npm / xmldsigjs
xmldsigjs
What changed in xmldsigjs 3, from its official release notes, upgrade guides and advisories. Sources checked 2026-11-09.
8 breaking2 new APIs and options1 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initxmldsigjs 311 changes
Breaking changes 8
asn1js ^4.0.0 is a peer dependency; apps pinned to asn1js 3 must upgrade, since asn1js 3 objects fail instanceof checks.
Invalid Base64 text now throws TypeError instead of DOMException InvalidCharacterError.
Odd-length or non-hex input now throws TypeError; the decoder ignores specified separators instead of silently producing incorrect bytes.
xmldsigjs is ESM-only and requires Node.js ^20.19.0 or >=22.12.0; Node.js 22.0–22.11 cannot require it.
Build outputs move to build/index.js, build/index.mjs, and build/index.d.ts; deep imports into build/ must be updated because exports blocks them.
pkijs ^4.0.0 is a peer dependency; apps pinned to pkijs 3 must upgrade.
Invalid UTF-8 and lone surrogates are replaced with U+FFFD instead of throwing URIError.
TypeScript projects compiling to CommonJS need module set to node20 or nodenext; node16 fails with TS1479.
New APIs and options 2
Adds a canonicalization sign option for XML signatures.
Adds the signedPropertiesReference sign option for XAdES.
Fixes and other changes 1
References can now be resolved using xml:id attributes.