NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
npm · #2357 most downloaded on npm
Parse, Resolve, and Dereference JSON Schema $ref pointers
Last release 14 days ago
20 Sep 2026
Release timing varies
gaps range from 8 days to 3 months
Nearly every release is documented
notes for 59 of the last 60 stable releases
1 version withdrawn
withdrawn after publishing
7 years old
91 releases · first in 2020
One column per quarter.
16.0.3 (2026-09-20) Bug Fixes deps: update dependencies
harden reference handling and update dependencies
exclude paths before resolving references
chore!: require Node.js 22 and update dependencies
decode %3F back to "?" in toFileSystemPath
harden reference resolution and HTTP safety
handle cyclic reference chains safely
preserve compound schema refs when bundling
block unsafe pointer set tokens
edge: fix some edge cases and add more tests
Revert "fix: support 2020-12 anchors and ref siblings"
support 2020-12 anchors and ref siblings ( f3f7e35 ), closes #145 #419
## 15.3.2 (2026-03-23) ### Bug Fixes * ref: pass original ref
resolve multiple dereference and bundle issues (#338, #370, #395)
circular: call onCircular callback for all occurrences of circular $refs
resolve: if timeout is set, check for abort controller existence
exports: add http resolver to root exports
imports: remove node imports to fix browser bundle
path: replace win32 usages with custom functions, prettier
add main property back to package.json
callback: pass additional parameters to canRead
## 15.0.1 (2025-11-12) ### Bug Fixes * port: dont override port
Respect RFC 6901, use ESM output, add new mergeKeys dereference option. (#398) (fbb56b5), closes #383 #356 #370
yaml: support non standard yaml as a fallback
substr: fix and improve substring matching
bundle: don't look for a $ref pointer on a null value
# 14.1.0 (2025-07-07) ### Features * add onBundle callback
targets: upgrade targets to support Node 20 (current maintenace node), change typescript config to match, dont ship vite config
file: support trailing slashes in file resolver #389
options: make safe url resolver optional and boolean
Fix security vulnerability allowing default http resolver to make requests to internal hostnames
## 13.0.5 (2025-06-10) ### Bug Fixes * url: update docs url
## 13.0.4 (2025-06-08) ### Bug Fixes * url: ensure url is resolvable
location: use explicit window.location
location: add better url and window.location checking, fall beck to root path
## 13.0.1 (2025-06-03) ### Bug Fixes * export: export
ono: going to make this a breaking change in case there are people depending on the stack traces / benefits of ono
allow $defs and fix circular pointers issue with $ref in root
dereference: cache poisoning when dereferencing external schemas
BREAKING CHANGE: dereference caching to prevent infinite loops on circular schemas
allow $ref pointers to point to a null value
http.timeout default does not match the documentation
## 11.9.1 (2025-02-12) ### Bug Fixes * incorrect argument name
dereference.preservedProperties for preserving data during dereferencing
Nothing published for this version
release missing pointer error message improvements
dont cache on circular references to prevent overwriting external ref resolutions
## 11.7.1 (2024-10-10) ### Bug Fixes * add exports (2c50198) * remove exports test
increase default http timeout to 60s per #353
deps: bump deps, migrate eslint, fix process undefined
Improve DOM-less type exports (#352) (7916f8d), closes /github.com/DefinitelyTyped/DefinitelyTyped/blob/aaf94a0a6431f52c46dab26182f1156d79720d29/types
## 11.6.3 (2024-06-02) ### Bug Fixes * bump deps
## 11.6.2 (2024-05-18) ### Bug Fixes * create release and bump deps
## 11.6.1 (2024-04-23) ### Bug Fixes * fix path sep undefined #345
# 11.6.0 (2024-04-22) ### Features * add timeout option
## 11.5.5 (2024-04-15) ### Bug Fixes * bump deps
types: make default type extend base object instead of JSONSchema to support non-spec compliant type overloads
types: fix types of options, inheritance globally
types: fix types to accept spread or list of strings
Your coding agent can read these notes before it upgrades. Set up the MCP server →