VERSION_HISTORY.md (7694B)
1 ## `jwt-go` Version History 2 3 #### 3.2.2 4 5 * Starting from this release, we are adopting the policy to support the most 2 recent versions of Go currently available. By the time of this release, this is Go 1.15 and 1.16 ([#28](https://github.com/golang-jwt/jwt/pull/28)). 6 * Fixed a potential issue that could occur when the verification of `exp`, `iat` or `nbf` was not required and contained invalid contents, i.e. non-numeric/date. Thanks for @thaJeztah for making us aware of that and @giorgos-f3 for originally reporting it to the formtech fork ([#40](https://github.com/golang-jwt/jwt/pull/40)). 7 * Added support for EdDSA / ED25519 ([#36](https://github.com/golang-jwt/jwt/pull/36)). 8 * Optimized allocations ([#33](https://github.com/golang-jwt/jwt/pull/33)). 9 10 #### 3.2.1 11 12 * **Import Path Change**: See MIGRATION_GUIDE.md for tips on updating your code 13 * Changed the import path from `github.com/dgrijalva/jwt-go` to `github.com/golang-jwt/jwt` 14 * Fixed type confusing issue between `string` and `[]string` in `VerifyAudience` ([#12](https://github.com/golang-jwt/jwt/pull/12)). This fixes CVE-2020-26160 15 16 #### 3.2.0 17 18 * Added method `ParseUnverified` to allow users to split up the tasks of parsing and validation 19 * HMAC signing method returns `ErrInvalidKeyType` instead of `ErrInvalidKey` where appropriate 20 * Added options to `request.ParseFromRequest`, which allows for an arbitrary list of modifiers to parsing behavior. Initial set include `WithClaims` and `WithParser`. Existing usage of this function will continue to work as before. 21 * Deprecated `ParseFromRequestWithClaims` to simplify API in the future. 22 23 #### 3.1.0 24 25 * Improvements to `jwt` command line tool 26 * Added `SkipClaimsValidation` option to `Parser` 27 * Documentation updates 28 29 #### 3.0.0 30 31 * **Compatibility Breaking Changes**: See MIGRATION_GUIDE.md for tips on updating your code 32 * Dropped support for `[]byte` keys when using RSA signing methods. This convenience feature could contribute to security vulnerabilities involving mismatched key types with signing methods. 33 * `ParseFromRequest` has been moved to `request` subpackage and usage has changed 34 * The `Claims` property on `Token` is now type `Claims` instead of `map[string]interface{}`. The default value is type `MapClaims`, which is an alias to `map[string]interface{}`. This makes it possible to use a custom type when decoding claims. 35 * Other Additions and Changes 36 * Added `Claims` interface type to allow users to decode the claims into a custom type 37 * Added `ParseWithClaims`, which takes a third argument of type `Claims`. Use this function instead of `Parse` if you have a custom type you'd like to decode into. 38 * Dramatically improved the functionality and flexibility of `ParseFromRequest`, which is now in the `request` subpackage 39 * Added `ParseFromRequestWithClaims` which is the `FromRequest` equivalent of `ParseWithClaims` 40 * Added new interface type `Extractor`, which is used for extracting JWT strings from http requests. Used with `ParseFromRequest` and `ParseFromRequestWithClaims`. 41 * Added several new, more specific, validation errors to error type bitmask 42 * Moved examples from README to executable example files 43 * Signing method registry is now thread safe 44 * Added new property to `ValidationError`, which contains the raw error returned by calls made by parse/verify (such as those returned by keyfunc or json parser) 45 46 #### 2.7.0 47 48 This will likely be the last backwards compatible release before 3.0.0, excluding essential bug fixes. 49 50 * Added new option `-show` to the `jwt` command that will just output the decoded token without verifying 51 * Error text for expired tokens includes how long it's been expired 52 * Fixed incorrect error returned from `ParseRSAPublicKeyFromPEM` 53 * Documentation updates 54 55 #### 2.6.0 56 57 * Exposed inner error within ValidationError 58 * Fixed validation errors when using UseJSONNumber flag 59 * Added several unit tests 60 61 #### 2.5.0 62 63 * Added support for signing method none. You shouldn't use this. The API tries to make this clear. 