Upgrading cloudinary 1 to 2
Breaking1.41.3 → 2.11.0Breaking3Security2Platform1New20Changed2Fixed15Other10
SecurityHigh · CVSS 8.6Cloudinary Node SDK is vulnerable to Arbitrary Argument Injection through parameters that include an ampersandGHSA-g4mf-96x5-5m2c · CVE-2025-12613 ↗
BreakingUpgrade verdict
3 breaking changes and a platform requirement change and a security fix.
In plain terms
- The slideshow feature is gone because the service behind it no longer exists.
- HTTPS URLs are now generated by default instead of HTTP.
- Generated URLs now include analytics parameters unless turned off.
- The package no longer runs on Node.js 6 or Node.js 8.
Must act 5 items need code or config changes
Node.js requirement changed in 2.0.0-rc: >=0.6 → >=9.
Drops cloudinary-core, core-js, q.
Installs 1 package in all (was 4).
What you must change
Breaking3
Removes create_slideshow because the slideshow API has been sunset.
create_slideshowThe secure option from config now defaults to true.
secureURL analytics is now enabled by default.
Security1
Cloudinary Node SDK is vulnerable to Arbitrary Argument Injection through parameters that include an ampersand
High · CVSS 8.6Platform1
Drops support for Node.js 6 and Node.js 8.
API changes
Generated by DepDelta from published .d.ts files. Not mixed with prose notes.
- removed:
function v2.uploader.create_slideshow(options?: ConfigOptions & { manifest_transformation?: TransformationOptions, manifest_json?: Record<string, any> }, callback?: UploadResponseCallback): Promise<any> - changed:
function v2.api.restore(public_ids: string[], callback?: ResponseCallback): Promise<any> → function v2.api.restore(public_ids: string[], callback?: ResponseCallback): Promise<ResourceApiResponse> - changed:
function v2.api.restore(public_ids: string[], options?: AdminApiOptions | { resource_type: ResourceType, type: DeliveryType }, callback?: ResponseCallback): Promise<any> → function v2.api.restore(public_ids: string[], options?: AdminApiOptions | { resource_type: ResourceType, type: DeliveryType }, callback?: ResponseCallback): Promise<ResourceApiResponse> - changed:
function v2.provisioning.account.users(pending: boolean, userIds?: string[], prefix?: string, subAccountId?: string, options?: ProvisioningApiOptions, callback?: ResponseCallback): Promise<any> → function v2.provisioning.account.users(pending: boolean, userIds?: string[], prefix?: string, subAccountId?: string, options?: ProvisioningApiOptions | { lastLogin?: boolean; fromDate?: Date | string; toDate?: Date | string }, callback?: ResponseCallback): Promise<any> - changed:
function v2.uploader.upload_chunked(path: string, callback?: UploadResponseCallback): Promise<UploadApiResponse> → function v2.uploader.upload_chunked(path: string, callback?: UploadResponseCallback): UploadStream - changed:
function v2.uploader.upload_chunked(path: string, options?: UploadApiOptions, callback?: UploadResponseCallback): Promise<UploadApiResponse> → function v2.uploader.upload_chunked(path: string, options?: UploadApiOptions, callback?: UploadResponseCallback): UploadStream - changed:
function v2.uploader.upload_large(path: string, callback?: UploadResponseCallback): Promise<UploadApiResponse> → function v2.uploader.upload_large(path: string, callback?: UploadResponseCallback): Promise<UploadApiResponse> | UploadStream - changed:
function v2.uploader.upload_large(path: string, options?: UploadApiOptions, callback?: UploadResponseCallback): Promise<UploadApiResponse> → function v2.uploader.upload_large(path: string, options?: UploadApiOptions, callback?: UploadResponseCallback): Promise<UploadApiResponse> | UploadStream - changed:
method v2.search.with_field(value?: string): search → method v2.search.with_field(value?: string | Array<string>): search - changed:
property MetadataFieldApiOptions.datasource?: DatasourceEntry → property MetadataFieldApiOptions.datasource?: { values: Array<DatasourceEntry> } - changed:
property MetadataFieldApiResponse.datasource: DatasourceEntry → property MetadataFieldApiResponse.datasource: { values: Array<DatasourceEntry> } - changed:
static method v2.search.with_field(args?: string): search → static method v2.search.with_field(args?: string | Array<string>): search - changed:
type VisualSearchParams = { image_url: string } | { image_asset_id: string } | { text: string } → type VisualSearchParams = { image_url: string } | { image_asset_id: string } | { text: string } | { image_file: string | Buffer } - added:
function v2.analysis.analyze_uri(uri: string, analysis_type: AnalysisType, options?: ConfigOptions & CustomAnalysisOptions): Promise<AnalyzeResponse> - added:
