# What changed in file-type

> 33 changes in file-type 21 to 22 from its official release notes, upgrade guides and advisories: 11 breaking, 4 security, 10 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/file-type/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## file-type 22

### Breaking changes

- Use this type in place of the removed ReadableStreamWithFileType type. (22.0.0) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v22.0.0)
- The MIME type for lz files is now application/lzip instead of application/x-lzip. (22.0.0) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v22.0.0)
- Apple Alias now uses application/x-ft-apple.alias instead of application/x.apple.alias. (22.0.0) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v22.0.0)
- Draco files now use application/x-ft-draco instead of application/vnd.google.draco. (22.0.0) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v22.0.0)
- fbx files now use application/x-ft-fbx instead of application/x.autodesk.fbx. (22.0.0) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v22.0.0)
- The MIME type for lnk files is now application/x-ms-shortcut instead of application/x.ms.shortcut. (22.0.0) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v22.0.0)
- Sub-exports have been removed; import everything directly from file-type. (22.0.0) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v22.0.0)
- Now accepts only a web ReadableStream; convert Node.js streams with Readable.toWeb(). (22.0.0) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v22.0.0)
- Now accepts only a web ReadableStream; convert Node.js streams with Readable.toWeb(). (22.0.0) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v22.0.0)
- Node.js 22 is now required to use file-type. (22.0.0) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v22.0.0)
- This type has been removed; use AnyWebReadableByteStreamWithFileType instead. (22.0.0) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v22.0.0)

### New APIs and options

- Adds support for detecting Core Audio Format (CAF) files. (22.2.0) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v22.2.0)
- Adds support for detecting DSDIFF files. (22.2.0) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v22.2.0)
- File-type detection now supports ISO 9660 files. (22.1.0) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v22.1.0)
- Detection now supports Apple iWork files: Keynote, Pages, and Numbers. (22.0.0) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v22.0.0)

### Tooling

- Warnings for the intentional runtime import are suppressed in Vite and webpack builds. (22.1.0) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v22.1.0)

### Fixes and other changes

- Fixes UTF-16 LE text being detected as MPEG audio. (22.0.2) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v22.0.2)
- Fixes ZIP detection on Node.js 24 for entries with a data descriptor. (22.0.2) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v22.0.2)
- Works around esbuild resolving Node-only imports, helping developers bundle file-type with esbuild. (22.0.1) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v22.0.1)
- Streamed OOXML files are no longer detected as zip. (22.0.0) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v22.1.1), [release notes](https://github.com/sindresorhus/file-type/releases/tag/v22.0.0)

## file-type 21

### Security

- The parser was hardened; the notes do not specify further details. (21.3.3) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v21.3.4), [release notes](https://github.com/sindresorhus/file-type/releases/tag/v21.3.3)
- file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry (21.3.2) — [security advisory](https://github.com/advisories/GHSA-J47W-4G3G-C36V)
- Fixes a ZIP bomb vulnerability in known-size ZIP probing. (21.3.2) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v21.3.2), [security advisory](https://github.com/advisories/GHSA-J47W-4G3G-C36V)
- file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header (21.3.1) — [security advisory](https://github.com/advisories/GHSA-5V7R-6R5C-R473), [release notes](https://github.com/sindresorhus/file-type/releases/tag/v21.3.1)

### New APIs and options

- Adds support for Mach-O Universal (Fat) binaries and additional architectures. (21.3.0) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v21.3.0)
- Adds support for detecting JMP files. (21.2.0) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v21.2.0)
- Adds support for detecting SPSS data files. (21.2.0) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v21.2.0)
- Adds support for detecting Windows registry hive files. (21.1.0) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v21.1.0)
- Adds support for detecting Windows registry files. (21.1.0) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v21.1.0)
- Adds support for detecting gunzipped tarball files. (21.1.0) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v21.1.0)

### Fixes and other changes

- Fixes bound recursive BOM and ID3 detection. (21.3.2) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v21.3.2)
- Fixes handling of partial Gunzip files. (21.1.1) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v21.1.1)
- Fixes handling of partial unzip. (21.1.0) — [release notes](https://github.com/sindresorhus/file-type/releases/tag/v21.1.0)