### Security - Devalue dependency version updated to prevent [CVE-2026-22774](https://github.com/advisories/GHSA-vw5p-8cq8-m7mv) and two other minor vulnerabilities. ### Added - Added adapter to support [Standard Schema](https://standardschema.dev/schema), now _any validation library_ implementing that interface can be used with Superforms! Big thanks to [sillvva](https://github.com/sillvva) for this contribution! Note however that the `defaults` option is required when using this adapter, as for default values to be inferred automatically, a more specialized adapter for the validation library (handling JSON Schema) needs to be used. ### Fixed - Improved error message for "No shape could be created for schema" to suggest using `zod4` adapter when applicable. [#594](https://github.com/ciscoheat/sveltekit-superforms/issues/594) - Added runtime detection warning when Zod v4 schema is passed to Zod v3 adapter, helping users identify adapter version mismatch. [#594](https://github.com/ciscoheat/sveltekit-superforms/issues/594) - Valibot adapter now handles transformation actions (`trim`, `transform`, etc.) properly by using `typeMode: 'input'` and `errorMode: 'ignore'` as defaults. This prevents errors when schemas contain transformations. Users can override these settings by passing `typeMode` and `errorMode` options to the adapter. [#668](https://github.com/ciscoheat/sveltekit-superforms/pull/668)

### Changed - TypeBox adapter has been bumped to 1.0! Check the [migration guide](https://github.com/sinclairzx81/typebox/blob/main/changelog/1.0.0-migration.md) to upgrade. Note that if you must stay on 0.x for a while, you cannot upgrade to this version of Superforms. ### Added - Added support for Zod 4 [stringbools](https://zod.dev/api?id=stringbool). [#610](https://github.com/ciscoheat/sveltekit-superforms/issues/610) - `booleanProxy` now supports the `empty` option. ### Fixed - Fixed loading timers when the `timeoutMS` setting is triggered and a redirect response is returned. [#622](https://github.com/ciscoheat/sveltekit-superforms/issues/622) - `filesStore` initialValue now matches `fileStore`. [#637](https://github.com/ciscoheat/sveltekit-superforms/issues/637) - Fixed JSON Schema for some non-representable types in Zod 4 adapter, it now handles `set` and `map` properly. [#617](https://github.com/ciscoheat/sveltekit-superforms/issues/617) - Possibly fixed the SuperDebug broken import on Svelte 5 in enforced runes mode [#599](https://github.com/ciscoheat/sveltekit-superforms/issues/599) - Zod 4 error messages should now take the current locale into account as default. [#618](https://github.com/ciscoheat/sveltekit-superforms/issues/618), [#639](https://github.com/ciscoheat/sveltekit-superforms/issues/639) - Zod 3 fix for URL parsing - A default boolean value of `true` returned `false` when parsing a URL with `superValidate`. [#633](https://github.com/ciscoheat/sveltekit-superforms/issues/633)

### Security - Devalue version bumped to avoid [prototype pollution](https://github.com/sveltejs/devalue/security/advisories/GHSA-vj54-72f3-p5jv). ### Fixed - Zod 4 tests working. - Zod 4 adapter didn't use the correct JSON Schema format for dates. - Nested data traversal for correcting invalid types didn't stop at a valid value, replacing paths with default data further down the tree.

### Added - Added `applyAction: 'never'` option, to prevent load function [invalidation](https://svelte.dev/tutorial/kit/invalidation) from overwriting the form state. - Added `invalidateAll: 'pessimistic'` option as an alternative to the `'force'` option (recommended to use instead for clarity).

### Fixed - Fixed error mapping for deeply nested errors where no default value existed.

### Added - Exported `SuperValidateOptions` type. - Exported `MergeUnion`, `MergeFormUnion` and a `mergeFormUnion` utility, for handling discriminated unions in forms. ### Fixed - Fixed diff algorithm problem with tainted objects. - Prevented crash when custom validity doesn't exist for an element. - `dateProxy` didn't restore properly with [snapshots](https://superforms.rocks/concepts/snapshots). - Fixed JSON Schema for simple adapters with empty arrays. ### Changed - Bumped TypeBox peerDep requirement to 0.34.28. - Bumped Effect peerDep requirement to 3.13.7. - Bumped Valibot peerDep requirement to 1.0.0-rc.3. - Bumped Zod peerDep requirement to 3.24.2. ### Deprecated - The `flashMessage` option is now deprecated, since SvelteKit has moved to [$app/state](https://svelte.dev/docs/kit/$app-state) instead of `$app/stores`, making it hard to support both. Use [sveltekit-flash-message](https://github.com/ciscoheat/sveltekit-flash-message) directly (`setFlash` or `redirect`) instead of integrating it with Superforms, it's less complicated as well.

### Added - `dateProxy` now has a `step` option, to support seconds (when [not divisible by 60](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input/time#using_the_step_attribute)). - [SuperDebug](https://superforms.rocks/super-debug) now opts out of runes mode as default. ### Fixed - Fixed `dateProxy` for `time` formats, previously it returned an invalid date. If you only care about the time part in the date, use `time-utc` as format to avoid timezone changes. - Vite 6 bundling fixed by introducing a `default` field into exports in package.json. ### Changed - [Arktype 2.0](https://arktype.io/) is finally released! Adapter updated, please check it out, it's validation on the next level. - Arktype is now displaying errors with `problem` instead of `message`, for nicer output. - Zod peerDependency updated to 3.24.1 to be compatible with its latest fix. - VineJS adapter updated to 3.0.0.

### Fixed - The [transport feature](https://superforms.rocks/concepts/nested-data#arbitrary-types-in-the-form) released in 2.22.0 didn't fully handle classes. It should work better now, but the classes must be quite simple to work. Let me know if you have any problems with a certain class. - Fixed Decimal.js detection in [SuperDebug](https://superforms.rocks/super-debug).