function v2.api.config(options?: AdminApiOptions | { settings: boolean }, callback?: ResponseCallback): Promise<ConfigResponse> - added:
function v2.api.delete_resources_by_asset_ids(asset_ids: string[], callback?: ResponseCallback): Promise<ResourceApiResponse> - added:
function v2.api.delete_resources_by_asset_ids(asset_ids: string[], options?: AdminAndResourceOptions, callback?: ResponseCallback): Promise<ResourceApiResponse> - added:
function v2.api.rename_folder(old_path: string, new_path: string, options?: AdminApiOptions, callback?: ResponseCallback): Promise<RenameFolderResponse> - added:
function v2.api.restore_by_asset_ids(asset_ids: string[], callback?: ResponseCallback): Promise<ResourceApiResponse> - added:
function v2.api.restore_by_asset_ids(asset_ids: string[], options?: AdminAndResourceOptions, callback?: ResponseCallback): Promise<ResourceApiResponse> - added:
function v2.provisioning.account.access_keys(subAccountId: string, options?: ProvisioningApiOptions | { page_size?: number, page?: number, sort_by?: string, sort_order?: 'desc' | 'asc' }, callback?: ResponseCallback): Promise<AccessKeysListResponse> - added:
function v2.provisioning.account.delete_access_key(subAccountId: string, apiKey: string, options?: ProvisioningApiOptions, callback?: ResponseCallback): Promise<DeleteAccessKeyResponse> - added:
function v2.provisioning.account.delete_access_key_by_name(subAccountId: string, options: ProvisioningApiOptions | { name: string }, callback?: ResponseCallback): Promise<DeleteAccessKeyResponse> - added:
function v2.provisioning.account.generate_access_key(subAccountId: string, options?: ProvisioningApiOptions | { name?: string, enabled?: boolean }, callback?: ResponseCallback): Promise<AccessKeyDetails> - added:
function v2.provisioning.account.update_access_key(subAccountId: string, apiKey: string, options?: ProvisioningApiOptions | { name?: string, enabled?: boolean, dedicated_for?: 'webhooks' }, callback?: ResponseCallback): Promise<AccessKeyDetails> - added:
function v2.uploader.upload_large_stream(options?: UploadApiOptions, callback?: UploadResponseCallback): UploadStream - added:
function v2.utils.download_folder(folder_path: string, options?: ArchiveApiOptions | ConfigAndUrlOptions): string - added:
interface AccessKeyDetails - added:
interface AccessKeysListResponse - added:
interface AnalyzeResponse - added:
interface ConfigResponse - added:
interface DeleteAccessKeyResponse - added:
interface RenameFolderResponse - added:
method v2.search.fields(value?: string | Array<string>): search - added:
namespace v2.analysis - added:
property AccessKeyDetails.api_key: string - added:
property AccessKeyDetails.api_secret: string - added:
property AccessKeyDetails.created_at: string - added:
property AccessKeyDetails.enabled: boolean - added:
property AccessKeyDetails.name: string - added:
property AccessKeyDetails.updated_at: string - added:
property AccessKeysListResponse.access_keys: Array<AccessKeyDetails> - added:
property AccessKeysListResponse.total: number - added:
property AdminApiBaseResponse.request_id?: string - added:
property AnalyzeResponse.data: { entity: string, analysis: Record<string, Record<string, string> | Array<string> | string> } - added:
property AnalyzeResponse.request_id: string - added:
property ArchiveApiOptions.target_asset_folder?: string - added:
property ConfigOptions.debug?: boolean - added:
property ConfigResponse.cloud_name: string - added:
property ConfigResponse.created_at: string - added:
property ConfigResponse.settings?: { folder_mode: 'fixed' | 'dynamic' } - added:
property DatasourceEntry.state?: 'active' | 'inactive' - added:
property DeleteAccessKeyResponse.message: 'ok' | 'not_found' - added:
property MetadataFieldApiOptions.allow_dynamic_list_values?: boolean - added:
property MetadataFieldApiOptions.default_disabled?: boolean - added:
property RenameFolderResponse.from: { name: string, path: string } - added:
property RenameFolderResponse.to: { name: string, path: string } - added:
property UploadApiErrorResponse.request_id?: string - added:
property UploadApiOptions.auto_chaptering?: boolean - added:
property UploadApiOptions.auto_transcription?: boolean | { translate: Array<string> } - added:
property UploadApiOptions.regions?: Record<string, [RegionCoordinate, RegionCoordinate, ...Array<RegionCoordinate>]> - added:
static method v2.search.fields(args?: string | Array<string>): search - added:
type AnalysisType = 'custom' | 'captioning' | 'cld_fashion' | 'cld_text' | 'coco' | 'google_tagging' | 'human_anatomy' | 'lvis' | 'shop_classifier' | 'unidet' - added:
type CustomAnalysisOptions = { model_name: string, model_version: number } - added:
type RegionCoordinate = [number, number]