# What changed in cac

> 10 changes in cac 7 from its official release notes, upgrade guides and advisories: 4 breaking, 1 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/npm/cac/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## cac 7

### Breaking changes

- The CJS build is removed; CAC is ESM-only. Migrate to ESM imports or use Node.js ≥ 20.19.0 for native require() support for ES modules. (7.0.0) — [release notes](https://github.com/cacjs/cac/releases/tag/v7.0.0)
- Event listener methods were renamed to follow the EventTarget API; use cli.addEventListener() instead of cli.on(). (7.0.0) — [release notes](https://github.com/cacjs/cac/releases/tag/v7.0.0)
- Node.js 20.19.0 is now the minimum required version; earlier versions are no longer supported. (7.0.0) — [release notes](https://github.com/cacjs/cac/releases/tag/v7.0.0)
- CAC throws an error when arguments are unused. (7.0.0) — [release notes](https://github.com/cacjs/cac/releases/tag/v7.0.0)

### Security

- Prevents prototype pollution via dotted option names when parsing command-line options. (7.0.1) — [release notes](https://github.com/cacjs/cac/releases/tag/v7.0.1)

### New APIs and options

- A JSR package is available for Deno users. (7.0.0) — [release notes](https://github.com/cacjs/cac/releases/tag/v7.0.0)

### Behavior and default changes

- CAC now supports use in browsers. (7.0.0) — [release notes](https://github.com/cacjs/cac/releases/tag/v7.0.0)

### Fixes and other changes

- An omitted array option remains absent instead of being added to the parsed result. (7.1.0) — [release notes](https://github.com/cacjs/cac/releases/tag/v7.1.0)
- cac reads process.argv lazily. (7.1.0) — [release notes](https://github.com/cacjs/cac/releases/tag/v7.1.0)
- A bug in checking default commands was fixed. (7.0.0) — [release notes](https://github.com/cacjs/cac/releases/tag/v7.0.0)