npm / cac
cac
What changed in cac 7, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-19.
4 breaking1 security1 new APIs and options1 behavior and defaults3 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initcac 710 changes
Breaking changes 4
The CJS build is removed; CAC is ESM-only. Migrate to ESM imports or use Node.js ≥ 20.19.0 for native require() support for ES modules.
Event listener methods were renamed to follow the EventTarget API; use cli.addEventListener() instead of cli.on().
Node.js 20.19.0 is now the minimum required version; earlier versions are no longer supported.
CAC throws an error when arguments are unused.
Security 1
Prevents prototype pollution via dotted option names when parsing command-line options.
New APIs and options 1
A JSR package is available for Deno users.
Behavior and default changes 1
CAC now supports use in browsers.
Fixes and other changes 3
An omitted array option remains absent instead of being added to the parsed result.
cac reads process.argv lazily.
A bug in checking default commands was fixed.