v4.0.0

4.0.0 (2026-10-22)

⚠ BREAKING CHANGES

• pkijs is ESM-only and requires Node.js ^20.19.0 || >=22.12.0 (previously >=16.0.0), so Node.js versions below 20.19 and 22.0-22.11 are no longer supported. The CommonJS build is removed: build/index.js (CommonJS) and build/index.es.js are replaced by a single ES module, build/index.js, with build/index.d.ts, and the new exports map blocks deep imports into build/. CommonJS code can still require("pkijs") on supported Node.js versions through require(esm). TypeScript projects that compile to CommonJS need "module": "node20" or "nodenext". asn1js is now a peer dependency (^4.0.0): install it next to pkijs; the application and pkijs must use the same asn1js copy, because pkijs checks instanceof against asn1js classes and values built with asn1js 3 fail those checks. bytestreamjs moves to ^3 and @noble/hashes to ^2, and pvtsutils and pvutils are replaced by @peculiar/utils ^4.1. The exported API is unchanged, but input handling is stricter: RSAPublicKey and ECPublicKey fromJSON() throw a TypeError when a JWK member isn't base64url, SignedCertificateTimestamp#verify() throws one when the log key isn't base64, SignedCertificateTimestamp serialization throws a RangeError for an invalid or pre-1970 timestamp, PkiObject#toString() accepts only "hex", "base64" and "base64url", and new CertificateChainValidationEngine(null) throws a TypeError. See "Breaking Changes In v4" in the README.

Bug Fixes

• RSAPublicKey: decode JWK n and e exactly (#559) (44c2d74)
• SignedData: verify timestamp tokens with a constructed eContent (#574) (ae4a4f9)

Build System

• deps: update @noble/hashes to 2.x (#561) (f2ab777)
• ship ESM-only output for Node.js ^20.19.0 || >=22.12.0 (#556) (0d2822b)