# What changed in pkijs

> 24 changes in pkijs 3 to 4 from its official release notes, upgrade guides and advisories: 13 breaking, 1 security. Each one cited. Sources checked 2026-10-22. HTML: https://unstale.sh/npm/pkijs/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## pkijs 4

### Breaking changes

- asn1js is now a peer dependency; install it next to pkijs and use the same copy, since values built with asn1js 3 fail instanceof checks. (4.0.0) — [release notes](https://github.com/PeculiarVentures/PKI.js/releases/tag/v4.0.0)
- Constructing a new CertificateChainValidationEngine with null throws a TypeError. (4.0.0) — [release notes](https://github.com/PeculiarVentures/PKI.js/releases/tag/v4.0.0)
- fromJSON() throws a TypeError when a JWK member isn't base64url. (4.0.0) — [release notes](https://github.com/PeculiarVentures/PKI.js/releases/tag/v4.0.0)
- The CommonJS build is removed and the package ships a single ES module at build/index.js; supported Node.js can still require pkijs through require(esm). (4.0.0) — [release notes](https://github.com/PeculiarVentures/PKI.js/releases/tag/v4.0.0)
- The new exports map blocks deep imports into build/. (4.0.0) — [release notes](https://github.com/PeculiarVentures/PKI.js/releases/tag/v4.0.0)
- TypeScript projects that compile to CommonJS need to set module to node20 or nodenext. (4.0.0) — [release notes](https://github.com/PeculiarVentures/PKI.js/releases/tag/v4.0.0)
- The minimum supported Node.js versions are ^20.19.0 or >=22.12.0; older versions, including 22.0–22.11, are no longer supported. (4.0.0) — [release notes](https://github.com/PeculiarVentures/PKI.js/releases/tag/v4.0.0)
- toString() accepts only hex, base64, and base64url. (4.0.0) — [release notes](https://github.com/PeculiarVentures/PKI.js/releases/tag/v4.0.0)
- fromJSON() throws a TypeError when a JWK member isn't base64url. (4.0.0) — [release notes](https://github.com/PeculiarVentures/PKI.js/releases/tag/v4.0.0)
- Serialization throws a RangeError for an invalid or pre-1970 timestamp. (4.0.0) — [release notes](https://github.com/PeculiarVentures/PKI.js/releases/tag/v4.0.0)
- verify() throws a TypeError when the log key isn't base64. (4.0.0) — [release notes](https://github.com/PeculiarVentures/PKI.js/releases/tag/v4.0.0)

### Fixes and other changes

- JWK n and e are decoded exactly. (4.0.0) — [release notes](https://github.com/PeculiarVentures/PKI.js/releases/tag/v4.0.0)
- Timestamp tokens are verified with a constructed eContent. (4.0.0) — [release notes](https://github.com/PeculiarVentures/PKI.js/releases/tag/v4.0.0)

## pkijs 3

### Breaking changes

- The build now requires Node.js >= 24.5.0 and npm 11.7.0. (3.4.1) — [release notes](https://github.com/PeculiarVentures/PKI.js/releases/tag/v3.4.1)
- SignedCertificateTimestamp.signature is now an ArrayBuffer. (3.3.1) — [release notes](https://github.com/PeculiarVentures/PKI.js/releases/tag/v3.3.1)

### Security

- OCSP responder authorization checks are now performed in accordance with RFC 6960 §4.2.2.2. (3.4.1) — [release notes](https://github.com/PeculiarVentures/PKI.js/releases/tag/v3.4.1)

### Fixes and other changes

- ECDSA r and s are encoded as minimal DER INTEGERs. (3.4.3) — [release notes](https://github.com/PeculiarVentures/PKI.js/releases/tag/v3.4.3)
- SCT timestamp verification no longer mutates certificates. (3.4.3) — [release notes](https://github.com/PeculiarVentures/PKI.js/releases/tag/v3.4.3)
- KeyTrans recipient encryption errors are now propagated. (3.4.2) — [release notes](https://github.com/PeculiarVentures/PKI.js/releases/tag/v3.4.2)
- Uses a safe global registry key when process.pid is not an integer. (3.4.1) — [release notes](https://github.com/PeculiarVentures/PKI.js/releases/tag/v3.4.1)
- RSA-PSS public key import now accepts id-RSASSA-PSS SubjectPublicKeyInfo. (3.4.0) — [release notes](https://github.com/PeculiarVentures/PKI.js/releases/tag/v3.4.0)
- Parse OCSP SingleResponse singleExtensions as [1] EXPLICIT. (3.3.3) — [release notes](https://github.com/PeculiarVentures/PKI.js/releases/tag/v3.3.3)
- Parse singleRequestExtensions as [0] EXPLICIT Extensions. (3.3.3) — [release notes](https://github.com/PeculiarVentures/PKI.js/releases/tag/v3.3.3)
- Crypto detection was fixed. (3.3.0) — [release notes](https://github.com/PeculiarVentures/PKI.js/releases/tag/v3.3.0)