Sourced from jws's releases.
v4.0.1
Changed
- Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.
- Upgrading JWA version to 2.0.1, addressing a compatibility issue for Node >= 25.
Sourced from jws's changelog.
[4.0.1]
Changed
- Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.
- Upgrading JWA version to 2.0.1, adressing a compatibility issue for Node >= 25.
[3.2.3]
Changed
- Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.
- Upgrading JWA version to 1.4.2, adressing a compatibility issue for Node >= 25.
[3.0.0]
Changed
- BREAKING:
jwt.verifynow requires analgorithmparameter, andjws.createVerifyrequires analgorithmoption. The"alg"field signature headers is ignored. This mitigates a critical security flaw in the library which would allow an attacker to generate signatures with arbitrary contents that would be accepted byjwt.verify. See https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/ for details.2.0.0 - 2015-01-30
Changed
BREAKING: Default payload encoding changed from
binarytoutf8.utf8is a is a more sensible default thanbinarybecause many payloads, as far as I can tell, will contain user-facing strings that could be in any language. ([6b6de48])Code reorganization, thanks [
@fearphage]! (7880050)Added
- Option in all relevant methods for
encoding. For those few users that might be depending on abinaryencoding of the messages, this is for them. ([6b6de48])
... (truncated)
34c45b2
Merge commit from fork49bc39b
version 4.0.1d42350c
Enhance tests for HMAC streaming sign and verify5cb007c
Improve secretOrKey initialization in VerifyStreamf9a2e1c
Improve secret handling in SignStreamb9fb8d3
Merge pull request #102
from auth0/SRE-57-Upload-opslevel-yaml95b75ee
Upload OpsLevel YAML8857ee7
test: remove unused variable (#96)This version was pushed to npm by julien.wollscheid, a new releaser for jws since your current version.
4e0068c
go.mod: update golang.org/x dependenciese79546e
ssh: curb GSSAPI DoS risk by limiting number of specified OIDsf91f7a7
ssh/agent: prevent panic on malformed constraint2df4153
acme/autocert: let automatic renewal work with short lifetime certsbcf6a84
acme: pass context to requestb4f2b62
ssh: fix error message on unsupported cipher79ec3a5
ssh: allow to bind to a hostname in remote forwarding122a78f
go.mod: update golang.org/x dependenciesc0531f9
all: eliminate vet diagnostics0997000
all: fix some commentsSourced from jws's releases.
v4.0.1
Changed
- Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.
- Upgrading JWA version to 2.0.1, addressing a compatibility issue for Node >= 25.
Sourced from jws's changelog.
[4.0.1]
Changed
- Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.
- Upgrading JWA version to 2.0.1, adressing a compatibility issue for Node >= 25.
[3.2.3]
Changed
- Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.
- Upgrading JWA version to 1.4.2, adressing a compatibility issue for Node >= 25.
[3.0.0]
Changed
- BREAKING:
jwt.verifynow requires analgorithmparameter, andjws.createVerifyrequires analgorithmoption. The"alg"field signature headers is ignored. This mitigates a critical security flaw in the library which would allow an attacker to generate signatures with arbitrary contents that would be accepted byjwt.verify. See https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/ for details.2.0.0 - 2015-01-30
Changed
BREAKING: Default payload encoding changed from
binarytoutf8.utf8is a is a more sensible default thanbinarybecause many payloads, as far as I can tell, will contain user-facing strings that could be in any language. ([6b6de48])Code reorganization, thanks [
@fearphage]! (7880050)Added
- Option in all relevant methods for
encoding. For those few users that might be depending on abinaryencoding of the messages, this is for them. ([6b6de48])
... (truncated)
34c45b2
Merge commit from fork49bc39b
version 4.0.1d42350c
Enhance tests for HMAC streaming sign and verify5cb007c
Improve secretOrKey initialization in VerifyStreamf9a2e1c
Improve secret handling in SignStreamb9fb8d3
Merge pull request #102
from auth0/SRE-57-Upload-opslevel-yaml95b75ee
Upload OpsLevel YAML8857ee7
test: remove unused variable (#96)This version was pushed to npm by julien.wollscheid, a new releaser for jws since your current version.
