v2.28.1

Fixed

• Zod 4 adapter: Allow top-level .transform() and .refine() in schemas. #646.
• Zod 4 adapter now respects global customError configuration when no explicit error map is provided. The adapter prioritizes customError over localeError. #618.
• Zod 4 adapter: Fixed Default Date values in nested objects. #650.

v2.28.0

Changed

• TypeBox adapter has been bumped to 1.0! Check the migration guide to upgrade. Note that if you must stay on 0.x for a while, you cannot upgrade to this version of Superforms.

Added

• Added support for Zod 4 stringbools. #610
• booleanProxy now supports the empty option.

Fixed

• Fixed loading timers when the timeoutMS setting is triggered and a redirect response is returned. #622
• filesStore initialValue now matches fileStore. #637
• Fixed JSON Schema for some non-representable types in Zod 4 adapter, it now handles set and map properly. #617
• Possibly fixed the SuperDebug broken import on Svelte 5 in enforced runes mode #599
• Zod 4 error messages should now take the current locale into account as default. #618, #639
• Zod 3 fix for URL parsing - A default boolean value of true returned false when parsing a URL with superValidate. #633

v2.27.4

Security

• Fixed prototype pollution when using dataType: 'json'.

v2.27.2

Security

• Devalue version bumped to avoid prototype pollution.

Fixed

• Zod 4 tests working.
• Zod 4 adapter didn't use the correct JSON Schema format for dates.
• Nested data traversal for correcting invalid types didn't stop at a valid value, replacing paths with default data further down the tree.

v2.27.1

Fixed

• Fixed client validation issue with rapid multiple blur events.
• Arktype adapter improved.
• Union schemas now works with default values, replacing invalid properties even if nested.
• When using the { taint: 'untaint-form' } option, form wasn't untainted unless it was modified.

v2.27.0

Added

• The Arktype adapter is finally a "full" adapter, meaning it's retrospectable and doesn't require default values anymore!

Fixed

• SuperDebug rune version is back, can now be imported as import SuperDebug from 'sveltekit-superforms/SuperDebug.svelte';
• Fixed bigint handling for Zod 4 and Valibot.

v2.26.1

Removed

• The SuperDebug rune version broke Svelte 4 compatibility, so it has been removed until a solution can be figured out, hopefully very soon.

Fixed

• Zod 4 adapter now handles top-level discriminated unions.

v2.26.0

Added

• Zod 4 adapter added! Adapter names are zod4 and zod4Client, works with both the full version and Zod Mini. As Zod is now using its own JSON Schema representation, and there are some breaking changes like how enums are handled, check migrations carefully and please report any bugs.
• taintedMessage now passes BeforeNavigate to its callback function.
• SuperDebug now has a Runes version, see the docs for how to import it.
• Added config options to valibotClient, same as in the valibot adapter.

Changed

• Bumped Zod peerDep requirement to 3.25.0 due to the Zod 4 release.
• Bumped Valibot peerDep requirement to 1.0.0, congratulations on the stable release!

v2.25.0

Added

• Added applyAction: 'never' option, to prevent load function invalidation from overwriting the form state.
• Added invalidateAll: 'pessimistic' option as an alternative to the 'force' option (recommended to use instead for clarity).

v2.24.1

Fixed

• Fixed error mapping for deeply nested errors where no default value existed.