Skip to content

v15.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 05 Jun 09:14
v15.0.0
8bca509
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

This release upgrades auth0-js to v10.0.0, which resolves CVE-2026-42280 — a security vulnerability in token validation for browser-based applications.

⚠️ Breaking Changes

  • feat: upgrade auth0-js from v9 to v10 #2810 (cschetan77)

    HS256 is no longer supported. Applications configured with HS256 as the JWT Signature Algorithm will see parseHash() return an invalid_token error. HS256 requires the client secret to be present in the browser to verify tokens, which is a security vulnerability. Applications using RS256 are not affected.

    Migration: Switch to RS256 before upgrading:

    Auth0 Dashboard → Applications → [Your App] → Settings → Advanced Settings → OAuth → JsonWebToken Signature Algorithm → RS256

Changed

  • fix(deps): remove trim dependency #2783 (gameroman)

    The third-party trim package has been removed. All string trimming now uses the native String.prototype.trim() method, which has been available in all supported browsers and Node.js versions for many years. This removes one dependency from the shipped package with no change in behaviour.

Assets 2
Loading