v2.15.1

Maintenance release

2.15.1 updates dependencies and the development toolchain. There are no behaviour changes: defaults, accepted messages and generated output are the same as 2.15.0.

Dependencies

• node-rsa removed. Redirect and SimpleSign detached signatures are now signed and verified with Node's built-in crypto. RSA-SHA1/256/512 signatures are byte-identical to 2.15.0. RSASSA-PSS signing keeps the same 20-byte salt; verification now accepts any salt length, so signatures from spec-compliant peers (digest-length salt) also verify.

• xml-crypto 6.4.0 (from 6.1.2): canonicalization and signature-handling fixes. It now implements RSASSA-PSS itself, so samlify's temporary PSS shim is removed.

• xpath 0.0.35.

• @authenio/xml-encryption 6.0.2 (from 2.0.2), now in sync with upstream xml-encryption 6.0.2 and shipping its own TypeScript declarations. It brings the upstream fixes since 2020, including @xmldom/xmldom 0.8.13 (CVE-2026-34601) and the Okta EncryptedAssertion layout. samlify keeps applying its own algorithm policy, so:

  • the default data encryption stays AES-256-CBC, and AES-CBC assertions from IdPs still decrypt;
  • RSA-1.5 and TripleDES are still refused unless allowInsecureDecryptionAlgorithms is set, with the same warning as before when they are used.

  Encrypted output keeps the same structure, and assertions encrypted by either version decrypt with the other.

Development

• ESLint now enforces whitespace (2-space indent, no tabs or trailing spaces, LF, final newline); .editorconfig is removed.
• timekeeper replaced by vitest's vi.setSystemTime; type-level regression tests consolidated under test/consumer-types.
• Removed dead files (types.d.ts, @types/xml-encryption.d.ts, .snyk, tsconfig.typecheck.json) and unused tsconfig options. None of the toolchain changes affect the compiled output.
• README refreshed.

Full changelog: v2.15.0...v2.15.1