# Zod release history: a compromised credential and a staged release

Source page: https://dev-news.anonyfox.com/zod/

Every Zod release since 2024 from npm by minor line, the six malicious commits pushed to main in September 2026, and the staged, approval-gated npm publishing Zod moved to afterwards.

## Where it stands (2026-10-24)

Zod 4.6.6 went out on 11 October 2026 with a note at the top of its release: six malicious commits were pushed to main on 21 September with a compromised git credential. They were reverted the same day and later removed from the history of main, and none of them reached npm. The note came out 20 days after the push.

The same release changed how Zod gets to npm. The release workflow now stages new versions instead of publishing them, and the run waits on an approval environment until someone signs off on what was staged. Before that, a release was one npm publish from CI.

## Latest stable releases

- [4.6.7](https://github.com/colinhacks/zod/releases/tag/v4.6.7) (2026-10-12): b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7
- [4.6.6](https://github.com/colinhacks/zod/releases/tag/v4.6.6) (2026-10-11): 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
- [4.6.5](https://github.com/colinhacks/zod/releases/tag/v4.6.5) (2026-09-13): d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
- [4.6.4](https://github.com/colinhacks/zod/releases/tag/v4.6.4) (2026-09-13): d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI
- [4.6.3](https://github.com/colinhacks/zod/releases/tag/v4.6.3) (2026-09-12): 413cce9a fix(v4): make z.properties() a check again — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and…
- [4.6.2](https://github.com/colinhacks/zod/releases/tag/v4.6.2) (2026-09-10): 9446b5cc fix: preserve undefined prefault outputs and object keys — closes #6585
- [4.6.1](https://github.com/colinhacks/zod/releases/tag/v4.6.1) (2026-09-09): b12aa523 fix: preserve unique tags with defaulted discriminators — closes #6577
- [4.6.0](https://github.com/colinhacks/zod/releases/tag/v4.6.0) (2026-09-09): .validate() — checks input validity without building a result (up to 35x faster than .safeParse().success on a compiled schema)
- [4.5.4](https://github.com/colinhacks/zod/releases/tag/v4.5.4) (2026-08-29): 84e416fbf4740527bbc8f319634f4e1b065bb42c fix(v4): stop the cycle walk from firing a default factory
- [4.5.3](https://github.com/colinhacks/zod/releases/tag/v4.5.3) (2026-08-29): e6b6ab347675cd2bd54b1bdbed16f98c59be82a9 docs(blog): widen the z.compile example to a 20-property schema
- [4.5.2](https://github.com/colinhacks/zod/releases/tag/v4.5.2) (2026-08-29): a354314ac04fdd5484aa62dd5c3a4b553211a0e4 fix(docs): keep blog posts out of the docs collection
- [4.5.0](https://github.com/colinhacks/zod/releases/tag/v4.5.0) (2026-08-28): z.compile() — the flagship feature of Zod 4.5
- [4.5.1](https://github.com/colinhacks/zod/releases/tag/v4.5.1) (2026-08-28): 2e862dbf89da2835e5206a8fd3d3be61afe3cf7f ci: gate the GitHub release and JSR publish on the version being live on npm
- [4.4.3](https://github.com/colinhacks/zod/releases/tag/v4.4.3) (2026-05-04): 4c2fa95ce3f3390fbc522324e406b4e9e89b88f9 docs: use Zernio primary wordmark for gold sponsor logo
- [4.4.2](https://github.com/colinhacks/zod/releases/tag/v4.4.2) (2026-05-01): 0c62df0ea19fd05abdf90473e9eef7eea530fab2 Clean up docs navigation and stale labels

Releases since 2024: 148 stable, 32 prereleases. JSON: https://dev-news.anonyfox.com/zod.json. Feed: https://dev-news.anonyfox.com/zod/feed.xml