npm / multiformats
multiformats
What changed in multiformats 10 to 14, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-26.
9 breaking1 security3 new APIs and options6 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initmultiformats 149 changes
Breaking changes 4
Varint decoding now rejects non-minimally encoded varints.
Identity bytes are constrained to single characters.
All Hasher types are now MultihashHasher<Code> types, changing the types developers use for hashers.
The identity hash is now typed as SyncMultihashHasher<0>.
Security 1
Verifies the CID hash before decoding in Block.create.
New APIs and options 2
ByteView can now specify its backing type.
Loading via require is now supported.
Fixes and other changes 2
Decoding for base16, base32, and base36 is case-insensitive, matching the multibase specification.
Returned Uint8Arrays are now typed as Uint8Array<ArrayBuffer>.
multiformats 121 changes
Breaking changes 1
The package uses an ESM-only build, affecting how developers consume it.
multiformats 113 changes
Breaking changes 1
link.toJSON now returns a DAG-JSON link, changing its serialized output.
Fixes and other changes 2
Fixed the browser bundle.
Fixed listing links of a block that is itself a CID.
multiformats 106 changes
Breaking changes 3
A browser field is added to package metadata for browser consumers.
Deprecated CID properties and methods are removed, so code using them must be updated.
The package main field is removed, changing the package entry-point metadata developers or tools may rely on.
New APIs and options 1
A Link interface is defined for CID, giving developers a type for links.
Fixes and other changes 2
asCID is made a regular, non-enumerable property instead of relying on Object.defineProperties.
Types are distributed in dist/types and properly exported, improving access to the package's types.