Skip to content

feat: upgrade jose dependency to v6 #486

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cschetan77 merged 5 commits into from
Feb 27, 2026
Merged

feat: upgrade jose dependency to v6 #486

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
3a46f08
upgrade jose@6
cschetan77 Feb 17, 2026
6fe1f2b
remove ES256K from allowed signature alg
cschetan77 Feb 25, 2026
bbbc982
add spec for utils.js
cschetan77 Feb 25, 2026
ccab205
fix lint
cschetan77 Feb 25, 2026
084941b
sync master
cschetan77 Feb 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 8 additions & 7 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
"dependencies": {
"@types/jsonwebtoken": "^9.0.4",
"debug": "^4.3.4",
"jose": "^4.15.4",
"jose": "^6.1.3",
"limiter": "^1.1.5",
"lru-memoizer": "^2.2.0"
},
Expand Down
2 changes: 0 additions & 2 deletions src/utils.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,6 @@ function resolveAlg(jwk) {
switch (jwk.crv) {
case 'P-256':
return 'ES256';
case 'secp256k1':
Copy link
Contributor

@nandan-bhat nandan-bhat Feb 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ES256K is still allowed in config.js.

So ES256K is allowed first, but fail later when the signing key is resolved.

Is this expected ?

Copy link
Contributor Author

@cschetan77 cschetan77 Feb 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, this is not expected.
I've removed the ES256K from the list of supported algorithms in config.js.

return 'ES256K';
Copy link
Contributor

@nandan-bhat nandan-bhat Feb 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we add test coverage for this removal ?

Copy link
Contributor Author

@cschetan77 cschetan77 Feb 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Was reluctant to add a spec for this specific unsupported algo (also there was no file for utils spec).
But have created a utitls.test.js and added a spec.

case 'P-384':
return 'ES384';
case 'P-521':
Expand Down
Loading