# What changed in express-rate-limit

> 28 changes in express-rate-limit 6 to 7 from its official release notes, upgrade guides and advisories: 14 breaking, 2 deprecations, 3 new APIs and options. Each one cited. Sources checked 2026-10-29. HTML: https://unstale.sh/npm/express-rate-limit/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## express-rate-limit 7

### Breaking changes

- The deprecated option was removed; use standardHeaders: 'draft-6' instead. (7.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v7.0.0)
- Setting max to 0 now blocks all requests instead of allowing them through; use skip to replicate the old behavior. (7.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v7.0.0)
- The minimum required Node version changed from v14 to v16. (7.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v7.0.0)
- The deprecated option was removed; a custom handler option can replicate its behavior. (7.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v7.0.0)
- Renames req.rateLimit.current to req.rateLimit.used; current remains as a hidden getter but is omitted from key iteration and JSON.stringify(). (7.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v7.0.0)

### Deprecations

- The limit configuration option is now preferred over max, though max remains supported and behavior is unchanged. (7.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v7.0.0)

### New APIs and options

- The validate config option can now be an object with keys to enable or disable specific validation checks. (7.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v7.0.0)

### Behavior and default changes

- MemoryStore now uses precise, per-user reset times instead of a global window that resets all users at once. (7.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v7.0.0)

## express-rate-limit 6

### Breaking changes

- The deprecated option is removed; delay functionality moved to express-slow-down. (6.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v6.0.0)
- The deprecated option is removed; delay functionality moved to express-slow-down. (6.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v6.0.0)
- express 4.x is now a peer dependency. (6.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v6.0.0)
- The deprecated option is removed; use a key generator that returns a constant value. (6.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v6.0.0)
- The custom store method incr is renamed to increment. (6.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v6.0.0)
- Renames the headers option to legacyHeaders. (6.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v6.0.0)
- The deprecated method is removed; use limiter.resetKey instead. (6.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v6.0.0)
- The package now requires NodeJS version 12.9.0 or greater. (6.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v6.0.0)
- Renames the draft_polli_ratelimit_headers option to standardHeaders. (6.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v6.0.0)

### Deprecations

- The configuration option is deprecated; replace it with a custom handler that checks the number of hits. (6.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v6.0.0)

### New APIs and options

- The package is exported as both ESM and CJS. (6.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v6.0.0)
- Custom stores can implement init to set themselves up using options passed to the middleware. (6.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v6.0.0)

### Behavior and default changes

- Old stores are automatically promisified and used. (6.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v6.0.0)
- Custom store decrement can now return a promise. (6.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v6.0.0)
- Custom store increment can now return a promise. (6.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v6.0.0)
- keyGenerator can now be an async function or return a promise. (6.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v6.0.0)
- Custom store resetAll can now return a promise. (6.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v6.0.0)
- Custom store resetKey can now return a promise. (6.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v6.0.0)
- The header is now sent if either legacyHeaders or standardHeaders is set. (6.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v6.0.0)

### Tooling

- Typescript support is improved; the library was rewritten in Typescript. (6.0.0) — [release notes](https://github.com/express-rate-limit/express-rate-limit/releases/tag/v6.0.0)