npm / stripe
stripe
What changed in stripe 22 to 23, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-19.
12 breaking3 security22 new APIs and options3 behavior and defaults4 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initstripe 2340 changes
Breaking changes 12
The reason field changes from string to an enum.
Removes payment_method_types support from Checkout Session creation parameters and several PaymentIntent and SetupIntent parameter types.
The top-level ErrorType interface export is removed; use .errors, which works as both a type and a value.
Removes countries from Financial Connections.Session.filters and FinancialConnections.SessionCreateParams.filters.
Adds country to Financial Connections session creation filters; countries is removed from session filters and creation filters.
Node.js 18 is no longer supported; Node.js 20 is the minimum supported version.
Removes support for payto on PaymentMethodUpdateParams.
This mistakenly added function is removed; use stripe.webhooks.constructEventWithoutVerification(payload) for the same functionality.
The V1-only object, has_more, and url fields are removed from Stripe.V2List<T>; they were never populated.
Responses that stall or are severed before the body is complete now throw StripeConnectionError instead of StripeAPIError.
V2 request address properties now use operation-specific V2 interfaces instead of shared V1 address parameter types.
When tolerance is omitted, verifyHeader now uses Webhook.DEFAULT_TOLERANCE for timestamp verification.
New APIs and options 22
Adds the Apps.Install resource with create, list, retrieve, uninstall, and update methods.
Snapshot events are now supported for Apps.Install, including created, deleted, and updated events.
Adds allowed_payment_method_types to Checkout Session creation parameters and Checkout.Session.
The updated_capability enum now includes blik_recurring_payments, satispay_payments, and sequra_payments.
Adds pause support to subscription details when creating an invoice preview.
Adds payment_record to PaymentIntent.
Adds PayPay support across payment method data, payment method details and options, and payment method types.
Adds the ProductCatalog.TrialOffer resource with create, list, retrieve, and update methods.
Adds Sequra support across payment method data, payment method details and options, and payment method types.
Set this environment variable to true to suppress Stripe notices in test and sandbox environments when not running under a detected AI agent; notices remain enabled by default and for AI agents.
Error-code enums on the listed error-bearing fields now support four additional codes.
Adds the pause method to the Subscription resource.
Adds payment_behavior to SubscriptionResumeParams.
Adds pause_schedules to subscription schedule create and update parameters and the SubscriptionSchedule resource.
Adds the Tax.Location resource with create, list, and retrieve methods.
Adds requirements to TaxCode.
Adds the ThreeDSecure.Authentication resource with cancel, create, list, retrieve, and submit methods.
Merchant capabilities now support satispay_payments in account configuration, create parameters, and update parameters.
Capability status code enums now accept eight additional rejection reasons across account capability status details.
Requirement error code enums now accept two additional invalid-address reasons.
Capability restriction enums in current and future requirements now include blik_recurring_payments and satispay_payments.
V2.Core.Event now supports snapshot_event.
Behavior and default changes 3
The pinned API version changes to 2026-09-30.endive.
EventNotification now supports singleton related objects.
When tolerance is omitted, verifyHeaderAsync now uses Webhook.DEFAULT_TOLERANCE for timestamp verification.
Fixes and other changes 3
Callback clients now use the event's Stripe context and preserve client telemetry, fixing 400 errors when the StripeClient is configured with stripeAccount.
Requests no longer hang when NodeHttpClient is used with Nock 14 or MSW HTTP request interceptors.
Passing 0 now properly skips timestamp tolerance verification instead of applying the default tolerance.
stripe 224 changes
Security 3
Webhook secrets are validated as non-empty, so empty secrets are rejected.
Hardens API requestor code against malicious URLs.
Multipart file uploads use cryptographically secure boundaries.
Fixes and other changes 1
Fixes serialization of schema-coerced values, including Decimal, in GET and DELETE query parameters.