npm / content-disposition
content-disposition
What changed in content-disposition 2 to 3, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-19.
8 breaking3 new APIs and options1 performance1 behavior and defaults2 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initcontent-disposition 33 changes
Breaking changes 3
The package is now ESM only, which affects how developers load it.
With extended format, param* is used instead of param when both are included and encoding would otherwise occur; extended: false is unchanged.
Invalid percent-encoding in ISO-8859-1 ext-value is now rejected.
content-disposition 212 changes
Breaking changes 5
Use the named create export instead of the default export.
create no longer applies basename; pass a filename rather than a full path to avoid exposing directory structure.
The filename passed to create is now ASCII only.
The decoder no longer falls back; invalid UTF-8 is no longer supported.
The default export was removed; use the named create export instead.
New APIs and options 3
format is now exposed as a method for formatting content-disposition values.
Extended parsing can now be disabled.
The multipart option parses headers within multipart/form-data appropriately, with HTML multipart behavior compatibility.
Performance 1
The parser was refactored to be 3x faster.
Behavior and default changes 1
The parser is more lenient and now parses unicode.
Fixes and other changes 2
Allows empty parameter values in quoted text.
Uses the first extended parameter when multiple extended parameters are present.