# What changed in xmldsigjs

> 11 changes in xmldsigjs 3 from its official release notes, upgrade guides and advisories: 8 breaking, 2 new APIs and options. Each one cited. Sources checked 2026-11-09. HTML: https://unstale.sh/npm/xmldsigjs/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## xmldsigjs 3

### Breaking changes

- asn1js ^4.0.0 is a peer dependency; apps pinned to asn1js 3 must upgrade, since asn1js 3 objects fail instanceof checks. (3.0.0) — [release notes](https://github.com/PeculiarVentures/xmldsigjs/releases/tag/v3.0.0)
- Invalid Base64 text now throws TypeError instead of DOMException InvalidCharacterError. (3.0.0) — [release notes](https://github.com/PeculiarVentures/xmldsigjs/releases/tag/v3.0.0)
- Odd-length or non-hex input now throws TypeError; the decoder ignores specified separators instead of silently producing incorrect bytes. (3.0.0) — [release notes](https://github.com/PeculiarVentures/xmldsigjs/releases/tag/v3.0.0)
- xmldsigjs is ESM-only and requires Node.js ^20.19.0 or >=22.12.0; Node.js 22.0–22.11 cannot require it. (3.0.0) — [release notes](https://github.com/PeculiarVentures/xmldsigjs/releases/tag/v3.0.0)
- Build outputs move to build/index.js, build/index.mjs, and build/index.d.ts; deep imports into build/ must be updated because exports blocks them. (3.0.0) — [release notes](https://github.com/PeculiarVentures/xmldsigjs/releases/tag/v3.0.0)
- pkijs ^4.0.0 is a peer dependency; apps pinned to pkijs 3 must upgrade. (3.0.0) — [release notes](https://github.com/PeculiarVentures/xmldsigjs/releases/tag/v3.0.0)
- Invalid UTF-8 and lone surrogates are replaced with U+FFFD instead of throwing URIError. (3.0.0) — [release notes](https://github.com/PeculiarVentures/xmldsigjs/releases/tag/v3.0.0)
- TypeScript projects compiling to CommonJS need module set to node20 or nodenext; node16 fails with TS1479. (3.0.0) — [release notes](https://github.com/PeculiarVentures/xmldsigjs/releases/tag/v3.0.0)

### New APIs and options

- Adds a canonicalization sign option for XML signatures. (3.1.0) — [release notes](https://github.com/PeculiarVentures/xmldsigjs/releases/tag/v3.1.0)
- Adds the signedPropertiesReference sign option for XAdES. (3.1.0) — [release notes](https://github.com/PeculiarVentures/xmldsigjs/releases/tag/v3.1.0)

### Fixes and other changes

- References can now be resolved using xml:id attributes. (3.1.0) — [release notes](https://github.com/PeculiarVentures/xmldsigjs/releases/tag/v3.1.0)