Sourced from @langchain/core's
releases.
@langchain/core@1.1.8Patch Changes
#9707
e5063f9Thanks@hntrl! - add security hardening forload#9684
8996647Thanks@christian-bromann! - fix(core): document purpose of name in base message
@langchain/core@1.1.6Patch Changes
#9668
a7b2a7dThanks@bracesproul! - fix: Cannot merge two undefined objects error#9657
a496c5fThanks@dqbd! - fix(core): avoid writing to TransformStream in EventStreamCallbackHandler when underlying ReadableStream is closed#9658
1da1325Thanks@dqbd! - fix(core): ensure streaming test chat models respect AbortSignal
@langchain/core@1.1.5Patch Changes
#9641
005c729Thanks@christian-bromann! - fix(community/core): various security fixes#7907
ab78246Thanks@jasonphillips! - fix(core): handle subgraph nesting better in graph_mermaid#9589
8cc81c7Thanks@nathannewyen! - test(core): add test for response_metadata in streamEvents#9644
f32e499Thanks@hntrl! - add bindTools to FakeListChatModel#9508
a28d83dThanks@shubham-021! - Fix toFormattedString() to properly display nested objects in tool call arguments instead of [object Object]#9165
2e5ad70Thanks@pawel-twardziak! - fix(mcp-adapters): preserve timeout from RunnableConfig in MCP tool calls#9647
e456c66Thanks@hntrl! - handle missing parent runs in tracer to prevent LangSmith 400 errors
@langchain/core@1.1.4Patch Changes
#9574
6c40d00Thanks@hntrl! - Revert "fix(@langchain/core): update and bundle dependencies (#9534)"
@langchain/core@1.1.3Patch Changes
#9534
bd2c46eThanks@christian-bromann! - fix(@langchain/core): update and bundlep-retry,ansi-styles,camelcaseanddecamelizedependencies#9544
487378bThanks@hntrl! - fix tool chunk concat behavior (#9450)#9505
138e7fbThanks@chosh-dev! - feat: replace btoa with toBase64Url for encoding in drawMermaidImage
... (truncated)
de32b32
chore: version packages (#9697)e5063f9
fix!(core/langchain): hardening for load (#9707)8b3e611
chore(turbopuffer): rollback version (#9698)8996647
fix(core): document purpose of name in base message (#9684)8df6264
chore: version packages (#9676)df9c42b
feat(core): usage_metadata in extra.metadata (#9686)4ea3a52
fix(ci): use appropriate path for core PR labels (#9696)ffb2402
feat(langchain): context (#9673)8d2982b
feat(core): Make runnable transform trace in a single payload in
LangChainTra...2b36431
fix(mcp-adapters): bump @modelcontextprotocol/sdk to
address CVE-2025-66414 (...Sourced from @langchain/google-genai's
releases.
