# What changed in samlify

> 32 changes in samlify 2 from its official release notes, upgrade guides and advisories: 7 breaking, 5 security, 9 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/samlify/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## samlify 2

### Breaking changes

- TypeScript users who imported xmldom's Options type should use DOMParserOptions. (2.14.0) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.14.0)
- Parse error messages are wrapped by xmldom's ParseError; code matching exact messages should switch to substring or regex matching. (2.14.0) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.14.0)
- Malformed or non-XML input now fails with a parse error instead of producing a partial document; metadata with two root EntityDescriptor elements is rejected. (2.14.0) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.14.0)
- Omitting signingAlgorithm now selects RSA-SHA256 instead of RSA-SHA1; callers requiring SHA-1 must pass signatureAlgorithms.RSA_SHA1 explicitly. (2.13.1) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.13.1)
- Unknown signature-algorithm URIs now throw this error instead of silently downgrading to SHA-1, rejecting malformed algorithms and preventing a verification-downgrade vector. (2.13.1) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.13.1)
- Promises now reject with Error instances instead of raw strings. (2.13.0) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.13.0)
- Unknown signature algorithms are rejected. (2.13.0) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.13.0)

### Security

- Options now merge the XXE-safe errorHandler baseline instead of replacing it, so empty or partial options no longer silently disable XXE protection; callers may still override it explicitly. (2.13.1) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.13.1)
- samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions (2.13.0) — [security advisory](https://github.com/advisories/GHSA-34R5-Q4JW-R36M)
- An XXE bypass was fixed. (2.13.0) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.13.0)
- Addresses XPath injection as part of a security audit. (2.12.0) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.12.0)
- Adds XXE protection as part of a security audit. (2.12.0) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.12.0)

### New APIs and options

- createLoginRequest supports specifying AssertionConsumerServiceIndex per request. (2.13.0) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.13.0)
- IdP metadata now supports the elementsOrder option. (2.13.0) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.13.0)
- createLoginRequest supports specifying ForceAuthn per request. (2.13.0) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.13.0)
- Login and logout requests can specify RelayState per request. (2.13.0) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.13.0)
- RSASSA-PSS signature algorithms are supported. (2.13.0) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.13.0)
- SimpleSign binding is supported for logout requests and responses. (2.13.0) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.13.0)
- IdP configuration now supports tagPrefix.assertion. (2.13.0) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.13.0)
- IdP configuration now supports tagPrefix.protocol. (2.13.0) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.13.0)
- Support was added for encrypted assertions, allowing developers to use them with samlify. (2.10.2) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.10.2)

### Behavior and default changes

- Importing samlify no longer adds browser DOM globals or DOM fetch/BodyInit types to TypeScript projects, including Node-only projects. (2.14.0) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.14.0)
- setDOMParserOptions accepts xmldom 0.9's onError(level, message) option instead of the deprecated errorHandler; the old object form remains supported through conversion. (2.14.0) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.14.0)
- SP signatureConfig now has a default when wantMessageSigned is true. (2.13.0) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.13.0)

### Fixes and other changes

- The body field type is now Record<string, unknown>, restoring TypeScript compatibility with Express and other web framework request objects. (2.13.1) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.13.1)
- The query field type is now Record<string, unknown>, restoring TypeScript compatibility with Express and other web framework request objects. (2.13.1) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.13.1)
- Attributes with null or undefined values are omitted from AuthnRequest. (2.13.0) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.13.0)
- customTagReplacement is invoked even when no explicit template is provided. (2.13.0) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.13.0)
- The metadata conflict error now surfaces SP and IdP signing flags. (2.13.0) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.13.0)
- A clear error is thrown when redirect binding has no SSO or SLO endpoint. (2.13.0) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.13.0)
- createLogoutRequest now passes through SessionIndex. (2.13.0) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.13.0)
- Maintains the CommonJS build. (2.12.0) — [release notes](https://github.com/tngan/samlify/releases/tag/v2.12.0)