-rafi, @​tachmyratsaparmyradov, @​arvindfroi, @​KUMachine, @​spidersouris, @​catdalfonso, @​mneetika, @​gwagjiug, @​MahinAnowar, @​MaksZhukov, @​emmayusufu, @​agcty, @​devareddy05, @​Vish05, @​yamcodes, @​mattiasahlsen, @​samchungy, @​ozzyfromspace, @​udohjeremiah, @​patrickwehbe, @​gajus, @​Harm-Nullix, @​thwbh, @​IdanGonen, @​irfanfandi, @​JuerGenie, @​marcalexiei, @​itsahmedbilal, @​DucMinhNe, @​meliharik.

• 9782f87c perf(v4): validate without building the output, and keep schemas out of dictionary mode (#​6480) by @​colinhacks
• 773a4867 refactor(v4): declare a trait's members on $constructor (#​6478) by @​colinhacks
• 68fb3f13 feat(v4): make z.compile() fall back instead of throwing (#​6479) by @​colinhacks
• 37b01501 feat(v4): add z.isValid and z.isValidAsync (#​6471) by @​colinhacks
• 749f5452 docs: add fullproduct.dev to v4 ecosystem page (#​6001) by @​codinsonn
• 24cdb7fd perf(v4): close the fastpass bindings into the compiled parser (#​6464) by @​colinhacks
• 8d896186 fix(v4): stop emitting a multipleOf that JSON Schema rejects (#​6468) by @​colinhacks
• 43f729db feat(v4): make a tuple's items optional with .partial() (#​6465) by @​colinhacks
• 97edaf7d fix(v4): don't throw from safeParse on bigint multipleOf(0n) (#​6466) by @​colinhacks
• 21a6f0cb feat(v4): let z.nanoid() take a custom length (#​4004) by @​oimo23
• 9d5b20ef fix(v4): restrict the first ULID character to [0-7] (#​6095) by @​JSap0914
• 1cf9cd09 docs: record that error maps run per parse, and how to translate at render by @​colinhacks
• 7ce3e77d fix(v4): run a wrapper's inner schema on its own payload (#​6462) by @​colinhacks
• 7b612b53 fix(v4): fold an intersection of object schemas into one object (#​6461) by @​colinhacks
• 1c43b774 docs(v4): record why the failure path is not worth compiling by @​colinhacks
• badf0b78 fix(v4): build the catch context from the input that failed (#​6192) by @​zelinewang
• a87ac366 fix(v4)!: distinguish number and bigint formats at the type level (#​6052) by @​abhishek-chaudhary2003
• 6726c1dd docs: record what z.input and z.output do with transforms and wrappers by @​colinhacks
• 7cfc0122 fix(v4): keep a wrapper's stored value only on the side it belongs to by @​colinhacks
• a825c1b0 fix(v4): empty enums and literals match nothing (#​6459) by @​colinhacks
• 7c070db9 feat(v4): expose the function schema on .implement() results (#​6267) by @​deepshekhardas
• 3a496968 fix(v4): make record input keys optional when the value can fill them (#​6460) by @​colinhacks
• 53cec2a0 fix(v4): resolve z.input past a preprocess transform by @​colinhacks
• 2125d30c fix(v4): accept exact decimal multiples in multipleOf (#​6223) by @​spokodev
• 168122fc fix(v4): carry a pipe's own checks through z.output by @​colinhacks
• 51a1368a fix(v4): let the includes(position) pattern match at or after the offset (#​6024) by @​francisjohnjohnston-web
• 72a05c4f feat(v4): expose stringbool truthy/falsy/case via _zod.bag (#​6357) by @​hamed-bavar
• 036b39f4 fix(v4)!: require seconds once a datetime carries a Z or an offset (#​6457) by @​colinhacks
• 5825605e perf(v4): skip the eager stack capture when building a ZodError (#​6450) by @​colinhacks
• d85472c4 feat(v4): support declared symbol keys in z.object() (#​6448) by @​colinhacks
• d4108872 fix(v4): correct the date/time format keywords in both JSON Schema directions (#​6452) by @​colinhacks
• 555e5f46 Add z.toZod helper (#​5913) by @​colinhacks
• e0e51a55 docs(v4): cut the compile comments down to what they explain (#​6449) by @​colinhacks
• 6574e784 fix(v4): stop catch resurrecting issues an optional already resolved (#​6440) by @​colinhacks
• 937b5d01 perf(v4): prefix issue paths in place in the object JIT failure path (#​6445) by @​colinhacks
• b63db248 fix(v4): keep a memoized node's cached issues private to the cache (#​6443) by @​colinhacks
• 6ec3d043 fix(resolution): keep pnpm's own warnings out of the attw snapshot (#​6446) by @​colinhacks
• 830ba314 fix(v4): validate the address, and return the string that was validated (#​6442) by @​colinhacks
• f101d8ca Preserve callsites in parse stack traces (#​5910) by @​colinhacks
• 6c77d028 feat: compact simple anyOf unions to type array in toJSONSchema (#​6339) by @​deepshekhardas
• 28e1ebd8 fix(v4): measure string length in Unicode code points (#​6441) by @​colinhacks
• 060bc9f3 refactor: share default when-clauses for size/length checks (#​6394) by @​zirkelc
• 2848177d docs: point the flattened/formatted error deprecations at a symbol that exists by @​colinhacks
• 3c2dee9e Add properties checks for instanceof schemas (#​5912) by @​colinhacks
• 87ffeb0f fix(v4): an absent key on the middle rung supplies nothing (#​6434) by @​colinhacks
• 7785fc82 feat(v4): add z.getDiscriminatedOption (#​5947) by @​dokson
• 0135c85a feat(v4): allow passing extra args to apply() (#​6337) by @​deepshekhardas
• ca246d26 fix(v4): drop empty alternation branch from datetime pattern (#​6439) by @​colinhacks
• e073d55b docs: z.iso.datetime() accepts a subset of ISO 8601, not all of it by @​colinhacks
• d6ca12ae fix(v4): infer recursive getter options in discriminatedUnion (#​6422) by @​colinhacks
• dc51404b Add shorn to Zod Utilities (#​6398) by @​ChiChuRita
• 580111da docs: mark AOT compilation as canary-only by @​colinhacks
• 6b0dae79 docs: note that a catch callback is not islanded by @​colinhacks
• 898c4461 refactor(v4): give the runtime and compiled code one URL implementation by @​colinhacks
• 260e5d4b fix(v4): stop islanding a catch callback, which diverged silently by @​colinhacks
