Additional changes to review3 matched termsMatched wording:removeddeprecatedno longerThese matches may be harmless in context. Expand to see the excerpts.
The changelog contains “removed”; check what was removed.
Fixed in #5759. JSON Schema conversion through z.toJSONSchema() now strips redundant id fields from $defs entries. This is required for correctness in older JSON Schema dialects from before was introduced: in those dialects, changes the resolution scope, so leaving it inside an extracted definition can make references resolve incorrectly. The removed value was redundant because the schema had already been extracted into , so the definition key itself is the identifier. This may affect consumers that were reading those internal fields directly.
4.4.0
This is a minor release with a wide set of correctness and soundness fixes. Some fixes intentionally make Zod stricter, so code that depended on previously accepted invalid or ambiguous inputs may need small updates.
Potentially breaking bug fixes
Tuple defaults now materialize output values correctly
Fixed in #5661. Tuple parsing now more accurately reflects defaults, optional tails, explicit undefined, and under-filled inputs. The headline behavior is that defaults in tuple positions now properly appear in parsed output.
Commit d3c0ec87 docs: add note about removed .errors alias in v4 changelog (#5705) by @togami2864
The changelog mentions deprecation; it may still be compatible.
CUID validation through z.cuid() has been tightened, and CUID v1 is now deprecated. Fixed in #5880.
Commit 55747b3c Remove deprecated downlevelIteration option (#5684) by @RyanCavanaugh
The changelog contains the phrase “no longer”; its impact needs context.
JSON Schema $defs entries no longer include redundant id
Tuple length errors are also more consistent now. Since z.function() arguments are tuple-shaped, function input errors may look different.
Required object properties with z.undefined()
Fixed in #5661, with follow-up coverage in 57d80a82. A property whose schema is z.undefined() is now treated as required. The key must be present, but its value may be undefined.
This also affects related .catch(), .partial(), .default(), and .prefault() combinations that previously relied on missing z.undefined() keys being treated as optional.
Safer .merge() behavior with refinements
Fixed in #5856. The .merge() method now throws when the receiver has refinements, rather than silently producing ambiguous refinement behavior. Refinements from the second schema are preserved.
Prefer .extend() or .safeExtend() for object composition. The .merge() method is still supported for compatibility, but it is discouraged for new code because its semantics around overlapping keys and refinements are easier to misread.
JSON Schema $defs entries no longer include redundant id
Fixed in #5759. JSON Schema conversion through z.toJSONSchema() now strips redundant id fields from $defs entries. This is required for correctness in older JSON Schema dialects from before $id was introduced: in those dialects, id changes the resolution scope, so leaving it inside an extracted definition can make references resolve incorrectly. The removed value was redundant because the schema had already been extracted into $defs, so the definition key itself is the identifier. This may affect consumers that were reading those internal id fields directly.
CUID validation through z.cuid() has been tightened, and CUID v1 is now deprecated. Fixed in #5880.
HTTP URL validation through z.httpUrl() now rejects malformed HTTP(S) URLs with a missing slash after the protocol. The underlying URL constructor normalizes inputs like https:/example.com, but Zod now rejects them instead of accepting the repaired URL. Fixed in #5672, related to #5284.
Nested union paths are now preserved correctly in the output of z.treeifyError() and z.formatError(). Fixed in #5708 and 60ff3987.
Invalid discriminated union errors now include discriminator options and improved messages. Fixed in #5723. This may affect users snapshotting ZodError output.
Other fixes
Record key transforms now run
Fixed in #5891. Record schemas now run transforms on record keys.
Key refinement failures now surface as structured invalid_key issues. Fixed in #5719.
Non-enumerable properties are skipped more consistently. Fixed in #5719.
The v3-style single-argument z.record(valueType) form works again. Fixed in 0e960108.
Metadata and input handling in fromJSONSchema()
Schema generation from JSON Schema now applies metadata more consistently across enum, const, not, anyOf, and multi-type schemas. Fixed in #5758. It also rejects or normalizes more non-JSON-like inputs, including cyclic objects and BigInt. Fixed in 87cf0f93.
Codecs
Codec changes:
Encoding through z.discriminatedUnion().encode() now works when the discriminator uses a codec. Fixed in #5769.
Transform callbacks now support ctx.addIssue(). Fixed in #5699.
Conditional .superRefine() with when
The when option was added for .superRefine(). Added in #5741, with related abort behavior fixed in #5681.
Defaults for Map and Set
Defaults for Map and Set are now cloned instead of shared across parses. Fixed in #5855.
const schema = z.map(z.string(), z.number()).default(new Map());
const a = schema.parse(undefined);
const b = schema.parse(undefined);
a === b;
// false
Empty unions
Empty z.union([]), z.xor([]), and discriminated unions no longer crash at construction time. They construct and fail at parse time. Fixed in #5869.
Floating-point multiples
Number multipleOf() / step() validation is more accurate for decimal and exponent edge cases. Fixed in #5687 and #5793.
Global config and jitless
Configuration fixes:
Global configuration is now shared through globalThis, improving behavior across mixed CJS/ESM module instances. Fixed in #5889.
Jitless mode now avoids eval probing when set before first access. Fixed in #5864.
Prototype pollution hardening
Object catchall paths now skip __proto__ keys. Fixed in #5898.
Performance improvements
Reduced memory usage from lazy-bound methods
Fixed in #5897. Classic builder methods are now lazy-bound through a shared internal prototype instead of eagerly attached per schema instance. This significantly reduces per-schema method allocation overhead, especially in codebases that construct many schemas. Detached methods continue to work:
const schema = z.string();
const optional = schema.optional;
optional.call(schema);
// still works
Improved tree-shaking
Implemented in 195e8696 and #5689. Top-level factory calls are annotated as pure, and generated stub package manifests now include sideEffects: false. This gives bundlers more room to remove unused Zod code.
This is intended as the conclusive fix for a long-standing class of tree-shaking and bundle-size issues, especially in Next.js and Turbopack projects. The most visible symptom was that unused validators and locales could survive bundling even when importing from zod/mini or from a narrow subpath.