Zod uses Biome (^1.9.4) as both formatter and linter — there is no ESLint or Prettier config in the active toolchain (prettier remains in devDependencies for auxiliary tooling, but source formatting is Biome's job). One tool means one config file and one fast pass over the repo, which matters when hooks run it on every commit.

The configuration

{
  "$schema": "https://biomejs.dev/schemas/1.9.4/schema.json",

  "formatter": {
    "enabled": true,
    "indentStyle": "space",
    "lineWidth": 120
  },
  "linter": {
    "enabled": true,
    "rules": {
      "recommended": true,
      "suspicious": {
        "noExplicitAny": "off", // `any` is amazing
        "noUnsafeDeclarationMerging": "off",
        "noMisleadingInstantiator": "off",
        "noEmptyInterface": "off",
        "noConfusingVoidType": "off",
        "noThenProperty": "off"
      },

The disabled rules are not laxity — they map directly onto how the library is built. noUnsafeDeclarationMerging and noEmptyInterface are off because the $constructor trait system pairs an interface and a const of the same name for every schema class (see schema construction). noExplicitAny is off by philosophy, as the inline comment states. noThenProperty is off because parse payloads can be Promises and the pipeline inspects them.

Scripts

"fix": "pnpm run format && pnpm run lint",
"format": "biome check --write .",
"format:check": "biome check .",
"lint": "biome lint --write .",
"lint:check": "biome lint .",

pnpm fix is the everyday command; the :check variants are the non-mutating versions for CI-style verification.

Enforcement at commit and push

Husky (installed by the root prepare script) wires two hooks. Pre-commit refuses untracked files, runs pnpm check:semver (the three version declarations must agree), then lint-staged, which the root manifest scopes to Biome:

"lint-staged": {
  "packages/*/src/**/*.ts": [
    "biome format --no-errors-on-unmatched --write",
    "biome lint --no-errors-on-unmatched --write"
  ],

Pre-push repeats the semver check and runs the full pnpm test. The effect: formatting issues cannot reach a commit, and failing tests cannot reach the remote.

Two more hygiene tools round out the setup: madge (pnpm check:circular) fails on circular imports across packages/zod/src outside the core, and recheck powers the ReDoS test over every built-in regex (packages/zod/src/v4/classic/tests/redos.test.ts).