jwt-2.10.2

v2.10.2 (2025-06-29)

Full Changelog

Fixes and enhancements:

• Avoid using the same digest across calls in JWT::JWA::Ecdsa and JWT::JWA::Rsa #697

jwt-3.1.2

v3.1.2 (2025-06-28)

Full Changelog

Fixes and enhancements:

• Avoid using the same digest across calls in JWT::JWA::Ecdsa and JWT::JWA::Rsa #697
• Fix signing with a EC JWK #699 (@anakinj)

jwt-3.1.1

v3.1.1 (2025-06-24)

Full Changelog

Fixes and enhancements:

• Require the algorithm to be provided when signing and verifying tokens using JWKs #695 (@anakinj)

jwt-3.1.0

v3.1.0 (2025-06-23)

Full Changelog

Features:

• Add support for x5t header parameter for X.509 certificate thumbprint verification #669 (@hieuk09)
• Raise an error if the ECDSA signing or verification key is not an instance of OpenSSL::PKey::EC #688 (@anakinj)
• Allow OpenSSL::PKey::EC::Point to be used as the verification key in ECDSA #689 (@anakinj)
• Require claims to have been verified before accessing the JWT::EncodedToken#payload #690 (@anakinj)
• Support signing and verifying tokens using a JWK #692 (@anakinj)

jwt-3.0.0

v3.0.0 (2025-06-14)

Full Changelog

Breaking changes:

• Require token signature to be verified before accessing payload #648 (@anakinj)
• Drop support for the HS512256 algorithm #650 (@anakinj)
• Remove deprecated claim verification methods #654 (@anakinj)
• Remove dependency to rbnacl #655 (@anakinj)
• Support only stricter base64 decoding (RFC 4648) #658 (@anakinj)
• Custom algorithms are required to include JWT::JWA::SigningAlgorithm #660 (@anakinj)
• Require RSA keys to be at least 2048 bits #661 (@anakinj)
• Base64 encode and decode the k value for HMAC JWKs #662 (@anakinj)

Take a look at the upgrade guide for more details.

Features:

• JWT::EncodedToken#verify! method that bundles signature and claim validation #647 (@anakinj)
• Do not override the alg header if already given #659 (@anakinj)
• Make JWK::KeyFinder compatible with JWT::EncodedToken #663 (@anakinj)

Fixes and enhancements:

• Ruby 3.4 to CI matrix #649 (@anakinj)
• Add logger as development dependency #670 (@hieuk09)

jwt-3.0.0.beta1

v3.0.0-beta1 (2025-01-25)

Full Changelog

Breaking changes:

• Require token signature to be verified before accessing payload #648 (@anakinj)
• Drop support for the HS512256 algorithm #650 (@anakinj)
• Remove deprecated claim verification methods #654 (@anakinj)
• Remove dependency to rbnacl #655 (@anakinj)
• Support only stricter base64 decoding (RFC 4648) #658 (@anakinj)
• Custom algorithms are required to include JWT::JWA::SigningAlgorithm #660 (@anakinj)
• Require RSA keys to be at least 2048 bits #661 (@anakinj)
• Base64 encode and decode the k value for HMAC JWKs #662 (@anakinj)

Take a look at the upgrade guide for more details.

Features:

• JWT::EncodedToken#verify! method that bundles signature and claim validation #647 (@anakinj)
• Do not override the alg header if already given #659 (@anakinj)
• Make JWK::KeyFinder compatible with JWT::EncodedToken #663 (@anakinj)

Fixes and enhancements:

• Ruby 3.4 to CI matrix #649 (@anakinj)

jwt-2.10.1

v2.10.1 (2024-12-26)

Full Changelog

Fixes and enhancements:

• Make version constants public again #646 (@anakinj)

jwt-2.10.0

v2.10.0 (2024-12-25)

Full Changelog

Features:

• JWT::Token and JWT::EncodedToken for signing and verifying tokens #621 (@anakinj)
• Detached payload support for JWT::Token and JWT::EncodedToken #630 (@anakinj)
• Skip decoding payload if b64 header is present and false #631 (@anakinj)
• Remove a few custom Rubocop configs #638 (@anakinj)

Fixes and enhancements:

• Deprecation warnings for deprecated methods and classes #629 (@anakinj)
• Improved documentation for public apis #629 (@anakinj)
• Use correct methods when raising error during signing/verification with EdDSA #633
• Fix JWT::EncodedToken behavior with empty string as token #640 (@ragalie)
• Deprecation warnings for rbnacl backed functionality #641 (@anakinj)

jwt-2.9.3

v2.9.3 (2024-10-03)

Full Changelog

Fixes and enhancements:

• Return truthy value for ::JWT::ClaimsValidator#validate! and ::JWT::Verify.verify_claims #628 (@anakinj)

jwt-2.9.2

v2.9.2 (2024-10-03)

Full Changelog

Features:

• Standalone claim verification interface #626 (@anakinj)

Fixes and enhancements:

• Updated README to correctly document OpenSSL::HMAC documentation #617 (@aedryan)
• Verify JWT header format #622 (@304)
• Bring back ::JWT::ClaimsValidator, ::JWT::Verify and a few other removed interfaces for preserved backwards compatibility #624 (@anakinj)