Zinit¶

ID: zinit
Links: Documentation · Repository
Upstream stars: ⭐ 4,862
Last commit: 2026-09-27
Version requirement: >= 3.10
Platforms: 🐧 Linux · 🍎 macOS
Operations: installed · install · upgrade · upgrade_all · remove
purl types: pkg:zinit/
CLI name: zsh
Forced environment: SHELL_SESSIONS_DISABLE=1
Issues and PRs: 📦 manager: zsh-based
Source: zinit.py

Zinit is a flexible and fast Zsh plugin manager.

Zinit installs Zsh plugins, snippets and completions from GitHub and other forges, cloning each into $ZINIT[PLUGINS_DIR]. Packages are identified by the user/repo slug Zinit both reports and accepts, which is the id mpm keys them on. A plugin the user renamed through the id-as ice reports under that alias instead, and feeds back into every operation just the same.

What `mpm` adds to `zinit`¶

mpm reaches across every manager at once, not zinit alone: mpm installed and mpm outdated cover zinit alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `zinit` commands, in `mpm`¶

You already know zinit: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `zinit`	With `mpm`
List what’s installed	`zsh --interactive -c 'zinit plugins'`	`mpm --zinit installed`
Install a package	`zinit load zdharma-continuum/null`	`mpm install pkg:zinit/zdharma-continuum/null`
Upgrade one package	`zinit update zdharma-continuum/null`	`mpm --zinit upgrade zdharma-continuum/null`
Upgrade everything	`zinit update --all`	`mpm --zinit upgrade --all`
Remove a package	`zinit delete --yes zdharma-continuum/null`	`mpm remove pkg:zinit/zdharma-continuum/null`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported	Notes
`installed`	✅	The inventory runs a full interactive shell startup, and may miss plugins deferred with the `wait` ice.
`outdated`	❌	The only “what would change” command self-updates Zinit first, so it mutates rather than queries; `upgrade --all` still works.
`orphans`
`search`	❌	Zinit resolves plugins straight from forge URLs and indexes no registry to search.
`install`	✅
`upgrade`	✅
`upgrade_all`	✅
`remove`	✅
`sync`
`cleanup`
`doctor`

Configuration¶

Ignore zinit on the mpm CLI by passing the --no-zinit option.
Ignore it for every run in your configuration:
```
[mpm]
zinit = false
```
Raise the timeout of all zinit calls:
```
[mpm.overrides.zinit]
timeout = 900
```

Run mpm config-template zinit to print all overridable settings for your configuration file:

[mpm.overrides.zinit]
cli_names = [
    "zsh",
]
cli_search_path = []
dry_run = false
ignore_auto_updates = true
plan = false
post_args = []
pre_args = []
pre_cmds = []
requirement = ">=3.10.0"
stop_on_error = false
unmaintained = false
version_cli_options = [
    "version",
]
version_regexes = [
    "zinit\\s+v(?P<version>\\S+)",
]

[mpm.overrides.zinit.extra_env]
SHELL_SESSIONS_DISABLE = "1"

The arguments and environment variables listed in the box atop this page are forced on every zinit call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Recipes¶

A few jobs you would otherwise script around zinit, one mpm command each:

Snapshot and clone a machine: mpm --zinit dump zinit.toml, then mpm restore zinit.toml on the next one.
Export a compliance SBOM: mpm --zinit sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations is privileged.

See privilege escalation for the full policy.

Cooldown¶

State of Zinit’s release-age gating, from the cooldown support table:

Status: ❌ None

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: Upstream Git clones
Retraction: None: a plugin is cloned straight from its upstream repository, so withdrawing a bad revision is its author force-pushing, retagging or deleting it themselves. No index sits in between
Publish date: ❌ a commit or tag date is set by the author and freely rewritable

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Reference traces¶

A collection of raw native outputs captured from the manager’s own CLI and recorded in the manager source. If you know Zinit well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ zsh --interactive -c 'zinit plugins'
==> 3 Plugins

 1 L ~zinit/zinit.git

 2 L zdharma-continuum/fast-syntax-highlighting

 3 U zsh-users/zsh-completions

Loaded: L | Unloaded: U

Version check¶

The version is probed by running:

$ zsh version
zinit v3.15.0 (darwin25.4.0_arm64)

and extracted with:

r"zinit\s+v(?P<version>\S+)"

Upstream project¶

Metrics	`zdharma-continuum/zinit`
Activity
Popularity
Metadata

Changelog¶

7.6.0 (2026-08-10)
- Add the Zinit Zsh plugin manager with installed, install, remove and upgrade support. Zsh is the CLI mpm executes, and the plugin inventory is read from an interactive shell since Zinit tracks plugins in state the user’s .zshrc populates.