The headline fact about Zod's technology choices: packages/zod/package.json — the manifest that ships to npm — has no dependencies, no peerDependencies, and no optionalDependencies fields at all. Everything the library does (string format regexes, error localization, JSON Schema conversion, code generation for the object fast path) is implemented in-tree under packages/zod/src. Installing zod installs exactly one package.

Its scripts block is correspondingly small:

"scripts": {
  "clean": "git clean -xdf . -e node_modules",
  "build": "zshy --project tsconfig.build.json",
  "postbuild": "tsx ../../scripts/write-stub-package-jsons.ts && pnpm biome check --write .",
  "test:watch": "pnpm vitest",
  "test": "pnpm vitest run",
  "prepublishOnly": "tsx ../../scripts/check-versions.ts"
}

So this section documents what actually carries engineering weight here: the development toolchain declared in the root package.json (36 dev dependencies). Grouped by job:

Build and type system

TypeScript ~5.5.4 (deliberately tilde-pinned) plus zshy as the build tool, with tsx for running TypeScript directly during development. The @zod/source custom export condition lets every tool in the repo run against raw source instead of build output. Details: TypeScript and the zshy build.

Testing

Vitest ^4.1.5 runs runtime tests and type-level tests in the same files, with tsc as the typechecker. @web-std/file polyfills File for z.file() tests, and @arethetypeswrong/cli is on hand for auditing how the published export map resolves across module systems. Details: Vitest.

Code quality

Biome ^1.9.4 is the single formatter and linter, enforced on staged files by husky + lint-staged, alongside madge for circular-dependency checks (pnpm check:circular) and recheck for verifying that Zod's format regexes are ReDoS-safe. Details: Biome and repo hygiene.

Performance and size accounting

Three benchmark harnesses (tinybench, mitata, benchmark) drive packages/bench, with arktype and zod3 (Zod 3, npm-aliased) installed as comparison targets. rollup, rolldown, and esbuild bundle the fixtures in packages/treeshake to keep tree-shaking honest. Details: benchmarks and bundle size.

Release and publishing

semver plus scripts/check-versions.ts keep the three version declarations in lockstep (package.json, jsr.json, src/v4/core/versions.ts); jsr publishes the Deno/JSR package @zod/zod. execa, chalk, globby, and console-table-printer are utility libraries for the repo's own scripts.

One dev dependency deserves a special mention for what it is not: zod: "workspace:*" — the repo depends on itself so that play.ts, benchmarks, and tests can import * as z from "zod" exactly like a consumer would.