Sourced from fast-jwt's releases.

v6.0.2

What's Changed

• [OPTIC-RELEASE-AUTOMATION] release/v6.0.1 by @​optic-release-automation in nearform/fast-jwt#557
• chore(deps-dev): bump tsd from 0.31.2 to 0.32.0 by @​dependabot in nearform/fast-jwt#558
• docs: Add error handling section with examples by @​simoneb in nearform/fast-jwt#561
• Fix: error constructor in declaration file by @​atlowChemi in nearform/fast-jwt#562

New Contributors

• @​atlowChemi made their first contribution in nearform/fast-jwt#562

Full Changelog: https://github.com/nearform/fast-jwt/compare/v6.0.1...v6.0.2

v6.0.1

What's Changed

• [OPTIC-RELEASE-AUTOMATION] release/v6.0.0 by @​optic-release-automation in nearform/fast-jwt#554
• feature: support negative expiresIn when signing tokens by @​agubler in nearform/fast-jwt#556

Full Changelog: https://github.com/nearform/fast-jwt/compare/v6.0.0...v6.0.1

v6.0.0

BREAKING CHANGES

This is a semver major release containing breaking changes to address more thoroughly the security vulnerability fixed in v5.0.6, which only fixed the vulnerability without introducing breaking changes.

This release takes it one step further by adhering more closely to the JWT specification.

More specifically, verification now expects all claims except for the aud claim to be single values, instead of supporting arrays of values.

This is a breaking change because JWTs containing claims in array format (with the exception of aud), now cause verification errors, while they were previously allowed.

What's Changed

• [OPTIC-RELEASE-AUTOMATION] release/v5.0.6 by @​optic-release-automation in nearform/fast-jwt#551
• feat!: align claim validation to specification by @​agubler in nearform/fast-jwt#553

New Contributors

• @​agubler made their first contribution in nearform/fast-jwt#553

Full Changelog: https://github.com/nearform/fast-jwt/compare/v5.0.6...v6.0.0

v5.0.6

SECURITY RELEASE

This release contains a fix for https://github.com/nearform/fast-jwt/security/advisories/GHSA-gm45-q3v2-6cf8.

Upgrading is strongly recommended.

Thanks to @​tibrn for reporting, and @​agubler for fixing it.

What's Changed

... (truncated)

• 56f00ff Release v6.0.2
• f28ebf9 Fix: error constructor in declaration file (#562)
• 2181bf1 docs: Add error handling section with examples (#561)
• 6234111 chore(deps-dev): bump tsd from 0.31.2 to 0.32.0 (#558)
• c298121 Release v6.0.1 (#557)
• 17fd233 feature: support negative expiresIn when signing tokens (#556)
• 438e18d Release v6.0.0 (#554)
• c4d4580 feat!: align claim validation to specification (#553)
• a8c6099 Release v5.0.6 (#551)
• cc26b1d Merge commit from fork
• Additional commits viewable in compare view

Sourced from @​fastify/jwt's releases.

v10.0.0

What's Changed

Breaking changes

build(deps): bump fast-jwt from 5.0.6 to 6.0.1 (fastify/fastify-jwt#374)

Please see https://github.com/nearform/fast-jwt/releases/tag/v6.0.0 for details on how it might affect you.

Other

chore(license): update date ranges; standardise style (fastify/fastify-jwt#379)

v9.1.0

What's Changed

• test: migrate to node test runner by @​ilteoood in fastify/fastify-jwt#367
• ci(ci): set job permissions by @​Fdawgs in fastify/fastify-jwt#370
• perf: use node: prefix to bypass require.cache call for builtins by @​Fdawgs in fastify/fastify-jwt#371
• fix: capture missingRequiredClaim errors and map to 401 by @​frederikprijck in fastify/fastify-jwt#369

New Contributors

• @​ilteoood made their first contribution in fastify/fastify-jwt#367
• @​frederikprijck made their first contribution in fastify/fastify-jwt#369

Full Changelog: https://github.com/fastify/fastify-jwt/compare/v9.0.4...v9.1.0

v9.0.4

What's Changed

• perf: Improve performance by caching verifier (fastify/fastify-jwt#360)

Full Changelog: https://github.com/fastify/fastify-jwt/compare/v9.0.3...v9.0.4

v9.0.3

What's Changed

• chore(package): add funding and contribs by @​Fdawgs in fastify/fastify-jwt#357
• perf: use optional chaining by @​Fdawgs in fastify/fastify-jwt#359
• refactor: prefix unused params with underscores by @​Fdawgs in fastify/fastify-jwt#361
• docs(readme): spelling and grammar fixes by @​Fdawgs in fastify/fastify-jwt#362

Full Changelog: https://github.com/fastify/fastify-jwt/compare/v9.0.2...v9.0.3

v9.0.2

What's Changed

• build(deps): bump fastify/workflows from 5.0.0 to 5.0.1 by @​dependabot in fastify/fastify-jwt#349
• docs: update readme to clarify fastify version compatibility by @​simoneb in fastify/fastify-jwt#350
• build(deps-dev): bump @​fastify/cookie from 10.0.1 to 11.0.1 by @​dependabot in fastify/fastify-jwt#351
• fix: Async key provider and errors should be resolved internally -- dynamic JWTs in tests by @​jmjf in fastify/fastify-jwt#338
• style: remove trailing whitespace by @​Fdawgs in fastify/fastify-jwt#352

... (truncated)

• 3567a17 Prepare to release 10.0.0
• e758062 build(deps-dev): bump @​types/node from 22.16.0 to 24.0.10 (#380)
• 870af5b chore(license): update date ranges; standardise style (#379)
• 4cbf5a5 build(deps-dev): bump tsd from 0.31.2 to 0.32.0 (#375)
• 89aad69 build(deps): bump fast-jwt from 5.0.6 to 6.0.1 (#374)
• 8932cc9 ci: restore job level permissions (#373)
• 09b5810 ci: set permissions at workflow level (#372)
• 0811cf5 Bumped v9.1.0
• 523e752 fix: capture missingRequiredClaim errors and map to 401 (#369)
• 2afec02 perf: use node: prefix to bypass require.cache call for builtins (#371)
• Additional commits viewable in compare view

This version was pushed to npm by kibertoad, a new releaser for @​fastify/jwt since your current version.

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.