# What changed in @casl/ability

> 15 changes in @casl/ability 6 to 7 from its official release notes, upgrade guides and advisories: 8 breaking, 2 security. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/npm/@casl/ability/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @casl/ability 7

### Breaking changes

- Ability replaces PureAbility and no longer has default options; use createMongoAbility and MongoAbility to get the previous Ability behavior. (7.0.0) — [release notes](https://github.com/stalniy/casl/releases/tag/%40casl/ability%407.0.0)
- An empty conditions object now matches all. (7.0.0) — [release notes](https://github.com/stalniy/casl/releases/tag/%40casl/ability%407.0.0)
- The exported getDefaultErrorMessage function was removed. (7.0.0) — [release notes](https://github.com/stalniy/casl/releases/tag/%40casl/ability%407.0.0)
- possibleRulesFor now returns readonly Rule[], so callers can no longer treat its result as a mutable array. (7.0.0) — [release notes](https://github.com/stalniy/casl/releases/tag/%40casl/ability%407.0.0)
- PureAbility was renamed to Ability. (7.0.0) — [release notes](https://github.com/stalniy/casl/releases/tag/%40casl/ability%407.0.0)
- rulesFor now returns readonly Rule[], so callers can no longer treat its result as a mutable array. (7.0.0) — [release notes](https://github.com/stalniy/casl/releases/tag/%40casl/ability%407.0.0)
- rulesToCondition replaces rulesToQuery. (7.0.0) — [release notes](https://github.com/stalniy/casl/releases/tag/%40casl/ability%407.0.0)
- rulesToQuery has been replaced by rulesToCondition. (7.0.0) — [release notes](https://github.com/stalniy/casl/releases/tag/%40casl/ability%407.0.0)

### Security

- Prevents rulesToFields from setting properties on prototypes and non-objects. (7.0.2) — [release notes](https://github.com/stalniy/casl/releases/tag/%40casl/ability%407.0.2)

### Behavior and default changes

- Conditions that semantically match everything are treated the same as rules without conditions. (7.0.0) — [release notes](https://github.com/stalniy/casl/releases/tag/%40casl/ability%407.0.0)

### Fixes and other changes

- Adds bugs metadata to all packages, giving developers a package-level issue-tracker reference. (7.0.1) — [release notes](https://github.com/stalniy/casl/releases/tag/%40casl/ability%407.0.1)
- Adds defensive protection against undefined returned from the rule conditions matcher. (7.0.0) — [release notes](https://github.com/stalniy/casl/releases/tag/%40casl/ability%407.0.0)
- Prevents the rules index cache from being polluted with undefined actions. (7.0.0) — [release notes](https://github.com/stalniy/casl/releases/tag/%40casl/ability%407.0.0)
- rulesToAST now generates conditions that respect rule priority. (7.0.0) — [release notes](https://github.com/stalniy/casl/releases/tag/%40casl/ability%407.0.0)

## @casl/ability 6

### Security

- CASL Ability is Vulnerable to Prototype Pollution (6.7.5) — [security advisory](https://github.com/advisories/GHSA-X9VF-53Q3-CVX6)