v2.30.0

Security

• Devalue dependency version updated to prevent CVE-2026-22774 and two other minor vulnerabilities.

Added

• Added adapter to support Standard Schema, now any validation library implementing that interface can be used with Superforms! Big thanks to sillvva for this contribution! Note however that the defaults option is required when using this adapter, as for default values to be inferred automatically, a more specialized adapter for the validation library (handling JSON Schema) needs to be used.

Fixed

• Improved error message for "No shape could be created for schema" to suggest using zod4 adapter when applicable. #594
• Added runtime detection warning when Zod v4 schema is passed to Zod v3 adapter, helping users identify adapter version mismatch. #594
• Valibot adapter now handles transformation actions (trim, transform, etc.) properly by using typeMode: 'input' and errorMode: 'ignore' as defaults. This prevents errors when schemas contain transformations. Users can override these settings by passing typeMode and errorMode options to the adapter. #668

v2.29.1

Fixed

• Fixed TypeScript type inference for discriminated unions in ValidationErrors. #653
• Fixed FormData parsing for discriminated unions, so they work properly without requiring dataType: 'json'. #655
• reset() function didn't preserve tainted state for fields that are not being reset when using partial data. #656
• Fixed FormData parsing incorrectly coercing empty strings to literal values (e.g., z.literal("bar")). Empty strings now properly fail validation instead of being replaced with the literal value. #664
• Fixed ReferenceError when using customValidity with validateForm({ update: true }). #669

Changed

• Replaced deprecated @finom/zod-to-json-schema with zod-v3-to-json-schema. #660
• Migrated Valibot adapter to use the official @valibot/to-json-schema package. #668

v2.28.1

Fixed

• Zod 4 adapter: Allow top-level .transform() and .refine() in schemas. #646.
• Zod 4 adapter now respects global customError configuration when no explicit error map is provided. The adapter prioritizes customError over localeError. #618.
• Zod 4 adapter: Fixed Default Date values in nested objects. #650.

v2.28.0

Changed

• TypeBox adapter has been bumped to 1.0! Check the migration guide to upgrade. Note that if you must stay on 0.x for a while, you cannot upgrade to this version of Superforms.

Added

• Added support for Zod 4 stringbools. #610
• booleanProxy now supports the empty option.

Fixed

• Fixed loading timers when the timeoutMS setting is triggered and a redirect response is returned. #622
• filesStore initialValue now matches fileStore. #637
• Fixed JSON Schema for some non-representable types in Zod 4 adapter, it now handles set and map properly. #617
• Possibly fixed the SuperDebug broken import on Svelte 5 in enforced runes mode #599
• Zod 4 error messages should now take the current locale into account as default. #618, #639
• Zod 3 fix for URL parsing - A default boolean value of true returned false when parsing a URL with superValidate. #633

v2.27.4

Security

• Fixed prototype pollution when using dataType: 'json'.

v2.27.2

Security

• Devalue version bumped to avoid prototype pollution.

Fixed

• Zod 4 tests working.
• Zod 4 adapter didn't use the correct JSON Schema format for dates.
• Nested data traversal for correcting invalid types didn't stop at a valid value, replacing paths with default data further down the tree.

v2.27.1

Fixed

• Fixed client validation issue with rapid multiple blur events.
• Arktype adapter improved.
• Union schemas now works with default values, replacing invalid properties even if nested.
• When using the { taint: 'untaint-form' } option, form wasn't untainted unless it was modified.

v2.27.0

Added

• The Arktype adapter is finally a "full" adapter, meaning it's retrospectable and doesn't require default values anymore!

Fixed

• SuperDebug rune version is back, can now be imported as import SuperDebug from 'sveltekit-superforms/SuperDebug.svelte';
• Fixed bigint handling for Zod 4 and Valibot.

v2.26.1

Removed

• The SuperDebug rune version broke Svelte 4 compatibility, so it has been removed until a solution can be figured out, hopefully very soon.

Fixed

• Zod 4 adapter now handles top-level discriminated unions.

v2.26.0

Added

• Zod 4 adapter added! Adapter names are zod4 and zod4Client, works with both the full version and Zod Mini. As Zod is now using its own JSON Schema representation, and there are some breaking changes like how enums are handled, check migrations carefully and please report any bugs.
• taintedMessage now passes BeforeNavigate to its callback function.
• SuperDebug now has a Runes version, see the docs for how to import it.
• Added config options to valibotClient, same as in the valibot adapter.

Changed

• Bumped Zod peerDep requirement to 3.25.0 due to the Zod 4 release.
• Bumped Valibot peerDep requirement to 1.0.0, congratulations on the stable release!