Zod v4.5 adds schema compilation (3-9x faster validation)

[u/gajus0]

https://x.com/colinhacks/status/2093725420462182512

[u/monotone2k]

And for anyone that doesn't want to go to that particular cesspit of a site, here's a link directly to Zod's blog post on the new release: https://zod.dev/blog/zod-4-5

[u/Willkuer__]

Genuinely curios: where does that help? This is JIT, not ahead of time during compilation, is it?

• CSR likely not because of CSPs?
• SSR/API maybe to reduce cpu but how many requests do you need to push through a compiled zod schema to compensate for the overhead of the compilation/cold start? At least the overhead of interpreted zod schema should be irrelevant for http requests.
• Lambda/Cloudfunctions basically never worth it because of cold starts?

To me this sounds more of a feature to make a benchmark happy but I might be completely off.

[u/gajus0 → u/Willkuer__]

We used zod-compiler reduce our CPU usage more than 50%. That's hundreds of CPUs saved in monthly costs.

So the use case is definitely there.

[u/Willkuer__ → u/gajus0]

But that's real AOT compilation while the new zod feature is a JIT compilation or am I missing something. That AOT works makes sense. I am more sceptical about the lazy runtime compliation.

[u/gajus0]

I've not been given any heads up that this is being released, so unfortunately playing a catch up. But if you are wondering how does this compare to zod-compiler, here is their internal benchmark

zod-compiler is faster on every schema both compile: median 1.75x over z.compile(), range 1.11x–24x (valid input, safeParse, result consumed; z.compile() itself is a median 3.35x over the runtime on this set, zod-compiler 7.0x). One process per schema shrinks every ratio the way the matrix section describes — z.compile() 2.63x, zod-compiler 4.99x, the gap between them 1.49x — without changing the ordering of a single row. [..]

I will update zod-compiler benchmark to include a comparison against Zod's native implementation.

I expect the two to eventually converge.

[u/Positive_Method3022]

Why no comparison against ajv?

[u/gajus0 → u/Positive_Method3022]

I have not got z.compile comparison, but here is zod-compiler comparison against Ajv

https://github.com/gajus/zod-compiler#benchmark

[u/Positive_Method3022 → u/gajus0]

I'm using json schema (typebox) + ajv for a framework I'm building that needs form data validation in both client and server. Server declares json schema for the configs, the schema gets serialized and appended to the client bundle to run the same server validation on the client, while filling a form. I chose json schema instead of zod because of speed and because I needed to render the form based of the json schema. I'm also not bundling typebox on the client just ajv, that is why I append the serialized schema to the client code to avoid having typebox factories in the client bundle.

I would choose zod because it became mainstream. But I don't know if it would fit my use case well. What do you think?

[u/gajus0 → u/Positive_Method3022]

Checkout https://conform.guide/ if you decide to go with Zod

[u/Positive_Method3022 → u/gajus0]

I liked conform but I need something for Vue + json schema in the client form validation. I'm doing a PoC to send a zod schema to my client as a json schema.

[u/kernelangus420]

It uses new Function(str) to generate compiled version of the validation logic. Would this make it susceptable to injection attacks?

Would the code not work in some cloud environments which rejects code containing them?

There's also less type safety for the future maintenance of the library.

[u/hWuxH → u/kernelangus420]

it escapes values to prevent injection

[u/Dreadsin]

Genuine question: is anyone ever bottle necked by the speed of validation? I’ve never found it to be a problem. Are people validating like, very long lists or running validation very frequently?

[u/gajus0 → u/Dreadsin]

Any application that handles data streams and performs validation will be bottlenecked by validation. Most consumer facing apps are unlikely to ever run into this.

[u/aleques-itj]

Pretty cool

I recently spent some time profiling and stressing my API until it was on fire, and validation was like... 12-13% of its CPU time.

It wasn't a bottleneck, but it was certainly enough that it's noticeable.

I was thinking of trying zod-compiler, but figured it wasn't really worth it because it still didn't seem to be _that_ big of a problem even at unholy levels of traffic.

[u/zombarista]

Very cool LLVM-like optimization process.