Packages

path-to-regexp

9.0.0 · 22 Oct 2026MIT310.6M / weekRepositoryHomepagenpmAtom feed

Upgrading path-to-regexp From 0.1.13 to 9.0.0

58 releases in betweennotes for 21

Reading releases, release notes and advisories…

Other targets from 0.1.13Newest 0.x0.2.5
3.0.0, 2.0.0, 1.0.0 have no release note on GitHub or in the repository's changelog, so their breaking changes are missing from the counts below.
  1. 0.1.13yours
  2. 0.2.0major
  3. 5 releases
  4. 1.0.0major
  5. 17 releases
  6. 2.0.0major
  7. 5 releases
  8. 3.0.0major
  9. 3 releases
  10. 4.0.0major
  11. 5 releases
  12. 5.0.0major
  13. 6.0.0major
  14. 5 releases
  15. 7.0.0major
  16. 7.1.0security
  17. 1 release
  18. 8.0.0security
  19. 3 releases
  20. 8.4.0security
  21. 2 releases
  22. 9.0.0target
4+
changes to make
0
advisories fixed
25+
new
6+
fixes

Counted from 21 of 58 release notes. Advisories are counted from the advisory database, in full.

Before you upgrade

Tick each one off as you go
  • breaking7.0.0
  • breaking7.0.0
  • breaking7.0.0
  • breaking7.0.0

Security

Release by release

  1. 9.0.0

    22 Oct 20263 fixes
    • fixed

      Avoid duplicate trailing delimiter matches

    • fixed

      Fix stringify of param names with control characters

    • fixed

      Fix stringify lookahead across empty text tokens

  2. 8.4.1 – 8.4.22 releases, no release note

  3. 8.4.0

    Security fix26 Mar 2026

  4. 8.3.0

    2 Sep 20252 new
    • new

      Add custom error class (#398) 2a7f2a4

    • new

      Allow plain objects for TokenData (#391) 687a9bb

  5. 8.2.0nothing new or fixed in the note

  6. 8.1.0

    10 Sep 20242 new
    • new

      Adds pathToRegexp method back for generating a regex

    • new

      Adds stringify method for converting TokenData into a path string

  7. 8.0.0

    Security fix1 Sep 20241 new

  8. 7.2.0

    10 Sep 20241 new
    • new

      Support array inputs for match and pathToRegexp 3fdd88f

50 other lines we could not sort, mostly version bumps

  • Refactor matching to be non-greedy

    9.0.0

  • Build project as ESM

    9.0.0

  • Remove TokenData class and Keys type

    9.0.0

  • Reject an empty-string param in compile

    9.0.0

  • Reject wildcard array that compiles to an empty path

    9.0.0

  • Quote param names followed by astral ID_Continue text

    9.0.0

  • Restricts wildcard backtracking when using more than 1 in a path (#421)

    8.4.0

  • Dedupes regex prefixes (#422)

    8.4.0

  • Rejects large optional route combinations (#424)

    8.4.0

  • Escape text should escape backslash (#390) a4a8552

    8.3.0