v6.3.0

What's Changed

• chore(deps-dev): bump eslint-plugin-n from 17.24.0 to 18.0.1 by @dependabot[bot] in #615
• fix: update exp and nbf claim handling in sing function by @alirezaJvh in #618
• refactor(types): migrate from tsd to tstyche by @Puppo in #614
• chore(deps-dev): bump @types/node from 25.9.4 to 26.0.0 by @dependabot[bot] in #622
• chore(deps): bump nearform-actions/github-action-notify-release from 1 to 2 by @dependabot[bot] in #624
• fix: skip public key detection for HSxxx algorithms by @toomuchdesign in #627
• test: reorganize tests by @toomuchdesign in #628
• fix: reject non-finite clockTimestamp, clockTolerance and cacheTTL options by @SociableSteve in #640
• fix: this dependabot configuration does not set a co... in... by @anupamme in #641
• fix: reject JSON array payloads in decoder by @SociableSteve in #639
• fix: reject non-whitespace key prefixes to close RSA→HS256 algorithm confusion (GHSA-ww5h-9m49-7xx4) by @lv10 in #632
• chore(deps): bump eslint to 10 and related tooling by @lv10 in #631
• fix: reject raw asymmetric JWK/JWKS JSON used as an HMAC secret by @SociableSteve in #636
• chore: update benchmarks by @SociableSteve in #644

New Contributors

• @alirezaJvh made their first contribution in #618
• @Puppo made their first contribution in #614
• @anupamme made their first contribution in #641
• @lv10 made their first contribution in #632

Full Changelog: v6.2.4...v6.3.0