Releases: hellocoop/packages-js
Release list
@hellocoop/email-verification@3.1.0
@hellocoop/email-verification@3.0.1
@hellocoop/httpsig@2.2.0
content-digest auto-coverage: new contentDigest option ('auto' | 'require' | 'omit', default 'auto') appends content-digest to signed components for digestible bodies; generateContentDigest now throws on unhandled body types; VerifyOptions.requireContentDigest lets a PS/AS enforce AAuth -11 §10.3 (body requests must cover content-digest and content-type).
@hellocoop/httpsig@2.1.0
What's Changed
- httpsig 2.1.0: one RFC 8941 parser, and two signature verification bugs it found by @dickhardt in #68
Full Changelog: https://github.com/hellocoop/packages-js/compare/@hellocoop/email-verification@3.0.0...@hellocoop/httpsig@2.1.0
Contributors
Assets 2
@hellocoop/httpsig@2.0.1
@hellocoop/email-verification@3.0.0
@hellocoop/email-verification@2.2.1
What's Changed
- ci: make lint pass, so tests actually run by @dickhardt in #67
Full Changelog: https://github.com/hellocoop/packages-js/compare/@hellocoop/httpsig@2.0.0-alpha.2...@hellocoop/email-verification@2.2.1
Contributors
Assets 2
@hellocoop/httpsig@2.0.0-alpha.2
Tracks draft-hardt-httpbis-signature-key-08, published to the IETF datatracker on 2026-08-05.
Published under the alpha dist-tag — npm install @hellocoop/httpsig still gives you 1.x.
npm install @hellocoop/httpsig@alpha
145 tests. See MIGRATING-2.0.md.
Since 2.0.0-alpha.1
Discovery metadata must carry a matching issuer. The document at {id}/.well-known/{dwk} must contain an issuer equal to id, compared by byte equality with no normalization. New issuer_missing and issuer_mismatch error codes.
This is a real security fix. 1.x followed jwks_uri wherever the metadata pointed, so a subdomain takeover or shared-hosting misconfiguration could get requests attributed to an identity that never signed them. It is the check RFC 8414 Section 3.3 requires of authorization server metadata. Documents conforming to RFC 8414 or OpenID Connect Discovery already carry issuer; a hand-rolled .well-known that omits it will now be rejected.
supportedAlgorithms lets a verifier declare which algorithms it accepts. A key outside the set is rejected with unsupported_algorithm, and the set comes back as acceptSignatureAlg for an Accept-Signature-Alg response header — deliberately not inside SignatureError, whose supported_algorithms member -08 removed. Defaults to everything the library implements, exported as SUPPORTED_ALGORITHMS.
Unusable keys elsewhere in a JWKS are skipped. Already the behaviour; now specified and tested, including an unparseable ML-DSA key placed before and after the usable one. Without this rule no issuer could ever add a post-quantum key alongside a classical one.
The alg signature parameter is ignored, and proven so — tests sign by hand with a misleading alg to confirm the key decides which operation runs.
Corrected the tracked revision to -08. alpha.0 and alpha.1 said -07, which was published on 2026-07-05 and was editorial. The hwk alg parameter was forbidden in -06 and -07 and becomes required in -08.
Known gaps
jwks,self-jwt,x509not implemented — additive, not breaking- Assertion caching deliberately omitted; the draft calls it a straw man
- RFC 9421 and Go interop vectors predate this specification and do not cover
signature-key, so they now assert rejection. Replacement coverage: dickhardt/signature-key#25
@hellocoop/httpsig@1.7.1
Security fix for the JWKS cache.
The JWKS cache was an unbounded Map with TTL checks on read and no eviction. Its key is a URL built from the request being verified — ${id}/.well-known/${dwk} and the jwks_uri discovered from it — so an unauthenticated signer chose the key by varying the id and dwk it presented, and could grow the map until the process ran out of memory. There was no work factor: each entry cost one request.
It is now a bounded LRU cache holding at most 100 entries. Eviction prefers an already-expired entry over a live one, so ordinary traffic keeps its working set while an attacker's entries are displaced first.
The cache is internal — nothing in the public API changes, and this is a drop-in upgrade from 1.7.0.
This release is cut from the new 1.x maintenance branch.
@hellocoop/httpsig@2.0.0-alpha.1
Corrects the tracked draft revision. This package tracks draft-hardt-httpbis-signature-key-08, not -07.
-07 was published to the IETF datatracker on 2026-07-05 and was editorial — a paragraph in the Introduction citing AAuth and Email Verification. All the normative work this package implements lands in -08. 2.0.0-alpha.0 said -07 throughout, including in its bundled README and migration guide.
In particular the hwk alg parameter was forbidden in -06 and -07, and becomes required in -08. The break this package straddles is -07 → -08.
No functional change from 2.0.0-alpha.0 — 132 tests, same behaviour. Documentation and comments only.
Published under the alpha dist-tag; npm install @hellocoop/httpsig still gives you 1.x.
npm install @hellocoop/httpsig@alpha
See MIGRATING-2.0.md.