# What changed in yargs

> 8 changes in yargs 16 to 18 from its official release notes, upgrade guides and advisories: 1 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/yargs/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## yargs 18

### Security

- Fixes a local prototype pollution vulnerability in apply-extends. (18.1.0) — [release notes](https://github.com/yargs/yargs/releases/tag/v18.1.0)

### New APIs and options

- Completions can now be created for the fish shell. (18.2.0) — [release notes](https://github.com/yargs/yargs/releases/tag/v18.2.0)

### Behavior and default changes

- Bun is ignored when yargs determines the bin name. (18.1.0) — [release notes](https://github.com/yargs/yargs/releases/tag/v18.1.0)

### Fixes and other changes

- Removes a spurious single quote from zsh loadautofunc detection. (18.2.0) — [release notes](https://github.com/yargs/yargs/releases/tag/v18.2.0)
- Fixes the 'count' translation for the de locale. (18.1.0) — [release notes](https://github.com/yargs/yargs/releases/tag/v18.1.0)
- Adds a Georgian translation. (18.1.0) — [release notes](https://github.com/yargs/yargs/releases/tag/v18.1.0)

## yargs 17

### Fixes and other changes

- Uses an entry point with a file extension for targets that support exports. (17.7.3) — [release notes](https://github.com/yargs/yargs/releases/tag/v17.7.3)

## yargs 16

### Fixes and other changes

- The yargs export now uses an entry point with a .cjs file extension. (16.2.2) — [release notes](https://github.com/yargs/yargs/releases/tag/v16.2.2)