file-type
22.2.0 · 14 Oct 2026MIT51.4M / weekRepositoryHomepagenpmAtom feed
Upgrading file-type from 14.6.1 to 22.2.0
67 releases in betweennotes for 65
Counted from 65 of 67 release notes. Advisories are counted from the advisory database, in full.
Before you upgrade
Tick each one off as you go- breaking22.0.0
- breaking22.0.0
- breaking22.0.0
- breaking22.0.0
- breaking22.0.0
- breaking21.0.0
- breaking21.0.0
- breaking21.0.0
- breaking21.0.0
- breaking21.0.0
Security
Fixes 2 advisories affecting 14.6.1
- file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-headermoderate · GHSA-5v7r-6r5c-r473
- file-type vulnerable to Infinite Loop via malformed MKV filehigh · GHSA-mhxj-85r3-2x55
- 21.3.2
Fix ZIP bomb in known-size ZIP probing (GHSA-j47w-4g3g-c36v) a155cd7
- 21.3.1
Fix infinite loop in ASF parser on malformed input (github.com/sindresorhus/file-type/security/advi…) 319abf8
- 17.1.3
Release by release
- new
Add support for Core Audio Format (CAF) (#805) bde605a
- new
Add support for DSDIFF (#804) e49d5b7
- new
- fixed
Fix streamed OOXML files being detected as zip (#801) 1347414
- fixed
- new
Add support for ISO 9660 (.iso) (#796) a675457
- new
- fixed
Fix ZIP detection on Node.js 24 for entries with a data descriptor f24af84
- fixed
Fix UTF-16 LE text being detected as MPEG audio c891929
- fixed
- fixed
Work around esbuild resolving Node-only imports ce4262f
- fixed
- new
Added detection for Apple iWork files:
.key(Keynote),.pages(Pages),.numbers(Numbers) - fixed
Fixed LibreOffice OOXML files being incorrectly detected as ZIP when reading from streams
- new
21.3.3 – 21.3.42 releases, nothing new or fixed in the notes
- fixed
Fix bound recursive BOM and ID3 detection 370ed91
- fixed
13 other lines we could not sort, mostly version bumps
- 22.1.0
Suppress Vite and webpack warnings for the intentional runtime import 2da7522
- 21.3.4
Harden parser more aec20a0
- 21.3.3
Harden parser c48c90b 135f91b
- 20.1.0
Improve WebP detection (#733) ef486f1
- 19.1.0
Replace Buffer usage with Uint8Array (#633) 00e051bceaf0791ffc1b08b36aee196ccdd95606
- 19.1.0
Please note that fileTypeFromBlob(blob) is streaming the Blob instead of buffering, which require at least Node.js ≥ 20.
- 17.1.2
Improve decoding of mime-type in ZIP file (#546) 1b10a71
- 17.0.1
Update
strtok3&token-typesdependencies for explicitnode:bufferimports (#507) b27fb5f - 16.5.3
Upgrade dependencies 3b08ab1
- 16.5.2
Lock
strtok3dependency
3 internal lines (docs, tests, tooling) left out.