Format Comparison Format Human-Readable Schema Size vs JSON Parse Speed JSON Yes None Baseline Moderate YAML Yes None (implicit) Larger Slow TOML Yes None (explicit) Larger Moderate Protobuf No Required ~95% smaller Fast Avro No Required (embedded) Small Fast MessagePack No None ~4–63% smaller Fast CBOR No None (tags) ~19% smaller Fast FlatBuffers No Required…
Cross-format conversion is not a neutral translation. Each format has a data model with different primitives, different structural guarantees, and different opinions about what a value means. JSON has null; TOML does not. XML has attributes and namespaces; JSON has neither. YAML has anchors and tags; JSON has no representation for them. A converter that…
A JSON array cannot be appended to. The closing bracket ends the document, and adding another object requires rewriting the file or buffering the entire array in memory before writing it out. This is the problem streaming serialization solves. JSON Lines (also called NDJSON or newline-delimited JSON) removes the brackets and uses a newline as…
A form with five fields does not need performance tuning. A form with fifty fields, a field array, and a live validation summary does. React Hook Form’s default behavior is already optimized—inputs are uncontrolled, and re-renders are triggered by subscriptions rather than by state changes. The performance problems that appear in large forms are not…
The previous chapter covered the basic resolver connection. This chapter covers the three patterns that turn a single-screen form into a real application: dynamic field arrays that add and remove rows, multi-step wizards that validate one screen at a time, and asynchronous uniqueness checks that debounce before hitting the network. Each pattern has a failure…
React Hook Form’s built-in validation rules live in the register call. Zod’s validation lives in the schema. The zodResolver connects them: the form fields register as usual, but validation is delegated to the schema, and the errors that appear in formState.errors are the schema’s issues mapped to field names. This means the rules are defined…
Zod’s synchronous parsing methods assume validation completes immediately. An async refinement—a database uniqueness check, an external API call, a file read—breaks that assumption. The schema returns a Promise instead of a value, and .parse() throws an error the moment it encounters one. Async validation is the mechanism that lets a schema await those checks, and…
Zod v4 replaced the fragmented error options of v3 with a single error parameter. In v3, a schema could accept message, invalid_type_error, required_error, or an errorMap, and each served a different purpose. In v4, all of them are removed, and error is the only parameter that customizes a validation message . The change is a…
A hash or a signature is only as trustworthy as the bytes it was computed over. If the same logical data can serialize to different byte sequences—different key order, different whitespace, different number formatting—then a signature computed over one sequence will fail verification against another, even though the data is identical. Canonical serialization is the…
Deserialization does not need to execute code to be dangerous. A payload that is small on the wire can expand into a structure that exhausts memory, blocks the event loop, or crashes the process. The attack class is CWE-400, uncontrolled resource consumption, and it appears in every format and every language: YAML’s billion laughs, JSON’s…