# What changed in validator

> 21 changes in validator 13 from its official release notes, upgrade guides and advisories: 1 breaking, 3 security, 5 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/validator/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## validator 13

### Breaking changes

- Restricts accepted characters to the valid slug charset. (13.15.35) — [release notes](https://github.com/validatorjs/validator.js/releases/tag/13.15.35)

### Security

- Handles a possible bypass involving URL-encoded content. (13.15.26) — [release notes](https://github.com/validatorjs/validator.js/releases/tag/13.15.26)
- Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements (13.15.22) — [security advisory](https://github.com/advisories/GHSA-VGHF-HV5Q-VC2G)
- validator.js has a URL validation bypass vulnerability in its isURL function (13.15.20) — [security advisory](https://github.com/advisories/GHSA-9965-VMPH-33XX), [release notes](https://github.com/validatorjs/validator.js/releases/tag/13.15.20)

### New APIs and options

- Adds the fr-DJ locale for mobile phone validation. (13.15.35) — [release notes](https://github.com/validatorjs/validator.js/releases/tag/13.15.35)
- Adds the MC locale for postal code validation. (13.15.35) — [release notes](https://github.com/validatorjs/validator.js/releases/tag/13.15.35)
- Adds the require_hashtag option to isHexColor. (13.15.26) — [release notes](https://github.com/validatorjs/validator.js/releases/tag/13.15.26)
- Adds Indic locales ta-IN, te-IN, kn-IN, ml-IN, gu-IN, pa-IN, and or-IN. (13.15.20) — [release notes](https://github.com/validatorjs/validator.js/releases/tag/13.15.20)
- Adds the ar-QA locale for mobile phone validation. (13.15.20) — [release notes](https://github.com/validatorjs/validator.js/releases/tag/13.15.20)

### Behavior and default changes

- Adds support for Kosovo, so XK is recognized as a valid ISO 3166-1 alpha-2 country code. (13.15.35) — [release notes](https://github.com/validatorjs/validator.js/releases/tag/13.15.35)
- Adds support for Kosovo, so XXK is recognized as a valid ISO 3166-1 alpha-3 country code. (13.15.35) — [release notes](https://github.com/validatorjs/validator.js/releases/tag/13.15.35)
- Allows any valid JSON value to pass validation, not just JSON objects or arrays. (13.15.35) — [release notes](https://github.com/validatorjs/validator.js/releases/tag/13.15.35)
- The pt-BR locale now supports alphanumeric CNPJ formats and formatted CPF values. (13.15.35) — [release notes](https://github.com/validatorjs/validator.js/releases/tag/13.15.35)
- Adds Indic locales ta-IN, te-IN, kn-IN, ml-IN, gu-IN, pa-IN, and or-IN. (13.15.20) — [release notes](https://github.com/validatorjs/validator.js/releases/tag/13.15.20)

### Fixes and other changes

- Ignores non-object options, avoiding unexpected handling when options are not objects. (13.15.35) — [release notes](https://github.com/validatorjs/validator.js/releases/tag/13.15.35)
- Improves passport number validation for the MX locale. (13.15.35) — [release notes](https://github.com/validatorjs/validator.js/releases/tag/13.15.35)
- Improves validation for the IR locale. (13.15.26) — [release notes](https://github.com/validatorjs/validator.js/releases/tag/13.15.26)
- Improves handling of Unicode variation selectors. (13.15.22) — [release notes](https://github.com/validatorjs/validator.js/releases/tag/13.15.22)
- Fixes a regression when validating hostnames with ports. (13.15.22) — [release notes](https://github.com/validatorjs/validator.js/releases/tag/13.15.22)
- Improves the padding regex used for Base64 validation. (13.15.20) — [release notes](https://github.com/validatorjs/validator.js/releases/tag/13.15.20)
- Improves VAT validation for the FR locale. (13.15.20) — [release notes](https://github.com/validatorjs/validator.js/releases/tag/13.15.20)