# What changed in content-disposition

> 15 changes in content-disposition 2 to 3 from its official release notes, upgrade guides and advisories: 8 breaking, 3 new APIs and options. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/npm/content-disposition/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## content-disposition 3

### Breaking changes

- The package is now ESM only, which affects how developers load it. (3.0.0) — [release notes](https://github.com/jshttp/content-disposition/releases/tag/v3.0.0)
- With extended format, param* is used instead of param when both are included and encoding would otherwise occur; extended: false is unchanged. (3.0.0) — [release notes](https://github.com/jshttp/content-disposition/releases/tag/v3.0.0)
- Invalid percent-encoding in ISO-8859-1 ext-value is now rejected. (3.0.0) — [release notes](https://github.com/jshttp/content-disposition/releases/tag/v3.0.0)

## content-disposition 2

### Breaking changes

- Use the named create export instead of the default export. (2.0.0) — [release notes](https://github.com/jshttp/content-disposition/releases/tag/v2.0.0)
- create no longer applies basename; pass a filename rather than a full path to avoid exposing directory structure. (2.0.0) — [release notes](https://github.com/jshttp/content-disposition/releases/tag/v2.0.0)
- The filename passed to create is now ASCII only. (2.0.0) — [release notes](https://github.com/jshttp/content-disposition/releases/tag/v2.0.0)
- The decoder no longer falls back; invalid UTF-8 is no longer supported. (2.0.0) — [release notes](https://github.com/jshttp/content-disposition/releases/tag/v2.0.0)
- The default export was removed; use the named create export instead. (2.0.0) — [release notes](https://github.com/jshttp/content-disposition/releases/tag/v2.0.0)

### New APIs and options

- format is now exposed as a method for formatting content-disposition values. (2.0.0) — [release notes](https://github.com/jshttp/content-disposition/releases/tag/v2.0.0)
- Extended parsing can now be disabled. (2.0.0) — [release notes](https://github.com/jshttp/content-disposition/releases/tag/v2.0.0)
- The multipart option parses headers within multipart/form-data appropriately, with HTML multipart behavior compatibility. (2.0.0) — [release notes](https://github.com/jshttp/content-disposition/releases/tag/v2.0.0)

### Performance

- The parser was refactored to be 3x faster. (2.0.0) — [release notes](https://github.com/jshttp/content-disposition/releases/tag/v2.0.0)

### Behavior and default changes

- The parser is more lenient and now parses unicode. (2.0.0) — [release notes](https://github.com/jshttp/content-disposition/releases/tag/v2.0.0)

### Fixes and other changes

- Allows empty parameter values in quoted text. (2.0.1) — [release notes](https://github.com/jshttp/content-disposition/releases/tag/v2.0.1)
- Uses the first extended parameter when multiple extended parameters are present. (2.0.1) — [release notes](https://github.com/jshttp/content-disposition/releases/tag/v2.0.1)