@langchain/google-genai@2.1.3Patch Changes
@langchain/google-genai@2.1.1Patch Changes
@langchain/google-genai@2.1.0Patch Changes
#8327
89a7909Thanks@caspherola! - support of adding custom headers on ChatGoogleGenerativeAI #6648#9584
f4ef9a1Thanks@encodedz! - safe access around custom content parts#9583
5b27f38Thanks@maslo55555! - fix(google-genai): support custom agent names in createAgentUpdated dependencies [
005c729,ab78246,8cc81c7,f32e499,a28d83d,2e5ad70,e456c66,1cfe603]:
@langchain/core@1.1.5
@langchain/google-genai@2.0.4Patch Changes
@langchain/google-genai@2.0.3Patch Changes
@langchain/google-genai@2.0.2Patch Changes
@langchain/google-genai@2.0.1Patch Changes
4e0068c
go.mod: update golang.org/x dependenciese79546e
ssh: curb GSSAPI DoS risk by limiting number of specified OIDsf91f7a7
ssh/agent: prevent panic on malformed constraint2df4153
acme/autocert: let automatic renewal work with short lifetime certsbcf6a84
acme: pass context to requestb4f2b62
ssh: fix error message on unsupported cipher79ec3a5
ssh: allow to bind to a hostname in remote forwarding122a78f
go.mod: update golang.org/x dependenciesc0531f9
all: eliminate vet diagnostics0997000
all: fix some comments4e0068c
go.mod: update golang.org/x dependenciese79546e
ssh: curb GSSAPI DoS risk by limiting number of specified OIDsf91f7a7
ssh/agent: prevent panic on malformed constraint2df4153
acme/autocert: let automatic renewal work with short lifetime certsbcf6a84
acme: pass context to requestb4f2b62
ssh: fix error message on unsupported cipher79ec3a5
ssh: allow to bind to a hostname in remote forwarding122a78f
go.mod: update golang.org/x dependenciesc0531f9
all: eliminate vet diagnostics0997000
all: fix some commentsSourced from qs's changelog.
6.14.1
- [Fix] ensure arrayLength applies to
[]notation as well- [Fix]
parse: when a custom decoder returnsnullfor a key, ignore that key- [Refactor]
parse: extract key segment splitting helper- [meta] add threat model
- [actions] add workflow permissions
- [Tests]
stringify: increase coverage- [Dev Deps] update
eslint,@ljharb/eslint-config,npmignore,es-value-fixtures,for-each,object-inspect
3fa11a5
v6.14.1a626704
[Dev Deps] update npmignore3086902
[Fix] ensure arrayLength applies to [] notation as
wellfc7930e
[Dev Deps] update eslint,
@ljharb/eslint-config0b06aac
[Dev Deps] update @ljharb/eslint-config64951f6
[Refactor] parse: extract key segment splitting helpere1bd259
[Dev Deps] update @ljharb/eslint-configf4b3d39
[eslint] add eslint 9 optional peer dep6e94d95
[Dev Deps] update eslint,
@ljharb/eslint-config, npmignore973dc3c
[actions] add workflow permissionsSourced from qs's changelog.
6.14.1
- [Fix] ensure arrayLength applies to
[]notation as well- [Fix]
parse: when a custom decoder returnsnullfor a key, ignore that key- [Refactor]
parse: extract key segment splitting helper- [meta] add threat model
- [actions] add workflow permissions
- [Tests]
stringify: increase coverage- [Dev Deps] update
eslint,@ljharb/eslint-config,npmignore,es-value-fixtures,for-each,object-inspect6.14.0
- [New]
parse: addthrowOnParameterLimitExceededoption (#517)- [Refactor]
parse: useutils.combinemore- [patch]
parse: add explicitthrowOnLimitExceededdefault- [actions] use shared action; re-add finishers
- [meta] Fix changelog formatting bug
- [Deps] update
side-channel- [Dev Deps] update
es-value-fixtures,has-bigints,has-proto,has-symbols- [Tests] increase coverage
6.13.1
- [Fix]
stringify: avoid a crash when afilterkey isnull- [Fix]
utils.merge: functions should not be stringified into keys- [Fix]
parse: avoid a crash with interpretNumericEntities: true, comma: true, and iso charset- [Fix]
stringify: ensure a non-stringfilterdoes not crash- [Refactor] use
__proto__syntax instead ofObject.createfor null objects- [Refactor] misc cleanup
- [Tests]
utils.merge: add some coverage- [Tests] fix a test case
- [actions] split out node 10-20, and 20+
- [Dev Deps] update
es-value-fixtures,mock-property,object-inspect,tape
3fa11a5
v6.14.1a626704
[Dev Deps] update npmignore3086902
[Fix] ensure arrayLength applies to [] notation as
wellfc7930e
[Dev Deps] update eslint,
@ljharb/eslint-config0b06aac
[Dev Deps] update @ljharb/eslint-config64951f6
[Refactor] parse: extract key segment splitting helpere1bd259
[Dev Deps] update @ljharb/eslint-configf4b3d39
[eslint] add eslint 9 optional peer dep6e94d95
[Dev Deps] update eslint,
@ljharb/eslint-config, npmignore973dc3c
[actions] add workflow permissionsSourced from body-parser's releases.