• 11c9268b revert(core): drop the exactOptional parse prototype from #​6432 (#​6438) by @​colinhacks
• a38ab4a8 fix(core): an omittable discriminator claims undefined (#​6432) by @​colinhacks
• c9ec89e0 perf(core): drop the seal and the per-key WeakSet from the lazy internals (#​6435) by @​colinhacks
• 3c9ca1d9 feat(json-schema): emit a root $ref when the root schema has an id (#​6029) by @​dinwwwh
• fa77a4d7 feat(v4): z.compile — ahead-of-time schema compilation (#​6085) by @​colinhacks
• f300476d fix(v4): let a schema's error map cover its own checks' issues (#​6426) by @​colinhacks
• 9f0a3d81 fix(core): restore defineLazy semantics lost in the internals move (#​6429) by @​colinhacks
• 604464c3 fix(locales): da/nn/no/sv called an IP address a range (#​6430) by @​colinhacks
• 7378e7cd fix(locales): backfill the mac and Sizable.map gaps, and pin dictionary parity (#​6427) by @​colinhacks
• b1077f05 perf(memory): install derived internals on a per-constructor prototype (#​6415) by @​colinhacks
• ccc15144 fix(locales): add the credit_card key to the seven locales missing it (#​6424) by @​colinhacks
• 73bacbbb fix(from-json-schema): drop redundant inclusive bound for draft-04 exclusive ranges (#​6022) by @​francisjohnjohnston-web
• 86b2e6da docs: list el and hr in the supported locales (#​6423) by @​colinhacks
• 45fdeda5 fix(v4): refine optin into a three-rung ladder, retire the fallback payload flag (#​6419) by @​colinhacks
• 5b34c0ce Improve Portuguese localization and add Brazilian Portuguese (pt-BR) (#​6076) by @​thristhart
• dc1a40a5 fix(locales): improve french translation (#​6120) by @​tsmartin9
• 0175a043 feat(locales): add Hindi and Kannada locale support (#​6315) by @​vedanshshetti
• 536ee3b0 Locales: added Slovak (sk) language (#​6041) by @​belicam
• 07b0c3d8 fix: preserve explicit superRefine issue input (#​6053) by @​frastefanini
• ba98071c feat: add .exactPartial() to ZodObject (#​6065) by @​andersk
• 234c407d feat(lang): Added Bengali locale (#​5974) by @​musaddiq-rafi
• 377cd9d7 feat(locales): add turkmen (tk) locale (#​6168) by @​tachmyratsaparmyradov
• 69b6bb08 feat(locales): add Norwegian Nynorsk (nn) locale (#​6092) by @​arvindfroi
• 33d82e6b Add Central Kurdish (ckb) locale (#​6078) by @​KUMachine
• 06666fe2 fix(fr): remove hyphen in "non-optionnel" (#​5999) by @​spidersouris
• 79cfedea feat(v4): expose the owning schema on check-originated issues (#​6420) by @​colinhacks
• 436b5da8 docs: propose compiled constructor graph by @​colinhacks
• eb4682c9 fix(json-schema): resolve tuple minItems past transform and catch in input mode (#​6418) by @​colinhacks
• 4d6b5cd3 fix(json-schema): route unrepresentable default values through unrepresentable by @​colinhacks
• 2abc9e05 docs: note that the JSON Schema emitter reads static optin (#​6417) by @​colinhacks
• 578e1cd0 feat(v4): support format: "hostname" in fromJSONSchema (#​6305) by @​catdalfonso
• 942bf8cb feat(v4): parse input containing reference cycles (#​6387) by @​colinhacks
• 78b523f0 fix(json-schema): keep preprocess object properties required in input mode (#​6133) by @​MerlijnW70
• 973b1b44 fix(v4): strip output-typed catch values from the input JSON Schema (#​6409) by @​colinhacks
• 5e608851 feat(v4): add z.deepPartial and runtime z.input / z.output (#​5928) by @​dokson
• 4e1720c8 fix(v4): align record keys and intersection strictness with TypeScript (#​6412) by @​colinhacks
• 4cc4053d fix: honor loose mode for closed record key schemas (#​6157) by @​pullfrog[bot]
• 69be843f fix(v4): stop the object JIT fastpass keeping a swallowed issue's value (#​6407) by @​colinhacks
• b899cd17 perf(json-schema): make toJSONSchema(registry) linear in registry size (#​6408) by @​colinhacks
• 6074828e fix(v4): make fromJSONSchema propertyNames compose with the other object keywords (#​6411) by @​colinhacks
• d7b209f3 docs: point the Web URLs callout at z.httpUrl() (#​6410) by @​colinhacks
• 611bd762 fix(mini): make merge() take an object schema, matching classic (#​6404) by @​colinhacks
• b53e53cc fix(v4): use exact flag in English locale too_small/too_big messages (#​6177) by @​pullfrog[bot]
• 421cc9a5 fix(json-schema): unescape JSON Pointer tokens when resolving $ref (#​6402) by @​colinhacks
• 4c27fe87 fix(v4): give z.xor() a distinct error when multiple options match (#​6376) by @​colinhacks
• a106fbe7 fix(v4): make fromJSONSchema tuples open-ended by default (#​6020) by @​mneetika
• e8034eba fix(v4): make prefixItems/draft-7 items respect minItems in fromJSONSchema (#​6201) by @​pullfrog[bot]
• 784e5c26 fix(v4): let bundlers tree-shake locales out of the default import (#​6384) by @​colinhacks
• 97edd70a fix(toJSONSchema): constrain closed tuple length (#​6194) by @​pullfrog[bot]
• f150020d fix(v4): escape non-string enum values in template literal patterns (#​5934) by @​gwagjiug
• faf33a28 fix: surface @​deprecated on re-exported compat aliases (#​6072) by @​MahinAnowar
• 3956224a docs: state that metadata wins over generated JSON Schema keywords (#​6401) by @​colinhacks
• a1904fc2 fix(v4): report date origin for numeric min/max bounds (#​6129) by @​MerlijnW70
• bd18314c fix: escape JSON Pointer reserved characters in toJSONSchema $ref (closes #​6027) (#​6144) by @​MaksZhukov
• 2a5164f5 fix(v4): enforce RFC 1035 length limits in regexes.domain (#​6035) by @​emmayusufu
• 0e5bc4b1 fix(v4): respect additionalProperties:false with patternProperties in fromJSONSchema (#​6199) by @​pullfrog[bot]
• c8f06d36 fix(v4): clarify infinite number errors (#​5906) by @​colinhacks

