valibot
1.5.0 · 9 Sep 2026MIT32M / weekRepositoryHomepagenpmAtom feed
Upgrading valibot from 1.3.0 to 1.4.2
4 releases in betweenevery note read
- 0
- changes to make
- 1
- advisory fixed
- 2
- new
- 6
- fixes
Security
Fixes 1 advisory affecting 1.3.0
- Valibot: record() issue paths can make flatten() throw for inherited Object property namesmoderate · GHSA-5qjj-4xww-7phc
Release by release
- fixed
Fix word count actions to cache the
Intl.Segmenterfor non-primitive locales, preventing it from being recreated on everywords,minWords,maxWordsandnotWordsvalidation (pull request #1521) - fixed
Fix
flattenmethod to handle issue path keys that collide withObject.prototypemembers liketoStringinstead of throwing aTypeError(pull request #1522)
- fixed
- fixed
Fix
intersectschema to infer correct input and output types for non-tuple array options instead ofnever(pull request #1478)
- fixed
- new
Add
isoDateTimeSecondvalidation action to validate ISO date times with seconds (pull request #1418) - new
Add
toCamelCase,toKebabCase,toPascalCaseandtoSnakeCasetransformation actions to convert strings between common naming conventions (pull request #1457) - fixed
Change hot paths to reduce object allocations and improve runtime performance (pull request #1437)
- fixed
Fix
creditCardvalidation action to reject Mastercard numbers with invalid lengths (pull request #1462) - fixed
Fix
intersectschema to no longer mutate input values, allowing frozen objects and arrays to be merged (pull request #1463)
- new
1.3.1nothing new or fixed in the note
5 other lines we could not sort, mostly version bumps
- 1.4.0
Change internal
ReadonlyOutputKeysandOutputWithReadonlytypes ofobjectschemas andWithReadonlytype ofrecordschemas to improve TypeScript type performance (pull request #1442) - 1.4.0
Change build target to ES2020 so distributed output stays compatible with environments that lack support for newer syntax (pull request #1455)
- 1.4.0
Change internal
_isValidObjectKeyto useObject.prototype.hasOwnProperty.callinstead ofObject.hasOwnso the distributed output stays compatible with runtimes that lack the ES2022Object.hasOwnbuiltin (pull request #1421) - 1.4.0
Change
flattenmethod to accept readonly issue arrays (pull request #1269) - 1.3.1
Change
MAC48_REGEX,MAC64_REGEXandMAC_REGEXto drop theiflag for better JSON Schema compatibility (pull request #1430)