jws

Changed

• Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require
  that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key)
  when using HMAC algorithms.
• Upgrading JWA version to 1.4.2, addressing a compatibility issue for Node >= 25.

v3.2.2

* jwa explicitly bumped to ^1.4.1
* KeyObject support
* PS* interoperability fixes

v3.2.1

* Updated jws.ALGORITHMS with PS* algs

v3.2.0

* [MINOR] Support for PS256,PS384,PS512 through jwa update. Thanks @csprl!
* README updates. Thanks @Calinou!

v3.1.5: inline base64url

* The base64url package has issues with TypeScript and also
has an open vulnerability reported on HackerOne (not
affected).

Most replacement packages are only compatible with Node 4+
so inlining an implementation in order to release with a
patch version

* Update README (Thanks @mmdf!)

package: version v3.1.4

Changed

• BREAKING: jwt.verify now requires an algorithm parameter, and jws.createVerify requires an algorithm option. The "alg" field signature headers is ignored. This mitigates a critical security flaw in the library which would allow an attacker to generate signatures with arbitrary contents that would be accepted by jwt.verify. See https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/ for details.

Changed

• BREAKING: Default payload encoding changed from binary to utf8. utf8 is a is a more sensible default than binary because many payloads, as far as I can tell, will contain user-facing strings that could be in any language. (<code>6b6de48</code>)

• Code reorganization, thanks @fearphage! (<code>7880050</code>)

Added

• Option in all relevant methods for encoding. For those few users that might be depending on a binary encoding of the messages, this is for them. (<code>6b6de48</code>)