npm / file-type

file-type

What changed in file-type 21 to 22, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.

11 breaking4 security10 new APIs and options1 tooling7 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

file-type 2220 changes

Use this type in place of the removed ReadableStreamWithFileType type.
22.0.0release notes
The MIME type for lz files is now application/lzip instead of application/x-lzip.
22.0.0release notes
Apple Alias now uses application/x-ft-apple.alias instead of application/x.apple.alias.
22.0.0release notes
Draco files now use application/x-ft-draco instead of application/vnd.google.draco.
22.0.0release notes
fbx files now use application/x-ft-fbx instead of application/x.autodesk.fbx.
22.0.0release notes
The MIME type for lnk files is now application/x-ms-shortcut instead of application/x.ms.shortcut.
22.0.0release notes
Sub-exports have been removed; import everything directly from file-type.
22.0.0release notes
Now accepts only a web ReadableStream; convert Node.js streams with Readable.toWeb().
22.0.0release notes
Now accepts only a web ReadableStream; convert Node.js streams with Readable.toWeb().
22.0.0release notes
Node.js 22 is now required to use file-type.
22.0.0release notes
This type has been removed; use AnyWebReadableByteStreamWithFileType instead.
22.0.0release notes

Adds support for detecting Core Audio Format (CAF) files.
22.2.0release notes
Adds support for detecting DSDIFF files.
22.2.0release notes
File-type detection now supports ISO 9660 files.
22.1.0release notes
Detection now supports Apple iWork files: Keynote, Pages, and Numbers.
22.0.0release notes

Warnings for the intentional runtime import are suppressed in Vite and webpack builds.
22.1.0release notes

Fixes UTF-16 LE text being detected as MPEG audio.
22.0.2release notes
Fixes ZIP detection on Node.js 24 for entries with a data descriptor.
22.0.2release notes
Works around esbuild resolving Node-only imports, helping developers bundle file-type with esbuild.
22.0.1release notes
Streamed OOXML files are no longer detected as zip.
22.0.0release notes release notes

The parser was hardened; the notes do not specify further details.
21.3.3release notes release notes
file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry
21.3.2security advisory
Fixes a ZIP bomb vulnerability in known-size ZIP probing.
21.3.2release notes security advisory
file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header
21.3.1security advisory release notes

Adds support for Mach-O Universal (Fat) binaries and additional architectures.
21.3.0release notes
Adds support for detecting JMP files.
21.2.0release notes
Adds support for detecting SPSS data files.
21.2.0release notes
Adds support for detecting Windows registry hive files.
21.1.0release notes
Adds support for detecting Windows registry files.
21.1.0release notes
Adds support for detecting gunzipped tarball files.
21.1.0release notes