# What changed in multiformats

> 19 changes in multiformats 10 to 14 from its official release notes, upgrade guides and advisories: 9 breaking, 1 security, 3 new APIs and options. Each one cited. Sources checked 2026-10-26. HTML: https://unstale.sh/npm/multiformats/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## multiformats 14

### Breaking changes

- Varint decoding now rejects non-minimally encoded varints. (14.0.5) — [release notes](https://github.com/multiformats/js-multiformats/releases/tag/v14.0.5)
- Identity bytes are constrained to single characters. (14.0.3) — [release notes](https://github.com/multiformats/js-multiformats/releases/tag/v14.0.3)
- All Hasher types are now MultihashHasher<Code> types, changing the types developers use for hashers. (14.0.0) — [release notes](https://github.com/multiformats/js-multiformats/releases/tag/v14.0.0)
- The identity hash is now typed as SyncMultihashHasher<0>. (14.0.0) — [release notes](https://github.com/multiformats/js-multiformats/releases/tag/v14.0.0)

### Security

- Verifies the CID hash before decoding in Block.create. (14.0.2) — [release notes](https://github.com/multiformats/js-multiformats/releases/tag/v14.0.2)

### New APIs and options

- ByteView can now specify its backing type. (14.0.4) — [release notes](https://github.com/multiformats/js-multiformats/releases/tag/v14.0.4)
- Loading via require is now supported. (14.0.0) — [release notes](https://github.com/multiformats/js-multiformats/releases/tag/v14.0.0)

### Fixes and other changes

- Decoding for base16, base32, and base36 is case-insensitive, matching the multibase specification. (14.0.1) — [release notes](https://github.com/multiformats/js-multiformats/releases/tag/v14.0.1)
- Returned Uint8Arrays are now typed as Uint8Array<ArrayBuffer>. (14.0.0) — [release notes](https://github.com/multiformats/js-multiformats/releases/tag/v14.0.0)

## multiformats 12

### Breaking changes

- The package uses an ESM-only build, affecting how developers consume it. (10.0.0, 12.0.0) — [release notes](https://github.com/multiformats/js-multiformats/releases/tag/v10.0.0), [release notes](https://github.com/multiformats/js-multiformats/releases/tag/v12.0.0)

## multiformats 11

### Breaking changes

- link.toJSON now returns a DAG-JSON link, changing its serialized output. (11.0.0) — [release notes](https://github.com/multiformats/js-multiformats/releases/tag/v11.0.0)

### Fixes and other changes

- Fixed the browser bundle. (11.0.0) — [release notes](https://github.com/multiformats/js-multiformats/releases/tag/v11.0.0)
- Fixed listing links of a block that is itself a CID. (11.0.0) — [release notes](https://github.com/multiformats/js-multiformats/releases/tag/v11.0.0)

## multiformats 10

### Breaking changes

- A browser field is added to package metadata for browser consumers. (10.0.0) — [release notes](https://github.com/multiformats/js-multiformats/releases/tag/v10.0.0)
- Deprecated CID properties and methods are removed, so code using them must be updated. (10.0.0) — [release notes](https://github.com/multiformats/js-multiformats/releases/tag/v10.0.0)
- The package main field is removed, changing the package entry-point metadata developers or tools may rely on. (10.0.0) — [release notes](https://github.com/multiformats/js-multiformats/releases/tag/v10.0.0)

### New APIs and options

- A Link interface is defined for CID, giving developers a type for links. (10.0.0) — [release notes](https://github.com/multiformats/js-multiformats/releases/tag/v10.0.0)

### Fixes and other changes

- asCID is made a regular, non-enumerable property instead of relying on Object.defineProperties. (10.0.0) — [release notes](https://github.com/multiformats/js-multiformats/releases/tag/v10.0.0)
- Types are distributed in dist/types and properly exported, improving access to the package's types. (10.0.0) — [release notes](https://github.com/multiformats/js-multiformats/releases/tag/v10.0.0)