npm / @toon-format/toon
@toon-format/toon
What changed in @toon-format/toon 2 to 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-19.
5 breaking1 security3 new APIs and options14 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@toon-format/toon 422 changes
Breaking changes 5
Normalizes sparse array holes to null during encoding.
Decoding rejects a bare token line outside root primitive position.
Encoding rejects unpaired surrogates and invalid delimiters.
Decoding omits leaf fields that have no cell instead of yielding undefined.
Ill-formed UTF-8 input now produces an error in strict mode.
New APIs and options 3
Adds support for spec v4.4.
Adds an export for verbatim replacer output.
Adds a marker for verbatim replacer output.
Fixes and other changes 14
Keeps usage output off stdout.
Fixes three decoder cases that diverged from the spec.
Updates the decoder to follow spec 4.2 rules.
When decoding with --no-strict, keeps the last duplicate key.
Quotes a root string that starts with U+FEFF.
Fixes how short option values are split.
CLI diagnostics are written to stderr so stdout contains results only.
File output now terminates its last line with a newline.
A raw string with a comment marker following a byte-order mark is rejected.
A tab-indented hash line is treated as content rather than a comment.
Decoding no longer truncates at a declared
[N].Decoding strips a byte-order mark and trailing spaces.
Accepts the
indentSizeoption named by the spec.A quoted colon is kept inside an unquoted key during decoding.
@toon-format/toon 21 changes
Security 1
TOON: Prototype pollution when decoding untrusted TOON input