Valibot v1.2 introduces five new type coercion transformation actions (toBigint, toBoolean, toDate, toNumber, toString) useful for parsing form data and query parameters, unlike Zod's z.coerce these can be composed anywhere in a pipeline. A new examples() action attaches machine-readable example values to schemas for AI tool integration and documentation. Built-in isbn() validation now supports ISBN-10 and ISBN-13 formats with checksum verification. The release also fixes an important ReDoS vulnerability in the emoji action's regex pattern, with users of that action urged to upgrade immediately. The build system switched from tsup to tsdown, and LambdaTest joins as a new partner.
Table of contents
Type coercion actionsExamples for AI tools and documentationISBN validationSecurity fix: ReDoS vulnerabilityFaster builds with tsdownNew partner announcementWhat's next?Questions this post answers
Is there a security vulnerability in Valibot's emoji validation action?
Yes, Valibot versions before 1.2 contain a ReDoS (Regular Expression Denial of Service) vulnerability in the EMOJI_REGEX pattern used by the emoji action. An attacker could craft input strings that cause excessive CPU usage. The regex pattern was fixed in v1.2 while keeping the same validation behavior, so anyone using the emoji action should upgrade immediately. daily.dev surfaces security fixes like this so validation libraries in your stack stay patched.
How do Valibot's type coercion actions differ from Zod's z.coerce?
Valibot v1.2 adds toBigint, toBoolean, toDate, toNumber, and toString transformation actions that, unlike Zod's z.coerce, can be composed anywhere within a validation pipeline rather than only at the start. This gives finer control over when transformations happen, for example converting a string to a number and then applying integer and range checks in sequence, useful for parsing form data and query parameters. developers comparing Zod and Valibot for schema validation can track library differences on daily.dev.
Does Valibot support ISBN validation?
Yes, Valibot v1.2 added a built-in isbn() action validating both ISBN-10 and ISBN-13 formats, accepting hyphens and spaces as separators and checking the checksum for mathematical correctness. Example valid formats include '0-306-40615-2' for ISBN-10 and '978-0-306-40615-7' for ISBN-13, making it suited for library systems and bookstore applications handling book identifiers. daily.dev helps developers building catalog or bookstore apps keep up with validation library features.