unstale

npm / @apidevtools/json-schema-ref-parser

@apidevtools/json-schema-ref-parser

What changed in @apidevtools/json-schema-ref-parser 15 to 16, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.

4 breaking5 security3 new APIs and options1 tooling19 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.1.1 on npm

@apidevtools/json-schema-ref-parser 168 changes

Breaking changes 1

  • Node.js versions before 22.19.0 are no longer supported.

    16.0.0release notes

Security 2

  • Pinned HTTP requests are hardened when undici is not available.

    16.0.4release notes

  • Reference handling was hardened.

    16.0.2release notes

Fixes and other changes 5

@apidevtools/json-schema-ref-parser 1524 changes

Breaking changes 3

  • Support for 2020-12 anchors and ref siblings was reverted.

    15.3.4release notes

  • The package now uses ESM output, affecting how applications load it.

    15.0.0release notes

  • URL encoding now uses strict RFC 6901, which may change how references are interpreted.

    15.0.0release notes

Security 3

  • Reference resolution and HTTP safety were hardened, which may affect how references and HTTP requests are handled.

    15.5.1release notes

  • Unsafe pointer set tokens are blocked.

    15.3.6release notes

  • The safe URL resolver is hardened.

    15.3.6release notes

New APIs and options 3

  • The HTTP resolver is now available from the package root exports.

    15.2.0release notes

  • The canRead callback now receives additional parameters, allowing callback implementations to use them.

    15.1.0release notes

  • A new dereference option, mergeKeys, is available.

    15.0.0release notes

Tooling 1

  • Enables npm OIDC trusted publishing with provenance.

    15.3.0release notes

Fixes and other changes 14

  • Decodes %3F back to ? in filesystem paths.

    15.5.2release notes

  • Cyclic reference chains are now handled safely.

    15.5.0release notes

  • Bundling now preserves compound schema refs.

    15.4.0release notes

  • Fixes some edge cases in the parser.

    15.3.5release notes

  • Support for 2020-12 anchors was added.

    15.3.3release notes

  • Support for ref siblings was added.

    15.3.3release notes

  • Ref handling now passes the original ref.

    15.3.2release notes

  • Fixes multiple issues with dereferencing and bundling.

    15.3.0release notes

  • The onCircular callback is now called for all occurrences of circular $refs.

    15.2.2release notes

  • When a timeout is set, resolution now checks whether an abort controller exists.

    15.2.1release notes

  • Node imports were removed to fix the browser bundle.

    15.1.3release notes

  • Replaces win32 usages with custom functions in path handling.

    15.1.2release notes

  • The main property was added back to package.json, restoring the package entry point for consumers.

    15.1.1release notes

  • Stops overriding the port.

    15.0.1release notes