web-token/jwt-framework

Release Notes for 4.2.1

4.2.x bugfix release (patch)

4.2.1

• Total issues resolved: 5
• Total pull requests resolved: 5
• Total contributors: 1

bug

• 699: fix(core): keep the cause of a load or verification failure thanks to @Spomky
• 698: fix(encryption): read the recipient header from the builder state thanks to @Spomky
• 697: fix(core): keep every key of a set sharing the same "kid" thanks to @Spomky
• 696: fix(encryption): allow a sender key with a static key agreement thanks to @Spomky
• 695: fix(signature): apply the payload encoding to the clone, not the receiver thanks to @Spomky

Release Notes for 4.2.0

Feature release (minor)

4.2.0

• Total issues resolved: 3
• Total pull requests resolved: 10
• Total contributors: 6

enhancement

• 677: feat(signature): accept an already Base64Url encoded payload in JWSBuilder thanks to @Spomky
• 674: feat(console): add a command to convert a key into PKCS#8 thanks to @Spomky and @stof
• 670: Add support for the ECC Brainpool curves thanks to @Spomky
• 666: fix(encryption): enforce the disjoint header requirement of RFC 7516 thanks to @Spomky
• 665: Deprecate the hardcoded RSA1_5 CEK size table thanks to @Spomky
• 646: adds support for brainpoolP256r1 thanks to @robertboeser

Dependencies

• 664: Add support for brick/math 0.18 and 0.19 thanks to @stof

• 659: Add support for brick/math 0.18 thanks to @morvaim2

• 658: fix(encryption): read alg/enc exclusively from protected header in JWEDecrypter thanks to @rossaddison

• 656: Merge-up 4.1.x → 4.2.x (security fixes) thanks to @Spomky

DX,enhancement,pinned

• 329: adds withEncodedPayload to JWSBuilder thanks to @aaronpk

Release Notes for 4.1.9

4.1.9

• Total issues resolved: 3

• Total pull requests resolved: 4

• Total contributors: 2

• 675: fix(core): bound the compact serializers' segment split thanks to @Spomky

bug

• 673: fix(bundle): alias the nested token services with their own class thanks to @Spomky and @stof
• 672: fix(core): correct the parameter types of the nested token builder thanks to @Spomky and @stof
• 671: fix(bundle): align the web debug toolbar item with the Symfony core styles thanks to @Spomky and @stof

Release Notes for 4.1.8

4.1.x bugfix release (patch)

4.1.8

• Total issues resolved: 0
• Total pull requests resolved: 2
• Total contributors: 1

bug

• 668: Register the experimental algorithms again thanks to @Spomky
• 667: Repair the conditional swap of the elliptic curve points thanks to @Spomky

Release Notes for 4.1.7

Security patch release (4.1.x).

Brings the security fixes up from 4.0.x (#655):

• PBES2-HS*+A*KW — bounded p2c (PBKDF2 iteration count) to prevent a CPU-amplification denial of service. (GHSA-3prj-6hqw-cm82)
• ChaCha20-Poly1305 key encryption — Poly1305 authentication tag now emitted and verified. (GHSA-6vvh-pxr4-25r7)
• RSA1_5 — constant-time implicit rejection (Bleichenbacher mitigation). (GHSA-5739-39v2-5754)
• JWS — alg read only from the integrity-protected header (algorithm-confusion mitigation). (GHSA-jc38-x7x8-2xc8)

Release Notes for 4.1.6

4.1.x bugfix release (patch)

• Fix brick/math version in the library

4.1.6

• Total issues resolved: 1
• Total pull requests resolved: 0
• Total contributors: 0

Release Notes for 4.1.5

4.1.x bugfix release (patch)

4.1.5

• Total issues resolved: 0
• Total pull requests resolved: 0
• Total contributors: 0

Release Notes for 4.1.4

4.1.x bugfix release (patch)

4.1.4

• Total issues resolved: 0
• Total pull requests resolved: 1
• Total contributors: 1

Dependencies

• 649: Update brick/math constraint and remove dev minimum stability thanks to @Spomky

Release Notes for 4.1.3

4.1.x bugfix release (patch)

4.1.3

• Total issues resolved: 0

• Total pull requests resolved: 1

• Total contributors: 1

• 648: Fix PHP 8.5 deprecation thanks to @sandesh-as

Release Notes for 4.1.2

4.1.x bugfix release (patch)

4.1.2

• Total issues resolved: 0
• Total pull requests resolved: 0
• Total contributors: 0

Release Notes for 4.1.1

4.1.x bugfix release (patch)

4.1.1

• Total issues resolved: 1
• Total pull requests resolved: 2
• Total contributors: 2

bug

• 645: Refactor command help text definitions for Symfony Console compatibility thanks to @Spomky and @LumiSys

• 643: Update CI configuration to trigger on all version branches thanks to @Spomky

Release Notes for 4.0.7

Security patch release (4.0.x).

Brings the security fixes up from 3.4.x (#652):

• PBES2-HS*+A*KW — bounded p2c (PBKDF2 iteration count) to prevent a CPU-amplification denial of service. (GHSA-3prj-6hqw-cm82)
• ChaCha20-Poly1305 key encryption — Poly1305 authentication tag now emitted and verified. (GHSA-6vvh-pxr4-25r7)
• RSA1_5 — constant-time implicit rejection (Bleichenbacher mitigation). (GHSA-5739-39v2-5754)
• JWS — alg read only from the integrity-protected header (algorithm-confusion mitigation). (GHSA-jc38-x7x8-2xc8)

Also included:

• #641 Enhance key operations validation in UsageAnalyzer and add unit tests thanks to @Spomky

Release Notes for 3.4.10

Security patch release.

This release addresses four security issues in the JOSE implementation:

• PBES2-HS*+A*KW — the p2c (PBKDF2 iteration count) is now bounded (configurable) to prevent a CPU-amplification denial of service. (GHSA-3prj-6hqw-cm82)
• ChaCha20-Poly1305 key encryption — the Poly1305 authentication tag is now emitted and verified; tampered tokens are rejected. (GHSA-6vvh-pxr4-25r7)
• RSA1_5 — PKCS#1 v1.5 decryption now uses constant-time implicit rejection, mitigating Bleichenbacher-style padding oracles. (GHSA-5739-39v2-5754)
• JWS — the alg parameter is read only from the integrity-protected header, preventing algorithm-confusion attacks. (GHSA-jc38-x7x8-2xc8)

Note: 3.4.10 ships the fixes; the accompanying test-suite update is included in 3.4.11.

Release Notes for 3.4.9

3.4.x bugfix release (patch)

3.4.9

• Total issues resolved: 0
• Total pull requests resolved: 1
• Total contributors: 1

enhancement

• 644: Add sodium support for Base64 URL safe encoding/decoding thanks to @jdreesen