Skip to content

chore(deps): update dependency jose to v6.2.12 - #817

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/jose-6.x-lockfile
Open

chore(deps): update dependency jose to v6.2.12#817
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/jose-6.x-lockfile

Conversation

@renovate

@renovate renovate Bot commented Sep 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
jose 6.2.3 → 6.2.12 age confidence

Release Notes

panva/jose (jose)

v6.2.12

Compare Source

Documentation
  • clarify and shorten public API guidance (be62530)
Refactor
  • simplify JWS and JWE operation cores (92e9640)
Performance
  • avoid copying AES-GCM output (6925d43)
  • deduplicate pending jwks key imports (bf5138b)
  • encode single-signature JWS input once (7bc9a33)
  • normalize General JWE shared headers once (78637bd)
  • normalize jwks selection metadata once (fd3ae3f)
  • use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Compare Source

v6.2.10

Compare Source

Fixes
  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)
  • jwt: prevent replacing protected headers (ae07d09)
  • jwt: reject invalid duration inputs (282f9aa)
  • jwt: validate builder claim values (ea03f83)
  • jwt: validate unsecured protected headers (230c14e)
  • key: validate generation and import options (15d880e)
  • reject mixed b64 modes for empty General JWS payloads (61a2ef7)
  • x509: reject DER truncated past its outer length (d8db9f6)
Documentation
  • jwks: correct cache timestamp units (01a44d9)
Refactor
  • jose: share binary input validation (eedb124)
  • jose: share compact token processing internals (85e30ed)
  • jwe: consolidate CBC decryption failures (1ee6f61)
  • jwe: specialize compact processing (a998927)
  • jwe: streamline single-recipient encryption (290aaa6)
  • jwks: compact JWK Set shape validation (930c7df), references Array#every
  • jwks: compact local key selection (4cb5ae5)
  • jwks: compact remote resolver state (ef5eaf4)
  • jws: specialize compact processing (021abf4)
  • jwt: compact claim validation helpers (f390683)
  • jwt: consolidate replicated claim checks (7dd5591)
  • jwt: share producer claim state (52ba159)
  • key: compact JWK algorithm selection (a6b29da)
  • key: compact secret length parsing (cc03be8)

v6.2.9

Compare Source

Fixes
  • reject a JWE whose generated Key Management Parameters collide (6ed19a6)
  • types: undeprecate PBES2 p2c parameter (33bf832)

v6.2.8

Compare Source

Fixes
  • enforce a single recipient when decrypting dir and ECDH-ES (505c383)
  • reject a non-string "alg" in EmbeddedJWK (714f870)
Refactor
  • index the JWS and JWE registries without a wrapper (925f3bb)
  • name the "alg" source in unsupported algorithm failures (1500459)

v6.2.7

Compare Source

Fixes
  • require own JOSE properties for presence checks (90ab09c)
Refactor

v6.2.6

Compare Source

Fixes
  • types: accept host CryptoKey declarations (b48a15b)

v6.2.5

Compare Source

Fixes
  • compare claim values for falsy validation options (eb86956)
  • forward key management parameters for a single JWE recipient (2d4f801)
  • handle a zero-length JWE additional authenticated data (16ca398)
  • reject a generateKeyPair crv option the algorithm does not imply (76364e9)
  • reject an unencoded payload in the JWS Compact Serialization (01d053f)
  • reject characters outside the Base64URL alphabet (0ebb971), references #​879
  • reject duplicate "crit" values when producing (31d60e1)
  • reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
  • reject truncated ASN.1 key data (7a16c66)
  • surface non-ASCII token segments as JOSE errors (194fe11)
  • types: correct JWK and CryptoKey types (62a196d)
  • types: correct key resolver and JWT header types (e95f8c4)
  • validate the clockTolerance and currentDate options are finite (ab2f18d)
Documentation
  • correct subpaths and API documentation (2daec38)
  • document consumer-supplied type parameters (9e9f66c)
  • stop claiming the JWK "use" parameter is used during import (47a07b2)
  • update CHANGELOG.md (fc51bf5)
Refactor
  • assert key shape and type from the entry (971057e)
  • avoid 32-bit truncation of the AES-CBC-HMAC AAD bit length (1c8c6e9)
  • correct swapped JWE unprotected header type error messages (894c498)
  • describe each JWS algorithm once (7375028)
  • discriminate a key once (0b59a69)
  • fold single-consumer modules into their consumers (c2f0ca3)
  • generate and import keys from the entry (da69b68)
  • keep JWE out of the JWKS and embedded-JWK paths (241dd48)
  • keep JWS and JWE out of each other's bundles (2a98564)
  • parse a Protected Header in one place (30f72af)
  • resolve the content encryption algorithm once (98b50ab)
  • tighten key property checks (fe0dc3b)
  • types: add discriminated JOSE error types (f7f764e)
  • types: add JOSE identifier unions and JWK narrowing (2a20f49)
  • types: improve key and result inference (cb25e77)
  • types: trim published declaration comments (544f179)
  • unify base64 decode errors (3a91833)
  • validate each token once rather than once per layer (bbdae09)
  • write each algorithm identifier once (73d83b5)

v6.2.4

Compare Source

Documentation
  • update README.md and SECURITY.md to reflect passed EOL dates (2a84032)
Refactor
  • normalize JWK export members from runtime quirks (386a3eb)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the UPDATE-PATCH label Sep 8, 2026
@changeset-bot

changeset-bot Bot commented Sep 8, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 6775d47

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@renovate
renovate Bot force-pushed the renovate/jose-6.x-lockfile branch from b90f439 to bfd53d1 Compare September 9, 2026 16:02
@nx-cloud

nx-cloud Bot commented Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

View your CI Pipeline Execution ↗ for commit 6775d47

Command Status Duration Result
nx affected -t build lint test typecheck e2e-ci ❌ Failed 2m 59s View ↗

💡 Dealing with memory or CPU issues? See memory and CPU details with the resource usage add-on ↗.

