npm / @casl/ability
@casl/ability
What changed in @casl/ability 6 to 7, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-19.
8 breaking2 security1 behavior and defaults4 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@casl/ability 714 changes
Breaking changes 8
Ability replaces PureAbility and no longer has default options; use createMongoAbility and MongoAbility to get the previous Ability behavior.
An empty conditions object now matches all.
The exported getDefaultErrorMessage function was removed.
possibleRulesFor now returns readonly Rule[], so callers can no longer treat its result as a mutable array.
PureAbility was renamed to Ability.
rulesFor now returns readonly Rule[], so callers can no longer treat its result as a mutable array.
rulesToCondition replaces rulesToQuery.
rulesToQuery has been replaced by rulesToCondition.
Security 1
Prevents rulesToFields from setting properties on prototypes and non-objects.
Behavior and default changes 1
Conditions that semantically match everything are treated the same as rules without conditions.
Fixes and other changes 4
Adds bugs metadata to all packages, giving developers a package-level issue-tracker reference.
Adds defensive protection against undefined returned from the rule conditions matcher.
Prevents the rules index cache from being polluted with undefined actions.
rulesToAST now generates conditions that respect rule priority.
@casl/ability 61 changes
Security 1
CASL Ability is Vulnerable to Prototype Pollution