Valibot v1.2: Type coercion, AI metadata, and ISBN validation

November 24, 2025

Valibot v1.2

Valibot v1.2 adds powerful transformation actions for type coercion, new metadata features to improve AI tool integration, and ISBN validation. These additions make it easier to work with forms, APIs, and AI-powered applications while maintaining Valibot's modular design and minimal bundle size.

This release also includes an important security fix for a ReDoS vulnerability in the emoji action. If you're using this action, we strongly recommend upgrading as soon as possible.

Huge thanks to @EskiMojo14 for implementing type coercion and examples metadata, and to @ysknsid25, a certified librarian, for contributing ISBN validation.

Type coercion actions

Five new transformation actions make type coercion straightforward: toBigint, toBoolean, toDate, toNumber, and toString.

Perfect for HTML forms and query parameters where everything arrives as strings. These actions use JavaScript's native coercion functions with added error handling. For example, toNumber checks for NaN after conversion, and toDate validates that the resulting date is valid.

import * as v from 'valibot';

// Coerce form data to proper types
const FormSchema = v.object({
  quantity: v.pipe(v.string(), v.toNumber()),
  balance: v.pipe(v.string(), v.toBigint()),
  createdAt: v.pipe(v.string(), v.toDate()),
});

// Input: { quantity: '25', balance: '1000', createdAt: '2025-11-23' }
// Output: { quantity: 25, balance: 1000n, createdAt: Date }

Unlike Zod's z.coerce, Valibot's coercion actions can be composed anywhere in your pipeline, giving you precise control over when and how transformations occur.

const QuerySchema = v.object({
  page: v.pipe(
    v.string(),
    v.toNumber(),
    v.integer(),
    v.minValue(1),
    v.maxValue(999)
  ),
  limit: v.pipe(
    v.string(),
    v.toNumber(),
    v.integer(),
    v.minValue(1),
    v.maxValue(100)
  ),
});

Examples for AI tools and documentation

As AI-powered applications become standard, providing machine-readable metadata about your schemas is increasingly important. The new examples() action lets you attach example values to any schema.

import * as v from 'valibot';

const UserSchema = v.object({
  id: v.pipe(
    v.string(),
    v.uuid(),
    v.examples(['550e8400-e29b-41d4-a716-446655440000'])
  ),
  name: v.pipe(
    v.string(),
    v.nonEmpty(),
    v.examples(['Alice Smith', 'Bob Johnson'])
  ),
  email: v.pipe(
    v.string(),
    v.email(),
    v.examples(['alice@example.com', 'bob@example.com'])
  ),
});

// Extract email examples
const emailExamples = v.getExamples(UserSchema.entries.email);

When multiple examples() actions appear in a pipeline, getExamples() automatically concatenates them using depth-first search, giving you a complete list of all examples in the schema tree. Use this for AI tool integration, generating documentation, or creating test fixtures.

ISBN validation

Thanks to @ysknsid25, a certified librarian, we now have built-in isbn() validation for both ISBN-10 and ISBN-13 formats.

import * as v from 'valibot';

const BookSchema = v.object({
  title: v.pipe(v.string(), v.nonEmpty()),
  isbn: v.pipe(v.string(), v.isbn('The ISBN is badly formatted.')),
  author: v.pipe(v.string(), v.nonEmpty()),
});

// Valid ISBN-10 formats:
// '0-306-40615-2', '0306406152', '0 306 40615 2'

// Valid ISBN-13 formats:
// '978-0-306-40615-7', '9780306406157', '978 0 306 40615 7'

The action accepts hyphens and spaces as separators and validates the checksum to ensure mathematical correctness. Perfect for library management systems, bookstores, or any application handling book identifiers.

Security fix: ReDoS vulnerability

This release also includes an important security fix for a ReDoS (Regular Expression Denial of Service) vulnerability in the EMOJI_REGEX pattern used by the emoji action. If you're using the emoji action in your application, we strongly recommend upgrading to v1.2 as soon as possible.

The vulnerability could allow an attacker to cause excessive CPU usage by providing specially crafted input strings. We've updated the regex pattern to eliminate this risk while maintaining the same validation functionality. Thank you to @makenowjust for finding and responsibly disclosing this issue.

Faster builds with tsdown

We've switched from tsup to tsdown (built on Rolldown, which uses Valibot for validation). This speeds up our build times.

New partner announcement

We're excited to welcome LambdaTest as a new partner! LambdaTest is a leading cloud-based testing platform that helps developers test their web applications across 3000+ browsers and operating systems. If your company uses Valibot and benefits from our work, please consider supporting the project through GitHub sponsors.

What's next?

We're creating more guides to help you get the most out of Valibot. Got a specific use case or pattern you'd like us to cover? Let us know on Discord or open a discussion on GitHub.

New to Valibot? Get started. Coming from Zod? Migration guide. Full changelog.

Edit page