# What changed in jsonpath-plus

> 3 changes in jsonpath-plus 10 from its official release notes, upgrade guides and advisories: 1 breaking, 1 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/jsonpath-plus/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## jsonpath-plus 10

### Breaking changes

- An explicit zero end in a slice no longer returns the whole array. (10.4.1) — [release notes](https://github.com/JSONPath-Plus/JSONPath/releases/tag/v10.4.1)

### Security

- Fixed an RCE vulnerability involving lookupGetter or lookupSetter. (10.4.0) — [release notes](https://github.com/JSONPath-Plus/JSONPath/releases/tag/v10.4.0)

### New APIs and options

- A void operator was added to JSONPath expressions. (10.4.0) — [release notes](https://github.com/JSONPath-Plus/JSONPath/releases/tag/v10.4.0)