☁️ Nx Cloud last updated this comment at 2026-09-09 21:12:54 UTC

@codecov-commenter

codecov-commenter commented Sep 9, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 24.11%. Comparing base (eafe277) to head (bfd53d1).
⚠️ Report is 131 commits behind head on main.

❌ Your project status has failed because the head coverage (24.11%) is below the target coverage (40.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main     #817      +/-   ##
==========================================
+ Coverage   18.07%   24.11%   +6.03%     
==========================================
  Files         155      163       +8     
  Lines       24398    25797    +1399     
  Branches     1203     1687     +484     
==========================================
+ Hits         4410     6221    +1811     
+ Misses      19988    19576     -412

see 24 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@pkg-pr-new

pkg-pr-new Bot commented Sep 9, 2026

Copy link
Copy Markdown

Open in StackBlitz

@forgerock/davinci-client

pnpm add https://pkg.pr.new/@forgerock/davinci-client@817

@forgerock/device-client

pnpm add https://pkg.pr.new/@forgerock/device-client@817

@forgerock/journey-client

pnpm add https://pkg.pr.new/@forgerock/journey-client@817

@forgerock/oidc-client

pnpm add https://pkg.pr.new/@forgerock/oidc-client@817

@forgerock/protect

pnpm add https://pkg.pr.new/@forgerock/protect@817

@forgerock/sdk-types

pnpm add https://pkg.pr.new/@forgerock/sdk-types@817

@forgerock/sdk-utilities

pnpm add https://pkg.pr.new/@forgerock/sdk-utilities@817

@forgerock/iframe-manager

pnpm add https://pkg.pr.new/@forgerock/iframe-manager@817

@forgerock/sdk-logger

pnpm add https://pkg.pr.new/@forgerock/sdk-logger@817

@forgerock/sdk-oidc

pnpm add https://pkg.pr.new/@forgerock/sdk-oidc@817

@forgerock/sdk-request-middleware

pnpm add https://pkg.pr.new/@forgerock/sdk-request-middleware@817

@forgerock/storage

pnpm add https://pkg.pr.new/@forgerock/storage@817

commit: bfd53d1

@github-actions

github-actions Bot commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

Deployed 7cfb40f to https://ForgeRock.github.io/ping-javascript-sdk/pr-817/7cfb40f40ded46542dbb41911791c686fc0bcebe branch gh-pages in ForgeRock/ping-javascript-sdk

@github-actions

github-actions Bot commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

📦 Bundle Size Analysis

📦 Bundle Size Analysis

🆕 New Packages

🆕 @forgerock/device-client - 0.0 KB (new)
🆕 @forgerock/device-client - 10.0 KB (new)
🆕 @forgerock/journey-client - 0.0 KB (new)
🆕 @forgerock/journey-client - 92.6 KB (new)

➖ No Changes

➖ @forgerock/sdk-types - 9.1 KB
➖ @forgerock/recognize - 4284.4 KB
➖ @forgerock/oidc-client - 35.5 KB
➖ @forgerock/storage - 1.5 KB
➖ @forgerock/iframe-manager - 3.2 KB
➖ @forgerock/sdk-logger - 1.6 KB
➖ @forgerock/sdk-oidc - 5.7 KB
➖ @forgerock/sdk-request-middleware - 4.6 KB
➖ @forgerock/sdk-utilities - 18.8 KB
➖ @forgerock/protect - 144.6 KB
➖ @forgerock/davinci-client - 59.7 KB

15 packages analyzed • Baseline from latest main build

Legend

🆕 New package
🔺 Size increased
🔻 Size decreased
➖ No change

ℹ️ How bundle sizes are calculated
  • Current Size: Total gzipped size of all files in the package's dist directory
  • Baseline: Comparison against the latest build from the main branch
  • Files included: All build outputs except source maps and TypeScript build cache
  • Exclusions: .map, .tsbuildinfo, and .d.ts.map files

🔄 Updated automatically on each push to this PR

@renovate
renovate Bot force-pushed the renovate/jose-6.x-lockfile branch from bfd53d1 to 6775d47 Compare September 9, 2026 21:08
@coderabbitai

coderabbitai Bot commented Sep 9, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 8fe29c8d-9106-4df7-b89e-afbc76414a7c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

nx-cloud[bot]
nx-cloud Bot reviewed Sep 9, 2026
View reviewed changes

@nx-cloud nx-cloud Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nx Cloud has identified a possible root cause for your failed CI:

We classified this failure as an environment issue rather than a code regression. The two timed-out tests run multiple sequential api-extractor passes and exceed the 5000ms limit by only ~300ms — a pattern consistent with CI resource contention, not with a jose cryptography library patch that has no relationship to TypeScript API extraction. Our recommendation is to re-run the pipeline; if timeouts persist, the test timeout for these integration tests should be increased.

No code changes were suggested for this issue.

Trigger a rerun:

Rerun CI

Nx Cloud View detailed reasoning on Nx Cloud ↗


🎓 Learn more about Self-Healing CI on nx.dev

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nx-cloud nx-cloud[bot] nx-cloud[bot] left review comments
@renovate-approve renovate-approve[bot] renovate-approve[bot] approved these changes

Assignees

No one assigned

Labels

UPDATE-PATCH

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@codecov-commenter