npm / convict

convict

What changed in convict 5 to 6, from its official release notes, upgrade guides and advisories. Also covers @types/convict. Sources checked 2026-10-27.

2 breaking6 security1 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.8 on npm

convict 67 changes

Security 6

Convict has prototype pollution via load(), loadFile(), and schema initialization
6.2.5security advisory
Convict has Prototype Pollution via startsWith() function
6.2.5security advisory
Prevents prototype pollution via load().
6.2.5release notes
Prevents prototype pollution via loadFile().
6.2.5release notes
Prevents prototype pollution via schema initialization.
6.2.5release notes
Prevents a prototype pollution bypass involving an override of String.prototype.startsWith.
6.2.5release notes

Fixes and other changes 1

Output now uses quotes consistently.
6.2.5release notes

convict 52 changes

Breaking changes 2

Node.js versions below 6 are no longer supported due to dependency requirements.
5.0.0release notes
The long-deprecated strict option was dropped and replaced by the allowed option.
5.0.0release notes