# What changed in csv-parse

> 16 changes in csv-parse 6 to 7 from its official release notes, upgrade guides and advisories: 1 breaking, 2 security, 3 new APIs and options. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/npm/csv-parse/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## csv-parse 7

### Breaking changes

- Trim behavior now aligns with ECMAScript whitespace. (7.0.0) — [release notes](https://github.com/adaltas/node-csv/blob/594c6469c4a7376c1048d13c47859c2f91674206/packages/csv-parse/CHANGELOG.md#700-2026-06-14)

### Security

- Fixes prototype replacement reachable through the columns option. (7.0.2) — [release notes](https://github.com/adaltas/node-csv/blob/594c6469c4a7376c1048d13c47859c2f91674206/packages/csv-parse/CHANGELOG.md#702-2026-08-02), [security advisory](https://github.com/advisories/GHSA-8CW4-87C7-C6XX)

### New APIs and options

- CsvError is now exported. (7.0.0) — [release notes](https://github.com/adaltas/node-csv/blob/594c6469c4a7376c1048d13c47859c2f91674206/packages/csv-parse/CHANGELOG.md#700-2026-06-14)
- Delimiter discovery was added to csv-parse. (7.0.0) — [release notes](https://github.com/adaltas/node-csv/blob/594c6469c4a7376c1048d13c47859c2f91674206/packages/csv-parse/CHANGELOG.md#700-2026-06-14)
- normalize_options is now exported. (7.0.0) — [release notes](https://github.com/adaltas/node-csv/blob/594c6469c4a7376c1048d13c47859c2f91674206/packages/csv-parse/CHANGELOG.md#700-2026-06-14)

### Behavior and default changes

- Delimiter splitting is disabled when the delimiter is an empty array. (7.0.0) — [release notes](https://github.com/adaltas/node-csv/blob/594c6469c4a7376c1048d13c47859c2f91674206/packages/csv-parse/CHANGELOG.md#700-2026-06-14)

### Fixes and other changes

- Preserves typed column keys. (7.0.3) — [release notes](https://github.com/adaltas/node-csv/blob/594c6469c4a7376c1048d13c47859c2f91674206/packages/csv-parse/CHANGELOG.md#703-2026-09-25)
- Types the score callback arguments. (7.0.3) — [release notes](https://github.com/adaltas/node-csv/blob/594c6469c4a7376c1048d13c47859c2f91674206/packages/csv-parse/CHANGELOG.md#703-2026-09-25)
- A CommonJS export is now shipped for the stream entry point. (7.0.1) — [release notes](https://github.com/adaltas/node-csv/blob/594c6469c4a7376c1048d13c47859c2f91674206/packages/csv-parse/CHANGELOG.md#701-2026-07-02)
- Sync parsing no longer modifies the prototype. (7.0.0) — [release notes](https://github.com/adaltas/node-csv/blob/594c6469c4a7376c1048d13c47859c2f91674206/packages/csv-parse/CHANGELOG.md#700-2026-06-14)

## csv-parse 6

### Security

- Fixes prototype pollution associated with the objname option. (6.2.1) — [release notes](https://github.com/adaltas/node-csv/blob/594c6469c4a7376c1048d13c47859c2f91674206/packages/csv-parse/CHANGELOG.md#621-2026-03-20)

### Fixes and other changes

- Support is added for number columns with cast. (6.2.0) — [release notes](https://github.com/adaltas/node-csv/blob/594c6469c4a7376c1048d13c47859c2f91674206/packages/csv-parse/CHANGELOG.md#620-2026-03-17)
- The inherited type for delimiter is fixed. (6.2.0) — [release notes](https://github.com/adaltas/node-csv/blob/594c6469c4a7376c1048d13c47859c2f91674206/packages/csv-parse/CHANGELOG.md#620-2026-03-17)
- The error type no longer uses TypeScript all. (6.2.0) — [release notes](https://github.com/adaltas/node-csv/blob/594c6469c4a7376c1048d13c47859c2f91674206/packages/csv-parse/CHANGELOG.md#620-2026-03-17)
- TypeScript info interfaces are aligned with the JavaScript API. (6.2.0) — [release notes](https://github.com/adaltas/node-csv/blob/594c6469c4a7376c1048d13c47859c2f91674206/packages/csv-parse/CHANGELOG.md#620-2026-03-17)
- A declaration for a nonexistent TypeScript function is removed. (6.2.0) — [release notes](https://github.com/adaltas/node-csv/blob/594c6469c4a7376c1048d13c47859c2f91674206/packages/csv-parse/CHANGELOG.md#620-2026-03-17)