# What changed in @toon-format/toon

> 23 changes in @toon-format/toon 2 to 4 from its official release notes, upgrade guides and advisories: 5 breaking, 1 security, 3 new APIs and options. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/npm/@toon-format/toon/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @toon-format/toon 4

### Breaking changes

- Normalizes sparse array holes to null during encoding. (4.4.0) — [release notes](https://github.com/toon-format/toon/releases/tag/v4.4.0)
- Decoding rejects a bare token line outside root primitive position. (4.1.0) — [release notes](https://github.com/toon-format/toon/releases/tag/v4.1.0)
- Encoding rejects unpaired surrogates and invalid delimiters. (4.1.0) — [release notes](https://github.com/toon-format/toon/releases/tag/v4.1.0)
- Decoding omits leaf fields that have no cell instead of yielding undefined. (4.1.0) — [release notes](https://github.com/toon-format/toon/releases/tag/v4.1.0)
- Ill-formed UTF-8 input now produces an error in strict mode. (4.1.0) — [release notes](https://github.com/toon-format/toon/releases/tag/v4.1.0)

### New APIs and options

- Adds support for spec v4.4. (4.4.0) — [release notes](https://github.com/toon-format/toon/releases/tag/v4.4.0)
- Adds an export for verbatim replacer output. (4.1.0) — [release notes](https://github.com/toon-format/toon/releases/tag/v4.1.0)
- Adds a marker for verbatim replacer output. (4.1.0) — [release notes](https://github.com/toon-format/toon/releases/tag/v4.1.0)

### Fixes and other changes

- Keeps usage output off stdout. (4.4.0) — [release notes](https://github.com/toon-format/toon/releases/tag/v4.4.0)
- Fixes three decoder cases that diverged from the spec. (4.4.0) — [release notes](https://github.com/toon-format/toon/releases/tag/v4.4.0)
- Updates the decoder to follow spec 4.2 rules. (4.4.0) — [release notes](https://github.com/toon-format/toon/releases/tag/v4.4.0)
- When decoding with --no-strict, keeps the last duplicate key. (4.4.0) — [release notes](https://github.com/toon-format/toon/releases/tag/v4.4.0)
- Quotes a root string that starts with U+FEFF. (4.4.0) — [release notes](https://github.com/toon-format/toon/releases/tag/v4.4.0)
- Fixes how short option values are split. (4.4.0) — [release notes](https://github.com/toon-format/toon/releases/tag/v4.4.0)
- CLI diagnostics are written to stderr so stdout contains results only. (4.1.1) — [release notes](https://github.com/toon-format/toon/releases/tag/v4.1.1)
- File output now terminates its last line with a newline. (4.1.1) — [release notes](https://github.com/toon-format/toon/releases/tag/v4.1.1)
- A raw string with a comment marker following a byte-order mark is rejected. (4.1.1) — [release notes](https://github.com/toon-format/toon/releases/tag/v4.1.1)
- A tab-indented hash line is treated as content rather than a comment. (4.1.1) — [release notes](https://github.com/toon-format/toon/releases/tag/v4.1.1)
- Decoding no longer truncates at a declared `[N]`. (4.1.0) — [release notes](https://github.com/toon-format/toon/releases/tag/v4.1.0)
- Decoding strips a byte-order mark and trailing spaces. (4.1.0) — [release notes](https://github.com/toon-format/toon/releases/tag/v4.1.0)
- Accepts the `indentSize` option named by the spec. (4.1.0) — [release notes](https://github.com/toon-format/toon/releases/tag/v4.1.0)
- A quoted colon is kept inside an unquoted key during decoding. (4.1.0) — [release notes](https://github.com/toon-format/toon/releases/tag/v4.1.0)

## @toon-format/toon 2

### Security

- TOON: Prototype pollution when decoding untrusted TOON input (2.3.1) — [security advisory](https://github.com/advisories/GHSA-P95V-992W-H6C3)