unstale

npm / pkijs

pkijs

What changed in pkijs 3 to 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-22.

13 breaking1 security10 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.3 on npm

pkijs 413 changes

Breaking changes 11

  • asn1js is now a peer dependency; install it next to pkijs and use the same copy, since values built with asn1js 3 fail instanceof checks.

    4.0.0release notes

  • Constructing a new CertificateChainValidationEngine with null throws a TypeError.

    4.0.0release notes

  • fromJSON() throws a TypeError when a JWK member isn't base64url.

    4.0.0release notes

  • The CommonJS build is removed and the package ships a single ES module at build/index.js; supported Node.js can still require pkijs through require(esm).

    4.0.0release notes

  • The new exports map blocks deep imports into build/.

    4.0.0release notes

  • TypeScript projects that compile to CommonJS need to set module to node20 or nodenext.

    4.0.0release notes

  • The minimum supported Node.js versions are ^20.19.0 or >=22.12.0; older versions, including 22.0–22.11, are no longer supported.

    4.0.0release notes

  • toString() accepts only hex, base64, and base64url.

    4.0.0release notes

  • fromJSON() throws a TypeError when a JWK member isn't base64url.

    4.0.0release notes

  • Serialization throws a RangeError for an invalid or pre-1970 timestamp.

    4.0.0release notes

  • verify() throws a TypeError when the log key isn't base64.

    4.0.0release notes

Fixes and other changes 2

pkijs 311 changes

Breaking changes 2

  • The build now requires Node.js >= 24.5.0 and npm 11.7.0.

    3.4.1release notes

  • SignedCertificateTimestamp.signature is now an ArrayBuffer.

    3.3.1release notes

Security 1

  • OCSP responder authorization checks are now performed in accordance with RFC 6960 §4.2.2.2.

    3.4.1release notes

Fixes and other changes 8

  • ECDSA r and s are encoded as minimal DER INTEGERs.

    3.4.3release notes

  • SCT timestamp verification no longer mutates certificates.

    3.4.3release notes

  • KeyTrans recipient encryption errors are now propagated.

    3.4.2release notes

  • Uses a safe global registry key when process.pid is not an integer.

    3.4.1release notes

  • RSA-PSS public key import now accepts id-RSASSA-PSS SubjectPublicKeyInfo.

    3.4.0release notes

  • Parse OCSP SingleResponse singleExtensions as [1] EXPLICIT.

    3.3.3release notes

  • Parse singleRequestExtensions as [0] EXPLICIT Extensions.

    3.3.3release notes

  • Crypto detection was fixed.

    3.3.0release notes