# What changed in joserfc

> 13 changes in joserfc 1 from its official release notes, upgrade guides and advisories: 2 breaking, 5 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-21. HTML: https://unstale.sh/pypi/joserfc/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## joserfc 1

### Breaking changes

- Oct imports now reject asymmetric public keys. (1.7.7) — [release notes](https://github.com/authlib/joserfc/releases/tag/1.7.7)
- Requires jti claim values to be strings. (1.7.6) — [release notes](https://github.com/authlib/joserfc/releases/tag/1.7.6)

### Security

- Limits the size of additional authenticated data in JWE. (1.7.6) — [release notes](https://github.com/authlib/joserfc/releases/tag/1.7.6)
- joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363) (1.6.8) — [security advisory](https://github.com/advisories/GHSA-GG9X-QCX2-XMRH)
- joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization (1.6.7) — [security advisory](https://github.com/advisories/GHSA-WPHV-VFRH-23Q5)
- joserfc's PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS) (1.6.3) — [security advisory](https://github.com/advisories/GHSA-W5R5-M38G-F9F9)
- joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads (1.3.5, 1.4.2) — [security advisory](https://github.com/advisories/GHSA-FRFH-8V73-GJG4)

### New APIs and options

- Adds max_recipients to JWERegistry. (1.7.5) — [release notes](https://github.com/authlib/joserfc/releases/tag/1.7.5)

### Fixes and other changes

- Typing use was improved. (1.7.7) — [release notes](https://github.com/authlib/joserfc/releases/tag/1.7.7)
- Validates compact value size before splitting it. (1.7.6) — [release notes](https://github.com/authlib/joserfc/releases/tag/1.7.6)
- Reports the correct claim name when the iss claim is invalid. (1.7.6) — [release notes](https://github.com/authlib/joserfc/releases/tag/1.7.6)
- Handles equality comparisons with unrelated types. (1.7.6) — [release notes](https://github.com/authlib/joserfc/releases/tag/1.7.6)
- Ignores unknown kty values when importing a key set, as specified by RFC 7517 §5. (1.7.5) — [release notes](https://github.com/authlib/joserfc/releases/tag/1.7.5)