# What changed in cjs-module-lexer

> 6 changes in cjs-module-lexer 2 from its official release notes, upgrade guides and advisories: 1 security. Each one cited. Sources checked 2026-10-24. HTML: https://unstale.sh/npm/cjs-module-lexer/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## cjs-module-lexer 2

### Security

- Parser stack bounds are guarded. (2.3.0) — [release notes](https://github.com/nodejs/cjs-module-lexer/releases/tag/2.3.0)

### Performance

- Class checks are skipped for unrelated identifiers to improve performance. (2.3.0) — [release notes](https://github.com/nodejs/cjs-module-lexer/releases/tag/2.3.0)
- Identifier and number runs are skipped to improve performance. (2.3.0) — [release notes](https://github.com/nodejs/cjs-module-lexer/releases/tag/2.3.0)
- UTF-16 source copies are faster. (2.3.0) — [release notes](https://github.com/nodejs/cjs-module-lexer/releases/tag/2.3.0)

### Tooling

- lexer.d.mts is now published, making the type declarations available to package consumers. (2.2.1) — [release notes](https://github.com/nodejs/cjs-module-lexer/releases/tag/2.2.1)

### Fixes and other changes

- Wasm is initialized automatically before parsing, so callers no longer need to initialize it first. (2.3.0) — [release notes](https://github.com/nodejs/cjs-module-lexer/releases/tag/2.3.0)