v10.3.0 Add an Option to Skip Webhook Signature Verification

What's Changed

✨ Add an Option to Skip Webhook Signature Verification

• Allow to skip signature verification by @habara-k in #1398

With this release, developers can now optionally skip signature verification when parsing incoming webhook requests. This new capability is especially useful in scenarios where the channel secret may change, potentially causing temporary signature mismatches.

Example Usage:

const m = line.middleware({
    channelSecret: CHANNEL_SECRET,
    skipSignatureVerification: () => true,
});

When signature verification is skipped, the signatureValidator will not be invoked. This allows webhook requests to be processed even if their signatures do not match the current channel secret used for verification.

This feature is particularly helpful in high-availability systems where avoiding downtime or message loss during configuration updates is critical.

Dependency updates

• Update dependency @types/node to v22.18.0 by @renovate[bot] in #1378
• Update dependency msw to v2.11.0 by @renovate[bot] in #1379
• Update dependency msw to v2.11.1 by @renovate[bot] in #1380
• Update dependency @types/node to v22.18.1 by @renovate[bot] in #1381
• Update dependency typedoc to v0.28.12 by @renovate[bot] in #1382
• Update actions/github-script action to v7.1.0 by @renovate[bot] in #1383
• Update actions/github-script action to v8 by @renovate[bot] in #1384
• Update actions/stale action to v10 by @renovate[bot] in #1386
• Update actions/setup-node action to v5 by @renovate[bot] in #1385
• Update dependency axios to v1.12.0 [SECURITY] by @renovate[bot] in #1390
• Update dependency org.apache.maven.plugins:maven-shade-plugin to v3.6.1 by @renovate[bot] in #1393
• Update dependency org.apache.maven.plugins:maven-surefire-plugin to v3.5.4 by @renovate[bot] in #1394
• Update dependency msw to v2.11.2 by @renovate[bot] in #1395
• Update actions/github-script action to v8 by @renovate[bot] in #1397
• Update dependency axios to v1.12.1 by @renovate[bot] in #1400
• Update dependency @types/node to v22.18.2 by @renovate[bot] in #1401
• Update dependency @types/node to v22.18.3 by @renovate[bot] in #1402
• Update dependency axios to v1.12.2 by @renovate[bot] in #1403
• Update dependency typedoc to v0.28.13 by @renovate[bot] in #1404

Other Changes

• Set minimumReleaseAge to 7 days to avoid merge renovate PR quickly by @Yang-33 in #1387
• Bump vite from 5.4.19 to 5.4.20 by @dependabot[bot] in #1388
• Update dependency typescript to v5.9.2 by @Yang-33 in #1391
• Update package-lock.json to apply result by npm run audit by @Yang-33 in #1392
• Reminder for npm audit fix by @Yang-33 in #1357
• Use github actor id instead of bot name to avoid renaming issues by @Yang-33 in #1399

Full Changelog: v10.2.0...v10.2.1