unstale

pypi / joserfc

joserfc

What changed in joserfc 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-21.

2 breaking5 security1 new APIs and options5 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.1 on npm

joserfc 113 changes

Breaking changes 2

Security 5

  • Limits the size of additional authenticated data in JWE.

    1.7.6release notes

  • joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)

    1.6.8security advisory

  • joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization

    1.6.7security advisory

  • joserfc's PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)

    1.6.3security advisory

  • joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads

    1.3.5, 1.4.2security advisory

New APIs and options 1

Fixes and other changes 5

  • Typing use was improved.

    1.7.7release notes

  • Validates compact value size before splitting it.

    1.7.6release notes

  • Reports the correct claim name when the iss claim is invalid.

    1.7.6release notes

  • Handles equality comparisons with unrelated types.

    1.7.6release notes

  • Ignores unknown kty values when importing a key set, as specified by RFC 7517 §5.

    1.7.5release notes