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@nuxtjs/robots@255

commit: 3659cba

[github-actions]

📦 Package Size

✅ No notable size changes

All tracked output (10)

Package output	Gzipped	Raw
@nuxtjs/robots · dependency @fingerprintjs/botd	13 kB	55 kB	✅
@nuxtjs/robots · dependency h3	34 kB	146 kB	✅
@nuxtjs/robots · dependency nuxt-site-config	10 kB	25 kB	✅
@nuxtjs/robots · dependency nuxtseo-shared	23 kB	76 kB	✅
@nuxtjs/robots · export .	5.3 kB	20 kB	✅
@nuxtjs/robots · export ./content	292 B	503 B	✅
@nuxtjs/robots · export ./util	6.6 kB	25 kB	✅
@nuxtjs/robots · published payload	36 kB	121 kB	✅
@nuxtjs/robots · app runtime	2.5 kB	6.2 kB	✅
@nuxtjs/robots · server runtime	8.6 kB	22 kB	✅

Runtime dependencies (10)

Package	Dependency	Requested	Resolved	Cost
@nuxtjs/robots	@fingerprintjs/botd	^2.0.0	2.0.0	📦 13 kB gzip
@nuxtjs/robots	@nuxt/kit	^4.5.2	4.5.2	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	consola	^3.4.2	3.4.2	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	defu	^6.1.7	6.1.7	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	h3	^1.15.11	1.15.11	📦 34 kB gzip
@nuxtjs/robots	nuxt-site-config	^4.2.3	4.2.3	📦 10 kB gzip
@nuxtjs/robots	nuxtseo-shared	^5.3.14	5.3.14	📦 23 kB gzip
@nuxtjs/robots	pathe	^2.0.3	2.0.3	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	pkg-types	^2.3.1	2.3.1	♻️ free via Nuxt 4.5.2
@nuxtjs/robots	ufo	^1.6.4	1.6.4	♻️ free via Nuxt 4.5.2

_{Baseline: main_@_4697167___2026-08-21 · gzip is the comparison metric · changes below 16 B gzip are ignored}