dev-newsZod logozod.dev

Latest stable Zod: 4.6.7, released (release notes). 148 stable releases since 18 Apr 2024.

Zod

TypeScript-first schema validation. 21 September 2026: a compromised credential on main.

until 4.6.5push to mainCI releasenpm publish21 Sep: six malicious commits land heresince 4.6.6push to mainCI releasenpm stageapprovalnpm publish#6622#6638
How a Zod release reached npm before and after 4.6.6, from the release notes and pull requests #6622 and #6638.

Zod 4.6.6 went out on 11 October 2026 with a note at the top of its release: six malicious commits were pushed to main on 21 September with a compromised git credential. They were reverted the same day and later removed from the history of main, and none of them reached npm. The note came out 20 days after the push.

The same release changed how Zod gets to npm. The release workflow now stages new versions instead of publishing them, and the run waits on an approval environment until someone signs off on what was staged. Before that, a release was one npm publish from CI.

As of 24 October 2026. Zod 4.6.6 release notes.

Incident log

  1. 4.6.5 published
  2. Six malicious commits pushed to main with a compromised git credential
  3. Reverted the same day in #6620, “Cleanup bad commits”
  4. 4.6.6: staged npm versions (#6622), approval gate before publish (#6638), commits removed from main’s history
  5. 4.6.7 published, a version bump only

Releases by minor line

3.2213.2393.2453.2575 · Zod 4 shipped inside 3.254.0184.1144.224.374.444.554.68
Every Zod release on npm since 2024, one tick each, grouped by minor version. Red is 4.6.6.

Latest releases

  1. 4.6.7Version bump only.
  2. 4.6.6Incident note; staged, approval-gated npm releases; size bounds checked before parsing.
  3. 4.6.5instanceof().properties() keys off the instance type.
  4. 4.6.4Adds z.currencyCode(); z.url() rejects invalid URLs about 50x faster.
  5. 4.6.3z.properties() is a check again.

From @colinhacks on X

colinhacks@colinhacks

2023: npm publish
2026: staged trusted publishing with provenance, env-scoping, and 3FA, and if you even THINK about minting an npm token you've already been pwned

On X, 23 Oct 2026 10:37:00 UTC

Colin McDonnell, Zod's author, on publishing in 2023 versus 2026, twelve days after 4.6.6.