# What changed in valibot

> 63 changes in valibot 1 from its official release notes, upgrade guides and advisories: 4 breaking, 3 security, 30 new APIs and options. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/valibot/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## valibot 1

### Breaking changes

- Rejects non-ASCII characters accepted by Unicode case folding. (1.5.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.5.0)
- Drops the i flag for better JSON Schema compatibility. (1.3.1) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.3.1)
- Drops the i flag for better JSON Schema compatibility. (1.3.1) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.3.1)
- Drops the i flag for better JSON Schema compatibility. (1.3.1) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.3.1)

### Security

- Rejects ULIDs that exceed the maximum 128-bit value. (1.5.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.5.0)
- The flatten method now handles issue path keys that collide with Object.prototype members such as toString without throwing a TypeError. (1.4.2) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.4.2), [security advisory](https://github.com/advisories/GHSA-5QJJ-4XWW-7PHC)
- Valibot has a ReDoS vulnerability in `EMOJI_REGEX` (1.2.0) — [security advisory](https://github.com/advisories/GHSA-VQPR-J7V3-HQW9), [release notes](https://github.com/open-circle/valibot/releases/tag/v1.2.0)

### New APIs and options

- Adds a validation action to validate the number of Unicode code points. (1.5.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.5.0)
- Adds a validation action to validate KSUIDs. (1.5.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.5.0)
- Adds a validation action to validate the number of Unicode code points. (1.5.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.5.0)
- Adds a validation action to validate the number of Unicode code points. (1.5.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.5.0)
- Adds a validation action to validate the number of Unicode code points. (1.5.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.5.0)
- Adds a validation action for ISO date times with seconds. (1.4.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.4.0)
- Adds a transformation action to convert strings to camel case. (1.4.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.4.0)
- Adds a transformation action to convert strings to kebab case. (1.4.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.4.0)
- Adds a transformation action to convert strings to Pascal case. (1.4.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.4.0)
- Adds a transformation action to convert strings to snake case. (1.4.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.4.0)
- Adds a method for caching schema output by input. (1.3.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.3.0)
- Adds a validation action for domain names. (1.3.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.3.0)
- Adds a transformation action that narrows types using type predicates. (1.3.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.3.0)
- Adds a validation action for ISRC codes. (1.3.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.3.0)
- Adds a validation action for JWS compact strings. (1.3.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.3.0)
- Adds a transformation action to parse boolean values from strings and other types. (1.3.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.3.0)
- Adds an action for adding example values to a schema. (1.2.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.2.0)
- Adds a method for extracting example values from a schema. (1.2.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.2.0)
- Adds a validation action for ISBN-10 and ISBN-13 strings. (1.2.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.2.0)
- Exports this type to improve the developer experience with rawCheck and rawTransform actions. (1.2.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.2.0)
- Exports this type to improve the developer experience with rawCheck and rawTransform actions. (1.2.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.2.0)
- Exports this type to improve the developer experience with rawCheck and rawTransform actions. (1.2.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.2.0)
- Exports this type to improve the developer experience with rawCheck and rawTransform actions. (1.2.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.2.0)
- Exports this type to improve the developer experience with rawCheck and rawTransform actions. (1.2.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.2.0)
- Exports this type to improve the developer experience with rawCheck and rawTransform actions. (1.2.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.2.0)
- Adds a transformation action that converts values to bigint. (1.2.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.2.0)
- Adds a transformation action that converts values to boolean. (1.2.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.2.0)
- Adds a transformation action that converts values to Date. (1.2.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.2.0)
- Adds a transformation action that converts values to number. (1.2.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.2.0)
- Adds a transformation action that converts values to string. (1.2.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.2.0)

### Performance

- Uses `URL.canParse` when available to avoid constructing URL objects. (1.5.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.5.0)
- Word count actions cache Intl.Segmenter for non-primitive locales instead of recreating it for each validation. (1.4.2) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.4.2)
- Changes hot paths to reduce object allocations and improve runtime performance. (1.4.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.4.0)

### Behavior and default changes

- The flatten method now accepts readonly issue arrays. (1.4.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.4.0)

### Tooling

- Changes the build target to ES2020 so distributed output stays compatible with environments that lack support for newer syntax. (1.4.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.4.0)

### Fixes and other changes

- Clones issues from a cached dataset so parent schemas do not add their path item to the same issue on every cache hit. (1.5.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.5.0)
- Clones issues from a cached dataset so parent schemas do not add their path item to the same issue on every cache hit. (1.5.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.5.0)
- Merges matching `NaN` values and invalid dates. (1.5.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.5.0)
- Ignores inherited properties when merging objects, preserves own properties without invoking inherited setters, and does not change the output prototype. (1.5.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.5.0)
- Ignores inherited properties when merging objects, preserves own properties without invoking inherited setters, and does not change the output prototype. (1.5.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.5.0)
- Treats `NaN` as equal to itself. (1.5.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.5.0)
- Treats `NaN` as equal to itself. (1.5.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.5.0)
- Treats `NaN` as equal to itself. (1.5.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.5.0)
- Preserves the dataset value when `JSON.stringify` returns `undefined`. (1.5.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.5.0)
- Object schemas and their async variants correctly handle unknown input keys that collide with `Object.prototype` members. (1.5.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.5.0)
- Treats `NaN` as equal to itself. (1.5.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.5.0)
- Treats `NaN` as equal to itself. (1.5.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.5.0)
- The intersect schema now merges object keys that collide with Object.prototype members such as toString. (1.4.2) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.4.2)
- Fixes inferred input and output types for non-tuple array options, which were previously inferred as never. (1.4.1) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.4.1)
- Fixes validation to reject Mastercard numbers with invalid lengths. (1.4.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.4.0)
- Stops mutating input values, allowing frozen objects and arrays to be merged. (1.4.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.4.0)
- Fixes a potential RangeError caused by spreading large issue arrays. (1.4.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.4.0)
- The hash action uses case-expanded character classes instead of the i flag. (1.3.1) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.3.1)
- Allows 13-digit Visa card numbers. (1.3.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.3.0)
- Fixes types for deeply readonly default and fallback values. (1.3.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.3.0)
- Allows an optional space before the UTC offset for PostgreSQL `timestamptz` compatibility. (1.3.0) — [release notes](https://github.com/open-circle/valibot/releases/tag/v1.3.0)