# What changed in @opensearch-project/opensearch

> 20 changes in @opensearch-project/opensearch 2 to 3 from its official release notes, upgrade guides and advisories: 9 breaking, 1 deprecations, 3 security, 2 new APIs and options. Each one cited. Sources checked 2026-11-13. HTML: https://unstale.sh/npm/@opensearch-project/opensearch/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @opensearch-project/opensearch 3

### Breaking changes

- Decompression is capped, limiting the amount of decompressed response data the client processes. (2.14.0, 3.10.0) — [release notes](https://github.com/opensearch-project/opensearch-js/releases/tag/2.14.0), [release notes](https://github.com/opensearch-project/opensearch-js/releases/tag/3.10.0)
- Declares the Connection agent property as agent rather than _agent. (3.9.0) — [release notes](https://github.com/opensearch-project/opensearch-js/releases/tag/3.9.0)
- API functions no longer accept camelCase parameters and accept only parameters matching the OpenSearch API specification. (3.0.0) — [release notes](https://github.com/opensearch-project/opensearch-js/releases/tag/3.0.0)
- API functions no longer allow overriding the HTTP method; method is treated as a querystring parameter. Use the client.http namespace for custom requests. (3.0.0) — [release notes](https://github.com/opensearch-project/opensearch-js/releases/tag/3.0.0)
- The client requires Node.js 14 or higher; support for Node.js 10 and 12 has been dropped. (3.0.0) — [release notes](https://github.com/opensearch-project/opensearch-js/releases/tag/3.0.0)

### Security

- Response size limits are applied when Content-Length is absent, protecting users from oversized responses without that header. (3.10.0) — [release notes](https://github.com/opensearch-project/opensearch-js/releases/tag/3.10.0)
- Fixed SigV4 signing so the x-amz-content-sha256 header is signed. (3.6.0) — [release notes](https://github.com/opensearch-project/opensearch-js/releases/tag/3.6.0)

### New APIs and options

- Adds support for overwriting the host header. (3.9.0) — [release notes](https://github.com/opensearch-project/opensearch-js/releases/tag/3.9.0)
- Over a hundred API functions were added, and existing functions were updated to match the latest OpenSearch API specification. (3.0.0) — [release notes](https://github.com/opensearch-project/opensearch-js/releases/tag/3.0.0)

### Performance

- API namespaces are instantiated lazily to improve Client construction performance. (3.9.0) — [release notes](https://github.com/opensearch-project/opensearch-js/releases/tag/3.9.0)

### Behavior and default changes

- The client was updated to reflect the latest OpenSearch API specification, potentially changing the API operations available to developers. (3.6.0) — [release notes](https://github.com/opensearch-project/opensearch-js/releases/tag/3.6.0)

### Tooling

- Handwritten request and response types were replaced with types generated from the OpenSearch API specification, improving autocomplete and type checking. (3.0.0) — [release notes](https://github.com/opensearch-project/opensearch-js/releases/tag/3.0.0)

### Fixes and other changes

- Fixes handling of mixed operations in the bulk helper. (3.9.0) — [release notes](https://github.com/opensearch-project/opensearch-js/releases/tag/3.9.0)
- The error listener was added back before the callback. (3.6.0) — [release notes](https://github.com/opensearch-project/opensearch-js/releases/tag/3.6.0)

## @opensearch-project/opensearch 2

### Breaking changes

- The client changes its Blacklist / Whitelist terminology. (2.0.0) — [release notes](https://github.com/opensearch-project/opensearch-js/releases/tag/2.0.0)
- The remaining existsType references are removed. (2.0.0) — [release notes](https://github.com/opensearch-project/opensearch-js/releases/tag/2.0.0)
- The remaining flushSynced references are removed. (2.0.0) — [release notes](https://github.com/opensearch-project/opensearch-js/releases/tag/2.0.0)
- Types are removed for 2.0. (2.0.0) — [release notes](https://github.com/opensearch-project/opensearch-js/releases/tag/2.0.0)

### Security

- Response size is bounded when Content-Length is absent, limiting the size of responses the client processes. (2.14.0) — [release notes](https://github.com/opensearch-project/opensearch-js/releases/tag/2.14.0)

### Deprecations

- The client deprecates its Master terminology. (2.0.0) — [release notes](https://github.com/opensearch-project/opensearch-js/releases/tag/2.0.0)