1.20.4
What's Changed
- Remove redundant depth check by
@blakeembreyin expressjs/body-parser#538- ci: add support for Node.js v23 by
@Phillip9587in expressjs/body-parser#553- ci: restore CI for 1.x branch by
@bjohansebasin expressjs/body-parser#665- deps: qs@^6.14.0 by
@bjohansebasin expressjs/body-parser#664- deps: use tilde notation and update certain dependencies by
@Phillip9587in expressjs/body-parser#668- chore: remove SECURITY.md by
@Phillip9587in expressjs/body-parser#669- ci: add CodeQL (SAST) by
@Phillip9587in expressjs/body-parser#670- Release: 1.20.4 by
@UlisesGasconin expressjs/body-parser#672Full Changelog: https://github.com/expressjs/body-parser/compare/1.20.3...1.20.4
Sourced from body-parser's changelog.
1.20.4 / 2025-12-01
- deps: qs@~6.14.0
- deps: use tilde notation for dependencies
- deps: http-errors@~2.0.1
- deps: raw-body@~2.5.3
7db202c
1.20.4 (#672)d8f8adb
ci: add CodeQL (SAST) (#670)6d133c1
chore: remove SECURITY.md (#669)fcd1535
deps: use tilde notation and update certain dependencies (#668)ec5fa29
deps: qs@~6.14.0 (#664)ffb95c1
ci: restore CI for 1.x branch (#665)48a5f07
ci: add support for Node.js v23 (#553)f20f6ad
Remove redundant depth check (#538)Sourced from express's releases.
v4.22.1
What's Changed
[!IMPORTANT]
The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.
- Release: 4.22.1 by
@UlisesGasconin expressjs/express#6934Full Changelog: https://github.com/expressjs/express/compare/4.22.0...v4.22.1
4.22.0
Important: Security
- Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
What's Changed
- Refactor: improve readability by
@sazk07in expressjs/express#6190- ci: add support for Node.js@23.0 by
@UlisesGasconin expressjs/express#6080- Method functions with no path should error by
@wesleytoddin expressjs/express#5957- ci: updated github actions ci workflow by
@Phillip9587in expressjs/express#6323- ci: reorder
npm isteps to fix ci for older node versions by@Phillip9587in expressjs/express#6336- Backport: ci: add node.js 24 to test matrix by
@Phillip9587in expressjs/express#6506- chore(4.x): wider range for query test skip by
@jonchurchin expressjs/express#6513- use tilde notation for certain dependencies by
@UlisesGasconin expressjs/express#6905- deps: qs@6.14.0 by
@UlisesGasconin expressjs/express#6909- deps: use tilde notation for
qsby@Phillip9587in expressjs/express#6919- Release: 4.22.0 by
@UlisesGasconin expressjs/express#6921Full Changelog: https://github.com/expressjs/express/compare/4.21.2...4.22.0
Sourced from express's changelog.
4.22.1 / 2025-12-01
- Revert security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
4.22.0 / 2025-12-01
- Security fix for CVE-2024-51999 (GHSA-pj86-cfqh-vqx6)
- deps: use tilde notation for dependencies
- deps: qs@6.14.0
12fae14
4.22.15ddf311
Revert "sec: security patch for CVE-2024-51999"49744ab
4.22.0 (#6921)6e97452
sec: security patch for CVE-2024-519996a23d34
deps: use tilde notation for qs (#6919)8c12cdf
deps: qs@6.14.0 (#6909)7fea74f
deps: use tilde notation for certain dependencies (#6905)dac7a04
chore: wider range for query test skip (#6513)997919b
ci: add node.js 24 to test matrix (#6506)36fb59c
fix(ci): reorder npm i steps to fix ci for older node
versions (#6336)