node-jose - npm Package Versions

0.11.1 (2018-05-15)

NOTE: This is a security patch, replacing base64url with b64u to address a vulnerability in the previous dependency.

Chore

• replace base64url with b64u (#179) (7f88049af5de3593adc00d886150bf2fa8f1ecd4), closes #179

<a name="0.11.0"></a>

0.11.0 (2017-11-30)

NOTICE This release includes a potentially breaking change. The default of jose.JWS.Verifier.verify() before 0.11.0 was to successfully verify if an embedded key was present and verification succeeds. Now the default is to instead fail verification. Applications that rely on embedded keys for JWS verification now must provide an opts Object to either jose.JWS.createVerify() or jose.JWS.Verifier.verify(), with the member allowEmbeddedKeys set to true.

Update

• configure if embedded keys can be used for signature verification; contributed by Fraser Winterborn of BlackBerry's Security Research Group (959a61d707ed2c8cf6582139a5605119283e4acb)
• configure option for allowed algorithm (9a86dd6dac3687ab58c806dfed6deca5a7d73dbb)

Doc

• Enable syntax highlighting on code areas in README (be18233154544cd160c185077cfaf77abea27507)

<a name="0.10.0"></a>

0.10.0 (2017-09-29)

Update

• alias JWS.createVerify to construct a sentence (2ed035a90c4ff74b210a8341292b3f9d6444a68d)
• Provide PBKDF2-based algorithms publicly (0a6e324eb5d163d69a58c5cf592cde84057faa40)

Fix

• HMAC minimum length checks should be better enforced (859539895b5f63f63c48e1d3871d1e052291af4e)
• prevent JWK.KeyStore#add from modifying jwk input (d1b8d882a1e4735434a317be8e6422bf259eed5d)

Build

• exclude old browsers from SL tests (20fe41ee982368123173995ba667c053608ff0bb)

<a name="0.9.5"></a>

0.9.5 (2017-08-07)

Update

• prevent embedding 'oct' keys in JWS objects (9e0c4dd81315306dc3e857142c84d69fba5c9519)

Fix

• coerce "kid" during lookup (bbe4d739e04e2b8a9e49c1e9235fc057dc952364), closes #109
• regression errors with Safari (7d8070cba5891506e0b5e978948ef9d1ba98a81f), closes #123 #125

Doc

• Add key hints and status badges to README (57916db0133d5ee97c5a34f32b80a46b6d63cb3a)

Build

• bundle package-lock.json for devel (3491d882b68270091ced996728b669a1c10086ef)
• support node-v8 in travis (60ba1e7312423ab3d1dee1f3f53c997f5b6f0d34)

<a name="0.9.4"></a>

0.9.4 (2017-04-13)

Update

• Use native RSA/OpenSSL crypto whenever possible (0d1a8cdc351988d74ac42398c3d973902db3d808)
• use npm-published base64url implementation (c6b30c91502ffef9b9d3addc8bdb1b8b0cc36e69), closes #96
• use npm-published node-forge implementation (0f4e0ab57839eaf6dd40c46be511afe3aec9ca44), closes #96
• Use WebCrypto API for PBKDF2 (5e5b9d376f334fa50bb69331e3065e2011c8e9c7)

Doc

• Fix wrong links to JWA and JWK specifications (538829dd4af480989422efec20a2c60f809d8d5c), closes #102

Build

• sourcemaps for karma tests (a571bd107d87df12bd9f076ade2a875c01b4b24d)
• update karma-firefox-launcher to version 1.0.1 (84f5f531783e4e50674532fa5c809dff4e6dc25c)
• update travis-ci for newer environments (55b91bb0b4bb158d9275dfc89c1de688e14163ed)
• update yargs to version 7.0.1 (af24f9e951b1078a088caf50acc13296c0076f68)

<a name="0.9.3"></a>

0.9.3 (2017-02-20)

Update

• maintain dependencies via Greenkeeper (2fde860746b009b6522fd9a990b4a62c34d034e4)
• update jsbn to version 1.1.0 (8a83b10c860e3c36aa581e890f5eeea7db23ec35)

Fix

• Validate EC public key is on configured curve (f92cffb4a0398b4b1158be98423369233282e0af)

Doc

• note webpack support (b011c001958c2e346b522e87cdb107f01e584da9)

Build

• additional tests on ECDH failures (af19f289811e75522bb8de662e76b1aef15a95fa)
• update gulp-mocha to latest version 🚀 (1e44875e9c1cad370cc44808bddf5fab99226eb0)
• Update webpack to the latest version 🚀 (bb513056143ad2ecf7b44862d3d7ac00e80852eb)

<a name="0.9.2"></a>

0.9.2 (2016-12-29)

Build

• include browser tests in travis-ci (4005f315f880add9aba33c1cbc7fb2c0a3a7a3d5)

Fix

• improper call to base64url.decode (e15d17c342c5374c8e953a2aa975c1a9daf1766a), closes #80
• node v6+ emits UnhandledPromiseRejectionWarning (6b5dbdfa9e9907ae547a6bce2a918fcc6c25368e), closes #79

<a name="0.9.1"></a>

0.9.1 (2016-08-23)

Build

• upgrade build environment (8f625984d668c160db0fea7ba48413b3e9320766)

<a name="0.9.0"></a>

0.9.0 (2016-07-17)

Update

• find keys embedded in JWS header (445381dd628936a9a3d4b8ff59794f96a0f34adb), closes #65

Fix

• incorrect member name for unprotected JWS header (6c6028c1619a500cb098b68fed0b83c52029823f)

<a name="0.8.1"></a>

0.8.1 (2016-07-13)

Fix

• Documentation typo (c8e27f517ce444ac13a8602f4e83da664c6fb34e)
• Issues with latest browserify-buffer (476e4d7fe743a50b6fd62ef1259d2db03d2313eb)
• Typo in lib/algorithms/constants (480721085b405c24349d5ead321c01d92941bdd2)
• Remove warnings from webpack (5056b6e29168ff147a948da908f305f90b60c45e)

Build

• Further restrict what is published (8e8f779cf84fe4d359123fa502276dfcad47ba0b)
• Reconcile git-prefixed dependencies (2b6bd1ec3f61ae301c9d631c1ff623b480ddd31b)

<a name="0.8.0"></a>