v2.27.4

Security

• Fixed prototype pollution when using dataType: 'json'.

v2.27.2

Security

• Devalue version bumped to avoid prototype pollution.

Fixed

• Zod 4 tests working.
• Zod 4 adapter didn't use the correct JSON Schema format for dates.
• Nested data traversal for correcting invalid types didn't stop at a valid value, replacing paths with default data further down the tree.

v2.27.1

Fixed

• Fixed client validation issue with rapid multiple blur events.
• Arktype adapter improved.
• Union schemas now works with default values, replacing invalid properties even if nested.
• When using the { taint: 'untaint-form' } option, form wasn't untainted unless it was modified.

v2.27.0

Added

• The Arktype adapter is finally a "full" adapter, meaning it's retrospectable and doesn't require default values anymore!

Fixed

• SuperDebug rune version is back, can now be imported as import SuperDebug from 'sveltekit-superforms/SuperDebug.svelte';
• Fixed bigint handling for Zod 4 and Valibot.

v2.26.1

Removed

• The SuperDebug rune version broke Svelte 4 compatibility, so it has been removed until a solution can be figured out, hopefully very soon.

Fixed

• Zod 4 adapter now handles top-level discriminated unions.

v2.26.0

Added

• Zod 4 adapter added! Adapter names are zod4 and zod4Client, works with both the full version and Zod Mini. As Zod is now using its own JSON Schema representation, and there are some breaking changes like how enums are handled, check migrations carefully and please report any bugs.
• taintedMessage now passes BeforeNavigate to its callback function.
• SuperDebug now has a Runes version, see the docs for how to import it.
• Added config options to valibotClient, same as in the valibot adapter.

Changed

• Bumped Zod peerDep requirement to 3.25.0 due to the Zod 4 release.
• Bumped Valibot peerDep requirement to 1.0.0, congratulations on the stable release!

v2.25.0

Added

• Added applyAction: 'never' option, to prevent load function invalidation from overwriting the form state.
• Added invalidateAll: 'pessimistic' option as an alternative to the 'force' option (recommended to use instead for clarity).

v2.24.1

Fixed

• Fixed error mapping for deeply nested errors where no default value existed.

v2.24.0

Added

• Exported SuperValidateOptions type.
• Exported MergeUnion, MergeFormUnion and a mergeFormUnion utility, for handling discriminated unions in forms.

Fixed

• Fixed diff algorithm problem with tainted objects.
• Prevented crash when custom validity doesn't exist for an element.
• dateProxy didn't restore properly with snapshots.
• Fixed JSON Schema for simple adapters with empty arrays.

Changed

• Bumped TypeBox peerDep requirement to 0.34.28.
• Bumped Effect peerDep requirement to 3.13.7.
• Bumped Valibot peerDep requirement to 1.0.0-rc.3.
• Bumped Zod peerDep requirement to 3.24.2.

Deprecated

• The flashMessage option is now deprecated, since SvelteKit has moved to $app/state instead of $app/stores, making it hard to support both. Use sveltekit-flash-message directly (setFlash or redirect) instead of integrating it with Superforms, it's less complicated as well.

v2.23.0

Added

• dateProxy now has a step option, to support seconds (when not divisible by 60).
• SuperDebug now opts out of runes mode as default.

Fixed

• Fixed dateProxy for time formats, previously it returned an invalid date. If you only care about the time part in the date, use time-utc as format to avoid timezone changes.
• Vite 6 bundling fixed by introducing a default field into exports in package.json.

Changed

• Arktype 2.0 is finally released! Adapter updated, please check it out, it's validation on the next level.
• Arktype is now displaying errors with problem instead of message, for nicer output.
• Zod peerDependency updated to 3.24.1 to be compatible with its latest fix.
• VineJS adapter updated to 3.0.0.