7.9.0

What's Changed

New middleware: @middy/http-dpop

DPoP (RFC 9449) sender-constrained tokens. Runs after a token verifier, reads the cnf.jkt thumbprint (RFC 7800) off the verified payload, and requires the request to prove possession of that key, so a stolen token is worthless on its own. Verification uses node:crypto only, no peer dependency.

Adoption is incremental: a token without cnf.jkt passes through as an ordinary bearer token until you set required: true. htu is built from origin (or requestContext.domainName), never the client-controlled Host header. Rejections are 401 with WWW-Authenticate: DPoP algs="...". No jti replay cache by design, see the docs for why and for the userland hook.

Docs: https://middy.js.org/docs/middlewares/http-dpop

@middy/http-jwt and @middy/http-paseto

• expectedClaims (new option): claims the payload must carry, compared with strict equality, e.g. { token_use: 'access' }. Absent claim fails like a wrong value. Checked after the signature and before the payload is published. Values must be string/number/boolean; arrays and objects are refused at construction.
• Key rotation: internalKey may now resolve to an array of keys. Tried in order, first success wins, and the signing key's own failure is reported rather than a signature miss from a bystander key. Each entry resolves independently, so a KMS keySpec narrows the algorithm allowlist per key, not middleware-wide. Empty array is a 500, not a silent 401.
• More key shapes: an already-resolved KeyObject or CryptoKey is accepted alongside { publicKey } (KMS), raw SPKI DER, and string secrets. An unsupported shape now throws a labelled 500 instead of leaking a bare TypeError.
• DPoP auth scheme: Authorization: DPoP <token> is parsed alongside Bearer.

CI / infra

• Staged publish audit, workflow hardening, OSSF Scorecard and SAST pipeline updates
• Dependency bumps (GitHub Actions group, 7 updates)
• Docs: DEPENDENCIES, WORKSTATION, SPVS compliance, incident response

Note: CI failed, use 7.9.2

Full Changelog: 7.8.0...7.9.0