Skip to content

v3.3.0

Choose a tag to compare

View all tags
@miladrahimi miladrahimi released this 25 Jul 15:44
v3.3.0
4fc1c41
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

Added

  • Support for the RSA-PSS algorithms PS256, PS384, and PS512 (#61)

Security

  • HMAC signature verification is now constant-time (#35)

Fixed

  • ES384 now hashes with SHA-384 as required by RFC 7518** (previously SHA-512)
  • ES384 tokens issued by earlier versions will no longer verify and must be re-issued. (#30)

Changed

  • Simplified the parser and DER-conversion internals (#60)
  • Internal cleanups, strict_types everywhere, and broader test coverage (#32)

Documentation

  • Runnable examples for every supported algorithm (#31, #63)
  • Accuracy sweep across docs, exception messages, and comments (#56)

CI & Tooling

  • PHPStan and PHPCS checks, running on PHP 8.5 (#33, #36)
  • Scrutinizer now fails builds on new issues and quality regressions (#64)
  • Dependabot enabled for Composer updates (#58, #59)

Full Changelog: v3.2.3...v3.3.0

Warning:

  • The ES384 fix gets a warning callout since it was marked breaking (fix(ecdsa)!) — it changes verification behavior, and that's the one item a consumer must read before upgrading.
Assets 2
Loading