# What changed in @apidevtools/json-schema-ref-parser

> 32 changes in @apidevtools/json-schema-ref-parser 15 to 16 from its official release notes, upgrade guides and advisories: 4 breaking, 5 security, 3 new APIs and options. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/@apidevtools/json-schema-ref-parser/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @apidevtools/json-schema-ref-parser 16

### Breaking changes

- Node.js versions before 22.19.0 are no longer supported. (16.0.0) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v16.0.0)

### Security

- Pinned HTTP requests are hardened when undici is not available. (16.0.4) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v16.0.4)
- Reference handling was hardened. (16.0.2) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v16.0.2)

### Fixes and other changes

- Bounded decompression is restored. (16.0.5) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v16.0.5)
- Encoded pointer identity is preserved. (16.0.5) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v16.0.5)
- HTTP handling now supports upgrades. (16.0.5) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v16.0.5)
- Reference scopes are preserved. (16.0.5) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v16.0.5)
- Paths are excluded before references are resolved. (16.0.1) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v16.0.1)

## @apidevtools/json-schema-ref-parser 15

### Breaking changes

- Support for 2020-12 anchors and ref siblings was reverted. (15.3.4) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.3.4)
- The package now uses ESM output, affecting how applications load it. (15.0.0) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.0.0)
- URL encoding now uses strict RFC 6901, which may change how references are interpreted. (15.0.0) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.0.0)

### Security

- Reference resolution and HTTP safety were hardened, which may affect how references and HTTP requests are handled. (15.5.1) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.5.1)
- Unsafe pointer set tokens are blocked. (15.3.6) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.3.6)
- The safe URL resolver is hardened. (15.3.6) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.3.6)

### New APIs and options

- The HTTP resolver is now available from the package root exports. (15.2.0) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.2.0)
- The canRead callback now receives additional parameters, allowing callback implementations to use them. (15.1.0) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.1.0)
- A new dereference option, mergeKeys, is available. (15.0.0) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.0.0)

### Tooling

- Enables npm OIDC trusted publishing with provenance. (15.3.0) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.3.0)

### Fixes and other changes

- Decodes %3F back to ? in filesystem paths. (15.5.2) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.5.2)
- Cyclic reference chains are now handled safely. (15.5.0) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.5.0)
- Bundling now preserves compound schema refs. (15.4.0) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.4.0)
- Fixes some edge cases in the parser. (15.3.5) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.3.5)
- Support for 2020-12 anchors was added. (15.3.3) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.3.3)
- Support for ref siblings was added. (15.3.3) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.3.3)
- Ref handling now passes the original ref. (15.3.2) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.3.2)
- Fixes multiple issues with dereferencing and bundling. (15.3.0) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.3.0)
- The onCircular callback is now called for all occurrences of circular $refs. (15.2.2) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.2.2)
- When a timeout is set, resolution now checks whether an abort controller exists. (15.2.1) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.2.1)
- Node imports were removed to fix the browser bundle. (15.1.3) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.1.3)
- Replaces win32 usages with custom functions in path handling. (15.1.2) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.1.2)
- The main property was added back to package.json, restoring the package entry point for consumers. (15.1.1) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.1.1)
- Stops overriding the port. (15.0.1) — [release notes](https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.0.1)