file-type
22.2.0 · 14 Oct 2026MIT51.4M / weekRepositoryHomepagenpmAtom feed
Upgrading file-type from 14.1.1 to 22.2.0
76 releases in betweennotes for 58
Counted from 58 of 76 release notes. Advisories are counted from the advisory database, in full.
Before you upgrade
Tick each one off as you go- breaking22.0.0
- breaking22.0.0
- breaking22.0.0
- breaking22.0.0
- breaking22.0.0
- breaking21.0.0
- breaking21.0.0
- breaking21.0.0
- breaking21.0.0
- breaking21.0.0
Security
Fixes 2 advisories affecting 14.1.1
- file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-headermoderate · GHSA-5v7r-6r5c-r473
- file-type vulnerable to Infinite Loop via malformed MKV filehigh · GHSA-mhxj-85r3-2x55
- 21.3.2
Fix ZIP bomb in known-size ZIP probing (GHSA-j47w-4g3g-c36v) a155cd7
- 21.3.1
Fix infinite loop in ASF parser on malformed input (github.com/sindresorhus/file-type/security/advi…) 319abf8
Release by release
- new
Add support for Core Audio Format (CAF) (#805) bde605a
- new
Add support for DSDIFF (#804) e49d5b7
- new
- fixed
Fix streamed OOXML files being detected as zip (#801) 1347414
- fixed
- new
Add support for ISO 9660 (.iso) (#796) a675457
- new
- fixed
Fix ZIP detection on Node.js 24 for entries with a data descriptor f24af84
- fixed
Fix UTF-16 LE text being detected as MPEG audio c891929
- fixed
- fixed
Work around esbuild resolving Node-only imports ce4262f
- fixed
- new
Added detection for Apple iWork files:
.key(Keynote),.pages(Pages),.numbers(Numbers) - fixed
Fixed LibreOffice OOXML files being incorrectly detected as ZIP when reading from streams
- new
21.3.3 – 21.3.42 releases, nothing new or fixed in the notes
- fixed
Fix bound recursive BOM and ID3 detection 370ed91
- fixed
9 other lines we could not sort, mostly version bumps
- 22.1.0
Suppress Vite and webpack warnings for the intentional runtime import 2da7522
- 21.3.4
Harden parser more aec20a0
- 21.3.3
Harden parser c48c90b 135f91b
- 20.1.0
Improve WebP detection (#733) ef486f1
- 19.1.0
Replace Buffer usage with Uint8Array (#633) 00e051bceaf0791ffc1b08b36aee196ccdd95606
- 19.1.0
Please note that fileTypeFromBlob(blob) is streaming the Blob instead of buffering, which require at least Node.js ≥ 20.
- 16.5.0
Remove ASAR 240 bytes of JSON payload length limitation (#453) 07101ac
- 16.5.0
Remove an unnecessary dependency (#458) 3df0ed1
- 16.2.0
Improve PDF / AI (Adobe Illustrator) recognition (#396) 9736aa3
2 internal lines (docs, tests, tooling) left out.