npm / samlify
samlify
What changed in samlify 2, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.
7 breaking5 security9 new APIs and options3 behavior and defaults8 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initsamlify 232 changes
Breaking changes 7
TypeScript users who imported xmldom's Options type should use DOMParserOptions.
Parse error messages are wrapped by xmldom's ParseError; code matching exact messages should switch to substring or regex matching.
Malformed or non-XML input now fails with a parse error instead of producing a partial document; metadata with two root EntityDescriptor elements is rejected.
Omitting signingAlgorithm now selects RSA-SHA256 instead of RSA-SHA1; callers requiring SHA-1 must pass signatureAlgorithms.RSA_SHA1 explicitly.
Unknown signature-algorithm URIs now throw this error instead of silently downgrading to SHA-1, rejecting malformed algorithms and preventing a verification-downgrade vector.
Promises now reject with Error instances instead of raw strings.
Unknown signature algorithms are rejected.
Security 5
Options now merge the XXE-safe errorHandler baseline instead of replacing it, so empty or partial options no longer silently disable XXE protection; callers may still override it explicitly.
samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions
An XXE bypass was fixed.
Addresses XPath injection as part of a security audit.
Adds XXE protection as part of a security audit.
New APIs and options 9
createLoginRequest supports specifying AssertionConsumerServiceIndex per request.
IdP metadata now supports the elementsOrder option.
createLoginRequest supports specifying ForceAuthn per request.
Login and logout requests can specify RelayState per request.
RSASSA-PSS signature algorithms are supported.
SimpleSign binding is supported for logout requests and responses.
IdP configuration now supports tagPrefix.assertion.
IdP configuration now supports tagPrefix.protocol.
Support was added for encrypted assertions, allowing developers to use them with samlify.
Behavior and default changes 3
Importing samlify no longer adds browser DOM globals or DOM fetch/BodyInit types to TypeScript projects, including Node-only projects.
setDOMParserOptions accepts xmldom 0.9's onError(level, message) option instead of the deprecated errorHandler; the old object form remains supported through conversion.
SP signatureConfig now has a default when wantMessageSigned is true.
Fixes and other changes 8
The body field type is now Record<string, unknown>, restoring TypeScript compatibility with Express and other web framework request objects.
The query field type is now Record<string, unknown>, restoring TypeScript compatibility with Express and other web framework request objects.
Attributes with null or undefined values are omitted from AuthnRequest.
customTagReplacement is invoked even when no explicit template is provided.
The metadata conflict error now surfaces SP and IdP signing flags.
A clear error is thrown when redirect binding has no SSO or SLO endpoint.
createLogoutRequest now passes through SessionIndex.
Maintains the CommonJS build.