view release on metacpan or  search on metacpan

Changes  view on Meta::CPAN

Changes for Crypt-JWT distribution

0.038   2026-05-16
        - SECURITY:
            * constant-time MAC compare;
            * enforce JWK alg/use/key_ops and EC alg/crv consistency;
            * reject mixed-symmetry or duplicate-kid keysets;
            * cap PBES2 p2c and inflated payload size;
            * new $MIN_HMAC_KEY_LEN (4) and $MIN_RSA_BITS (2048);
            * new section SECURITY CONSIDERATIONS in POD
        - fix: ConcatKDF: INTEROP BREAK with <=0.037 for ECDH-ES + A192CBC-HS384 / A256CBC-HS512 only
        - fix: ECDH-ES apu/apv header values are base64url-decoded before KDF input
        - fix: AAD bit-length encoding (only diverged at AAD >= 512 MB)
        - fix: accepted_alg / accepted_enc now croak on unsupported types
        - aes_key_wrap/unwrap:
            * strict RFC 3394 (KW) vs RFC 5649 (KWP) modes;
            * ct length validation
            * fix unwrap of aligned KWP messages
        - require Compress::Raw::Zlib >= 2.057
        - new author-only Wycheproof harness t/wycheproof.t (AUTHOR_MODE=1)

0.037   2025-04-27
        - fix #43 Fails to decode JWT from AWS Application Load Balancers
        - fix #44 Allow decoding JWS with Base64 padding characters
        - added tolerate_padding parameter for decode_jwt

0.036   2025-01-26
        - fix #35 support aud claim as an array of strings
        - added verify_typ - verify 'typ' header parameter

0.035   2023-10-03
        - PR #37 Speed up decode_jwt

0.034   2021-11-28
        - fix #32 ensure payload is serialized consistently (canonical)

0.033   2021-05-01
        - fix #31 verify_xxx options do not work properly with decode_payload=0

0.032   2021-03-18
        - fix #30 use lower uid/gid in release tarball

0.031   2021-01-10
        - fix #29 Broken JWS support for ES256K "alg" type

0.030   2021-01-08
        - fix #28 Using "kid_keys" with PS256 fails

0.029   2020-06-22
        - verify_iss, verify_aud, verify_sub, verify_jti accept Scalar

0.028   2020-06-14
        - switch to JSON from JSON::MaybeXS

0.027   2020-06-05
        - fix #25 more intuitive exceptions
        - support for ES256K

0.026   2019-02-02
        - added support for EdDSA/ed25519 + ECDH/x25519
        - fix #21 Potentially wrong IV in gcm_key_wrap

0.025   2019-09-29
        - fix #19 Empty payload in JWS JSON token
        - PR #18 _verify_claims: Refactor iss, sub, aud, and jti checks

0.024   2019-03-26
        - fix #16 - INCOMPATIBLE CHANGES
          * croak if verify_iss is specified and claim iss is missing
          * croak if verify_aud is specified and claim aud is missing
          * croak if verify_sub is specified and claim sub is missing
          * croak if verify_jti is specified and claim jti is missing
        - documentation fixes

0.023   2018-09-01
        - SECURITY FIX: related to JWS signature validation
          issue reported by Jeremy Choi (CVE later)
        - (JWS) using a key from 'jwk' header requires to explicitly set
          'key_from_jwk_header => 1' and works only for RSA/ECDSA public keys
        - (JWS+JWE) when 'kid_keys' specified it croaks if header does not
          contain 'kid' value or if 'kid' was not found in 'kid_keys'

0.022   2018-06-24
        - fix AESGCM IV size as required by RFC (in encrypt_jwe_payload)

0.021   2018-03-15
        - fix #13 off-by-one in exp verification

0.020   2018-02-02
        - improved diagnostics

0.019   2018-01-26
        - fix #11 kid keys
        - fix #9  Support for Java lib that pads base64 encoding

0.018   2016-08-31
        - doc fixes
        - file perms fixes

0.017   2016-06-03
        - doc fixes