3.2.1

• fix: update example/get-my-ip.js to use await syntax
• docs(README): remove callback usage example, match the code
• deps: bump versions
• ci: expand testing to LTS versions & macOS

3.2.0

RFC 8489 (STUN 2020) support:

• New attributes: MESSAGE_INTEGRITY_SHA256 (0x001C), PASSWORD_ALGORITHM (0x001D), USERHASH (0x001E), PASSWORD_ALGORITHMS (0x8002), ALTERNATE_DOMAIN (0x8003)
• addMessageIntegritySha256(key) on StunRequest
• addUserhash(username, realm) — sends SHA-256(username:realm) instead of plaintext username
• addPasswordAlgorithm(algorithm, params?) — single algorithm selection
• addPasswordAlgorithms(algorithms) — server-side algorithm advertisement
• addAlternateDomain(domain) — FQDN companion to ALTERNATE_SERVER
• Corresponding getters on StunResponse: getMessageIntegritySha256(), getUserhash(), getPasswordAlgorithm(), getPasswordAlgorithms(), getAlternateDomain()
• validateMessageIntegritySha256(message, key) exported from lib/validate and from the top-level module
• constants.passwordAlgorithm ({ MD5: 0x0001, SHA_256: 0x0002 }) and public constants prefixed STUN_PASSWORD_ALGORITHM_
• Custom codec classes StunPasswordAlgorithmAttribute and StunPasswordAlgorithmsAttribute with correct per-entry padding for the list format

RFC 7064 (stuns: URI scheme) support:

• request('stuns://host:port') routes to a new TLS-over-TCP transport (tls-request)
• default port for stuns: is 5349 (was previously an error)
• rejectUnauthorized option forwarded to the TLS socket (defaults true)
• http: and other non-STUN protocols still throw Invalid protocol

Modern JS idioms

• index — constants export rewritten using Object.fromEntries & assign + a small prefix() helper, replacing five Object.keys().forEach() mutation loops
• util — removed redundant !Number.isNaN(m) from isNumber()
• create-message — || → transaction ?? createTransaction() (nullish coalescing)

3.1.2

• fix(stun-error-code-attribute) — fix errorClass * 100 + code
• fix(response) — fix getFingerprint() and getPriority()
• fix(validate) — Buffer.from(...subarray(...)) + timingSafeEqual
• fix(stun-xor-address-attribute) — fix xor() with ?? and Buffer.alloc
• fix(request) — addPriority uint32 check, addUsername off-by-one, 2 ** retries
• fix(dgram-server) — strengthen isStun with magic cookie check
• fix(decode) — add length guard

3.1.1

• ci: tighten permissions for codeql #12
• dep(ipaddr.js): bump to 2.3.0
• doc(CONTRIBUTORS.md): added
• prettier: formatting

v3.0.2

• dep: replace ip with ipaddr.js

v3.0.1

• dep(ip): bump 2.0.0 to 2.0.1
• configure eslint & prettier the modern way
  • jettison @nodertc/eslint-config, much of local config was turning off stuff imported from there
• ci: bump GHA versions
• test: remove eslint from devDependencies (installed by GHA for tests, npx will use local version)
• test: remove jest from devDependencies
  • installed by npx when needed
  • dramatically shrinks package-lock.json
  • next version: replaced with node:test

v3.0.0

[3.0.0] - 2023-12-13

• BREAKING: drop support for node.js <= 16
  • still works, but no legacy version testing
• dep(eslint): bump to 8.55.0
• dep(jest): bump to 29.7.0
• dep(prettier): bump to 3.1.1

v2.1.16

• dep(meow): replace with minimist
• dep(parse-url): replace with native URL
  • require node.js >= 10
• ci: replace Travis with GHA