# What changed in @peculiar/x509

> 17 changes in @peculiar/x509 1 to 3 from its official release notes, upgrade guides and advisories: 9 breaking, 3 new APIs and options. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/@peculiar/x509/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @peculiar/x509 3

### Breaking changes

- The browser script exposing the x509 global is removed; browsers should use the ESM build through a bundler or esm.sh, or pin version 2 for the old script. (3.0.0) — [release notes](https://github.com/PeculiarVentures/x509/releases/tag/v3.0.0)
- Input with trailing bytes after the encoded ASN.1 structure now throws an error instead of being accepted with the extra bytes kept in rawData. (3.0.0) — [release notes](https://github.com/PeculiarVentures/x509/releases/tag/v3.0.0)
- TypeScript projects compiling to CommonJS need module set to node20 or nodenext; node16 fails with TS1479. (3.0.0) — [release notes](https://github.com/PeculiarVentures/x509/releases/tag/v3.0.0)
- The supported versions are ^20.19.0 || >=22.12.0; Node.js 20.0-20.18 and 22.0-22.11 cannot use CommonJS require(esm). (3.0.0) — [release notes](https://github.com/PeculiarVentures/x509/releases/tag/v3.0.0)
- Deep imports are blocked by package exports, so consumers must use supported package entry points. (3.0.0) — [release notes](https://github.com/PeculiarVentures/x509/releases/tag/v3.0.0)
- Version ^3.0.0 is a peer dependency; ASN.1 objects from asn1-schema 2 packages can no longer be passed in. (3.0.0) — [release notes](https://github.com/PeculiarVentures/x509/releases/tag/v3.0.0)
- The package is ESM-only; CommonJS require works only on supported Node.js versions through require(esm). (3.0.0) — [release notes](https://github.com/PeculiarVentures/x509/releases/tag/v3.0.0)
- The unpkg and jsdelivr package fields are removed along with the browser script. (3.0.0) — [release notes](https://github.com/PeculiarVentures/x509/releases/tag/v3.0.0)

## @peculiar/x509 2

### Breaking changes

- The reflect polyfill is now required. (2.0.0) — [release notes](https://github.com/PeculiarVentures/x509/releases/tag/v2.0.0)

### New APIs and options

- ASN.1 parse options are exposed for developers to use. (2.1.0) — [release notes](https://github.com/PeculiarVentures/x509/releases/tag/v2.1.0)
- A crypto argument is added to findRevoked. (2.1.0) — [release notes](https://github.com/PeculiarVentures/x509/releases/tag/v2.1.0)
- AlgorithmProvider handlers are registered for ML-DSA and SLH-DSA, adding support for FIPS 204 and FIPS 205 algorithms. (2.1.0) — [release notes](https://github.com/PeculiarVentures/x509/releases/tag/v2.1.0)

### Performance

- PEM encoding and decoding are optimized for performance. (2.0.0) — [release notes](https://github.com/PeculiarVentures/x509/releases/tag/v2.0.0)

### Fixes and other changes

- Limits are no longer applied when parsing the library's own DER. (2.2.0) — [release notes](https://github.com/PeculiarVentures/x509/releases/tag/v2.2.0)
- Revoked serial numbers in CRLs are encoded as positive INTEGERs. (2.1.0) — [release notes](https://github.com/PeculiarVentures/x509/releases/tag/v2.1.0)

## @peculiar/x509 1

### Behavior and default changes

- The minimum supported Node.js version was lowered from >=22.0.0 to >=20.0.0, allowing developers to use the package with Node.js 20 and newer. (1.14.3) — [release notes](https://github.com/PeculiarVentures/x509/releases/tag/v1.14.3)

### Fixes and other changes

- Fixes passing crypto. (1.14.2) — [release notes](https://github.com/PeculiarVentures/x509/releases/tag/v1.14.2)