# What changed in convict

> 9 changes in convict 5 to 6 from its official release notes, upgrade guides and advisories: 2 breaking, 6 security. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/convict/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## convict 6

### Security

- Convict has prototype pollution via load(), loadFile(), and schema initialization (6.2.5) — [security advisory](https://github.com/advisories/GHSA-HF2R-9GF9-RWCH)
- Convict has Prototype Pollution via startsWith() function (6.2.5) — [security advisory](https://github.com/advisories/GHSA-44FC-8FM5-Q62H)
- Prevents prototype pollution via load(). (6.2.5) — [release notes](https://github.com/mozilla/node-convict/blob/ba7693f368e10f596397dc676263a578f910a2a9/CHANGELOG.md#625-2026-03-19)
- Prevents prototype pollution via loadFile(). (6.2.5) — [release notes](https://github.com/mozilla/node-convict/blob/ba7693f368e10f596397dc676263a578f910a2a9/CHANGELOG.md#625-2026-03-19)
- Prevents prototype pollution via schema initialization. (6.2.5) — [release notes](https://github.com/mozilla/node-convict/blob/ba7693f368e10f596397dc676263a578f910a2a9/CHANGELOG.md#625-2026-03-19)
- Prevents a prototype pollution bypass involving an override of String.prototype.startsWith. (6.2.5) — [release notes](https://github.com/mozilla/node-convict/blob/ba7693f368e10f596397dc676263a578f910a2a9/CHANGELOG.md#625-2026-03-19)

### Fixes and other changes

- Output now uses quotes consistently. (6.2.5) — [release notes](https://github.com/mozilla/node-convict/blob/ba7693f368e10f596397dc676263a578f910a2a9/CHANGELOG.md#625-2026-03-19)

## convict 5

### Breaking changes

- Node.js versions below 6 are no longer supported due to dependency requirements. (5.0.0) — [release notes](https://github.com/mozilla/node-convict/blob/HEAD/CHANGELOG.md)
- The long-deprecated strict option was dropped and replaced by the allowed option. (5.0.0) — [release notes](https://github.com/mozilla/node-convict/blob/HEAD/CHANGELOG.md)