Release notes

Release notes

Detailed per-version history. The README carries the one-line summaries.

3.0.0 (2026-07-17)

Breaking reshape — the package became the web-app glue over AWS's official verifier:

• Verification delegated to aws-jwt-verify (^5.2.1), the single runtime dependency (itself dependency-free). The 1.x homegrown verification stack (jsonwebtoken-era code and its 2.x zero-dependency rewrite) is gone. CognitoJwtVerifier / JwtVerifier are re-exported from the package root.
• makeGetUser(verifier, options?) replaces makeGetUser(pools, options?): build the verifier yourself (CognitoJwtVerifier.create({userPoolId, clientId, tokenUse})) and hand it over. An absent token resolves null and never throws; verification failures resolve null or, under throwOnError, throw aws-jwt-verify error classes. prime() maps to the verifier's hydrate().
• Middlewares absorbed as subpaths — the sister packages koa-cognito-middleware and cognito-express-middleware moved in as cognito-toolkit/koa and cognito-toolkit/express; the standalone packages are frozen re-export thunks (their 2.0.0). makeAuth(options) returns a per-instance bundle — getUser, isAuthenticated, hasGroup, hasScope, isAllowed, setAuthCookie, stateUserProperty — replacing the former module-level statics.
• Auth-cookie fix: the cookie domain defaults to the request hostname — the old host default broke on Express 5, which keeps the port on req.host (the cookie serializer rejects it).
• Guards read Cognito's cognito:groups and OAuth2 scope claims; 401 for anonymous, 403 for authenticated-but-unauthorized. Tokens are used bare (no Bearer stripping — use a custom source to strip).
• Token utilities (utils/lazy-access-token, utils/renewable-access-token) are unchanged from 2.x.
• Migration guides: from the v1 middlewares and from cognito-toolkit 1.x.

2.0.0 (unpublished)

Zero-dependency, ESM-only rewrite of the 1.x verifier on Node built-ins (crypto + fetch): configurable algorithm policy, audience / tokenUse / validate checks, typed CognitoAuthError, per-issuer JWKS with rotation refresh. Never published — the survey found AWS's aws-jwt-verify at parity-plus, which led directly to the 3.0.0 delegation.

1.x

• 1.0.6 — updated dependencies.
• 1.0.5 — updated dependencies.
• 1.0.4 — updated dependencies.
• 1.0.3 — updated dependencies.
• 1.0.2 — updated dependencies.
• 1.0.1 — added support for multiple pools.
• 1.0.0 — the initial public release (CommonJS, jsonwebtoken + jwk-to-pem).