64 * Updated/fixed some documentation 65 * Added more helpful error message when trying to parse tokens that begin with `BEARER ` 66 67 #### 2.4.0 68 69 * Added new type, Parser, to allow for configuration of various parsing parameters 70 * You can now specify a list of valid signing methods. Anything outside this set will be rejected. 71 * You can now opt to use the `json.Number` type instead of `float64` when parsing token JSON 72 * Added support for [Travis CI](https://travis-ci.org/dgrijalva/jwt-go) 73 * Fixed some bugs with ECDSA parsing 74 75 #### 2.3.0 76 77 * Added support for ECDSA signing methods 78 * Added support for RSA PSS signing methods (requires go v1.4) 79 80 #### 2.2.0 81 82 * Gracefully handle a `nil` `Keyfunc` being passed to `Parse`. Result will now be the parsed token and an error, instead of a panic. 83 84 #### 2.1.0 85 86 Backwards compatible API change that was missed in 2.0.0. 87 88 * The `SignedString` method on `Token` now takes `interface{}` instead of `[]byte` 89 90 #### 2.0.0 91 92 There were two major reasons for breaking backwards compatibility with this update. The first was a refactor required to expand the width of the RSA and HMAC-SHA signing implementations. There will likely be no required code changes to support this change. 93 94 The second update, while unfortunately requiring a small change in integration, is required to open up this library to other signing methods. Not all keys used for all signing methods have a single standard on-disk representation. Requiring `[]byte` as the type for all keys proved too limiting. Additionally, this implementation allows for pre-parsed tokens to be reused, which might matter in an application that parses a high volume of tokens with a small set of keys. Backwards compatibilty has been maintained for passing `[]byte` to the RSA signing methods, but they will also accept `*rsa.PublicKey` and `*rsa.PrivateKey`. 95 96 It is likely the only integration change required here will be to change `func(t *jwt.Token) ([]byte, error)` to `func(t *jwt.Token) (interface{}, error)` when calling `Parse`. 97 98 * **Compatibility Breaking Changes** 99 * `SigningMethodHS256` is now `*SigningMethodHMAC` instead of `type struct` 100 * `SigningMethodRS256` is now `*SigningMethodRSA` instead of `type struct` 101 * `KeyFunc` now returns `interface{}` instead of `[]byte` 102 * `SigningMethod.Sign` now takes `interface{}` instead of `[]byte` for the key 103 * `SigningMethod.Verify` now takes `interface{}` instead of `[]byte` for the key 104 * Renamed type `SigningMethodHS256` to `SigningMethodHMAC`. Specific sizes are now just instances of this type. 105 * Added public package global `SigningMethodHS256` 106 * Added public package global `SigningMethodHS384` 107 * Added public package global `SigningMethodHS512` 108 * Renamed type `SigningMethodRS256` to `SigningMethodRSA`. Specific sizes are now just instances of this type. 109 * Added public package global `SigningMethodRS256` 110 * Added public package global `SigningMethodRS384` 111 * Added public package global `SigningMethodRS512` 112 * Moved sample private key for HMAC tests from an inline value to a file on disk. Value is unchanged. 113 * Refactored the RSA implementation to be easier to read 114 * Exposed helper methods `ParseRSAPrivateKeyFromPEM` and `ParseRSAPublicKeyFromPEM` 115 116 #### 1.0.2 117 118 * Fixed bug in parsing public keys from certificates 119 * Added more tests around the parsing of keys for RS256 120 * Code refactoring in RS256 implementation. No functional changes 121 122 #### 1.0.1 123 124 * Fixed panic if RS256 signing method was passed an invalid key 125 126 #### 1.0.0 127 128 * First versioned release 129 * API stabilized 130 * Supports creating, signing, parsing, and validating JWT tokens 131 * Supports RS256 and HS256 signing methods