CHANGELOG

Changelog

All notable changes to this project will be documented in this file. See standard-versionarrow-up-right for commit guidelines.

2.0.5arrow-up-right (2021-04-09)

Bug Fixes

2.0.4arrow-up-right (2021-01-18)

Performance

2.0.3arrow-up-right (2020-10-29)

Bug Fixes

2.0.2arrow-up-right (2020-09-14)

Bug Fixes

2.0.1arrow-up-right (2020-09-10)

Bug Fixes

2.0.0arrow-up-right (2020-09-08)

⚠ BREAKING CHANGES

  • the JWE.decrypt option algorithms was removed and replaced with contentEncryptionAlgorithms (handles enc allowlist) and keyManagementAlgorithms (handles alg allowlist)

  • the JWT.verify profile option was removed, use e.g. JWT.IdToken.verify instead.

  • removed the maxAuthAge JWT.verify option, this option is now only present at the specific JWT profile APIs where the auth_time property applies.

  • removed the nonce JWT.verify option, this option is now only present at the specific JWT profile APIs where the nonce property applies.

  • the acr, amr, nonce and azp claim value types will only be checked when verifying a specific JWT profile using its dedicated API.

  • using the draft implementing APIs will emit a one-time warning per process using process.emitWarning

  • JWT.sign function options no longer accept a nonce property. To create a JWT with a nonce just pass the value to the payload.

  • due to added ESM module support Node.js version with ESM implementation bugs are no longer supported, this only affects early v13.x versions. The resulting Node.js semver range is >=10.13.0 < 13 || >=13.7.0

  • deprecated method JWK.importKey was removed

  • deprecated method JWKS.KeyStore.fromJWKS was removed

  • the use of unregistered curve name P-256K for secp256k1 was removed

  • jose.JWE.Encrypt constructor aad and unprotectedHeader arguments swapped places

  • jose.JWE.encrypt.flattened header (unprotectedHeader) and aad arguments swapped places

  • jose.JWE.encrypt.general header (unprotectedHeader) and aad arguments swapped places

  • JWS.verify returned payloads are now always buffers

  • JWS.verify options encoding and parse were removed

Features

Bug Fixes

Refactor

Features

Bug Fixes

Bug Fixes

Bug Fixes

Features

Bug Fixes

Features

BREAKING CHANGES

  • at+JWT JWT draft profile - in the draft's Section 2.2 the claims iat and jti are now REQUIRED (was RECOMMENDED).

Bug Fixes

Bug Fixes

Features

Bug Fixes

Features

Bug Fixes

Features

Performance Improvements

Bug Fixes

Features

Performance Improvements

Bug Fixes

Bug Fixes

Features

Features

Features

Bug Fixes

Bug Fixes

Features

Bug Fixes

Bug Fixes

Features

Bug Fixes

Bug Fixes

Features

Bug Fixes

Bug Fixes

Features

Features

Features

Features

Features

Bug Fixes

Bug Fixes

Features

1.9.2arrow-up-right (2019-09-16)

Bug Fixes

1.9.1arrow-up-right (2019-09-10)

1.9.0arrow-up-right (2019-08-24)

Features

1.8.0arrow-up-right (2019-08-22)

Features

1.7.0arrow-up-right (2019-08-20)

Features

1.6.1arrow-up-right (2019-07-29)

Bug Fixes

1.6.0arrow-up-right (2019-07-27)

Bug Fixes

Features

1.5.2arrow-up-right (2019-07-27)

Bug Fixes

1.5.1arrow-up-right (2019-07-27)

Bug Fixes

1.5.0arrow-up-right (2019-07-23)

Features

1.4.1arrow-up-right (2019-07-14)

Bug Fixes

1.4.0arrow-up-right (2019-07-08)

Features

1.3.0arrow-up-right (2019-06-21)

Features

Bug Fixes

Deprecations

  • this deprecates the use of JWK.importKey in favor of JWK.asKey

  • this deprecates the use of JWKS.KeyStore.fromJWKS in favor of JWKS.asKeyStore

Both JWK.importKey and JWKS.KeyStore.fromJWKS could have resulted in the process getting blocked when large bitsize RSA private keys were missing their components and could also result in an endless calculation loop when the private key's private exponent was outright invalid or tampered with.

The new methods still allow to import private RSA keys with these optimization key parameters missing but it is disabled by default and one should choose to enable it when working with keys from trusted sources

It is recommended not to use jose versions with this feature in its original on-by-default form - v1.1.0 and v1.2.0

1.0.2arrow-up-right (2019-05-13)

Bug Fixes

1.0.1arrow-up-right (2019-04-27)

Bug Fixes

1.0.0arrow-up-right (2019-04-23)

Bug Fixes

Features

BREAKING CHANGES

  • key.algorithms(op) un+wrapKey was split into correct wrapKey/unwrapKey/deriveKey returns

  • keystore.all and keystore.get operation option was removed, key_ops: string[] supersedes it

  • Node.js minimal version is now v12.0.0 due to its added EdDSA support (crypto.sign, crypto.verify and eddsa key objects)

Reverts

BREAKING CHANGES

  • removing ES256K alg and EC P-256K crv support until the IETF WG decides on what the final names will be.

Features

Bug Fixes

Bug Fixes

Features

Bug Fixes

Bug Fixes

Bug Fixes

BREAKING CHANGES

  • all JWAarrow-up-right defined RSA based operations require key size of 2048 bits or more.

Bug Fixes

Features

BREAKING CHANGES

  • "dir" is no longer returned as wrap/unwrapKey key operation

0.9.2arrow-up-right (2019-03-05)

Bug Fixes

0.9.1arrow-up-right (2019-03-02)

Bug Fixes

0.9.0 (2019-03-02)

Initial release

Implemented Features

JWK Key Types
Supported

RSA

RSA

Elliptic Curve

EC

Octet sequence

oct

Serialization
JWS Sign
JWS Verify
JWE Encrypt
JWE Decrypt

Compact

General JSON

Flattened JSON

JWS Algorithms
Supported

RSASSA-PKCS1-v1_5

RS256, RS384, RS512

RSASSA-PSS

PS256, PS384, PS512

ECDSA

ES256, ES384, ES512

HMAC with SHA-2

HS256, HS384, HS512

JWE Key Management Algorithms
Supported

AES

A128KW, A192KW, A256KW

AES GCM

A128GCMKW, A192GCMKW, A256GCMKW

Direct Key Agreement

dir

RSAES OAEP

✓*

RSA-OAEP (*RSA-OAEP-256 is not supported due to its lack of support in Node.js)

RSAES-PKCS1-v1_5

RSA1_5

PBES2

PBES2-HS256+A128KW, PBES2-HS384+A192KW, PBES2-HS512+A256KW

ECDH-ES

ECDH-ES, ECDH-ES+A128KW, ECDH-ES+A192KW, ECDH-ES+A256KW

JWE Content Encryption Algorithms
Supported

AES GCM

A128GCM, A192GCM, A256GCM

AES_CBC_HMAC_SHA2

A128CBC-HS256, A192CBC-HS384, A256CBC-HS512

Last updated