v6.3.2

What's Changed

• fix: accept cacheTTL: Infinity, keep rejecting NaN by @SociableSteve with @Copilot in #652

Full Changelog: v6.3.1...v6.3.2

v6.3.1

What's Changed

• Clarify createVerifier maxAge behavior in README by @SociableSteve with @Copilot in #647
• fix: require a key unless the only allowed algorithm is "none" (GHSA-8wpc-h4q6-8fxv) by @SociableSteve in #649

New Contributors

• @SociableSteve with @Copilot made their first contribution in #647

Full Changelog: v6.3.0...v6.3.1

v6.3.0

What's Changed

• chore(deps-dev): bump eslint-plugin-n from 17.24.0 to 18.0.1 by @dependabot[bot] in #615
• fix: update exp and nbf claim handling in sing function by @alirezaJvh in #618
• refactor(types): migrate from tsd to tstyche by @Puppo in #614
• chore(deps-dev): bump @types/node from 25.9.4 to 26.0.0 by @dependabot[bot] in #622
• chore(deps): bump nearform-actions/github-action-notify-release from 1 to 2 by @dependabot[bot] in #624
• fix: skip public key detection for HSxxx algorithms by @toomuchdesign in #627
• test: reorganize tests by @toomuchdesign in #628
• fix: reject non-finite clockTimestamp, clockTolerance and cacheTTL options by @SociableSteve in #640
• fix: this dependabot configuration does not set a co... in... by @anupamme in #641
• fix: reject JSON array payloads in decoder by @SociableSteve in #639
• fix: reject non-whitespace key prefixes to close RSA→HS256 algorithm confusion (GHSA-ww5h-9m49-7xx4) by @lv10 in #632
• chore(deps): bump eslint to 10 and related tooling by @lv10 in #631
• fix: reject raw asymmetric JWK/JWKS JSON used as an HMAC secret by @SociableSteve in #636
• chore: update benchmarks by @SociableSteve in #644

New Contributors

• @alirezaJvh made their first contribution in #618
• @Puppo made their first contribution in #614
• @anupamme made their first contribution in #641
• @lv10 made their first contribution in #632

Full Changelog: v6.2.4...v6.3.0

v6.2.4

What's Changed

• fix: reject empty HMAC secret in prepareKeyOrSecret (#609) by @SociableSteve in #610

Full Changelog: v6.2.3...v6.2.4

v6.2.3

What's Changed

• chore(deps-dev): bump typescript from 5.9.3 to 6.0.3 by @dependabot[bot] in #604
• fix: strict base64url validation on verify (#606) by @mvanhorn in #607

New Contributors

• @mvanhorn made their first contribution in #607

Full Changelog: v6.2.2...v6.2.3

v6.2.2

What's Changed

• Add guard against 'null' token and token parts by @SociableSteve in #602

New Contributors

• @SociableSteve made their first contribution in #602

Full Changelog: v6.2.1...v6.2.2

v6.2.1

What's Changed

• Fix/regex non deterministic validation by @antoatta85 in #593
• fix: GHSA-cjw9-ghj4-fwxf CVE-2026-35041 ReDoS when using RegExp in allowed options by @antoatta85 in #595

Full Changelog: v6.2.0...v6.2.1

v6.2.0

What's Changed

• chore(deps-dev): bump @types/node from 24.10.4 to 25.0.2 by @dependabot[bot] in #575
• fix: complete patch for GHSA-mvf2-f6gm-w987 and #586 by @dcs-soni in #598
• fix acceptance of unknown crit headers and comply with RFC 7515 by @antoatta85 in #591
• fix: cache confusion risk with composite-key approach by @antoatta85 in #587

New Contributors

• @dcs-soni made their first contribution in #598
• @antoatta85 made their first contribution in #591

Full Changelog: v6.1.0...v6.2.0

v6.1.0

What's Changed

• [OPTIC-RELEASE-AUTOMATION] release/v6.0.2 by @optic-release-automation[bot] in #564
• chore(deps-dev): bump @types/node from 22.15.32 to 24.0.3 by @dependabot[bot] in #565
• chore(deps-dev): bump tsd from 0.32.0 to 0.33.0 by @dependabot[bot] in #567
• chore: import crypto once by @ilteoood in #568
• chore: migrate to OIDC publishing for npm releases by @zibs in #569
• feat: expose TOKEN_ERROR_CODES and derive duplicated error code types from it by @wopian in #573

New Contributors

• @zibs made their first contribution in #569
• @wopian made their first contribution in #573

Full Changelog: v6.0.2...v6.1.0

v6.0.2

What's Changed

• [OPTIC-RELEASE-AUTOMATION] release/v6.0.1 by @optic-release-automation in #557
• chore(deps-dev): bump tsd from 0.31.2 to 0.32.0 by @dependabot in #558
• docs: Add error handling section with examples by @simoneb in #561
• Fix: error constructor in declaration file by @atlowChemi in #562

New Contributors

• @atlowChemi made their first contribution in #562

Full Changelog: v6.0.1...v6.0.2