Skip to content

chore(deps): bump jws from 3.2.2 to 3.2.3#328

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/jws-3.2.3
Open

chore(deps): bump jws from 3.2.2 to 3.2.3#328
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/jws-3.2.3

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Dec 4, 2025

Bumps jws from 3.2.2 to 3.2.3.

Release notes

Sourced from jws's releases.

v3.2.3

Changed

  • Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.
  • Upgrading JWA version to 1.4.2, addressing a compatibility issue for Node >= 25.
Changelog

Sourced from jws's changelog.

[3.2.3]

Changed

  • Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.
  • Upgrading JWA version to 1.4.2, adressing a compatibility issue for Node >= 25.

[3.0.0]

Changed

2.0.0 - 2015-01-30

Changed

  • BREAKING: Default payload encoding changed from binary to utf8. utf8 is a is a more sensible default than binary because many payloads, as far as I can tell, will contain user-facing strings that could be in any language. (6b6de48)

  • Code reorganization, thanks @​fearphage! (7880050)

Added

  • Option in all relevant methods for encoding. For those few users that might be depending on a binary encoding of the messages, this is for them. (6b6de48)
Commits
  • 4f6e73f Merge commit from fork
  • bd0fea5 version 3.2.3
  • 7c3b4b4 Enhance tests for HMAC streaming sign and verify
  • a9b8ed9 Improve secretOrKey initialization in VerifyStream
  • 6707fde Improve secret handling in SignStream
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by julien.wollscheid, a new releaser for jws since your current version.


@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Dec 4, 2025
andreabadesso added a commit that referenced this pull request Feb 25, 2026
Consolidates 30 dependabot PRs into a single update:

Direct dependency bumps:
- axios: 0.21.1 → 1.13.5 (wallet-service), 1.6.2 → 1.13.5 (daemon)
- eslint: ^8.57.0 → ^9.26.0 (root)
- jsonwebtoken: 8.5.1 → 9.0.0 (wallet-service)
- lodash: 4.17.21 → 4.17.23 (daemon, wallet-service)
- mysql2: ^3.9.3 → ^3.9.8 (root), 2.2.5 → 3.9.8 (wallet-service), 3.5.2 → 3.9.8 (daemon)
- webpack: 5.88.2 → 5.104.1 (wallet-service)
- ws: 8.13.0 → 8.17.1 (daemon)

Transitive dependency updates via yarn.lock regeneration:
qs, diff, jws, node-forge, sha.js, tar-fs, js-yaml, base-x,
@babel/helpers, serialize-javascript, elliptic, cross-spawn,
secp256k1, tar, jose, es5-ext, ip, @babel/traverse, validator

Closes #368, #366, #365, #364, #361, #353, #348, #347, #345, #344
Closes #328, #323, #318, #316, #315, #314, #258, #220, #215, #214
Closes #197, #191, #188, #187, #157, #142, #139, #126, #124, #123

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@luislhl
Copy link
Copy Markdown
Collaborator

luislhl commented May 4, 2026

@dependabot rebase

Bumps [jws](https://github.com/brianloveswords/node-jws) from 3.2.2 to 3.2.3.
- [Release notes](https://github.com/brianloveswords/node-jws/releases)
- [Changelog](https://github.com/auth0/node-jws/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jws@v3.2.2...v3.2.3)

---
updated-dependencies:
- dependency-name: jws
  dependency-version: 3.2.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/jws-3.2.3 branch from 26db4e1 to 1f3a898 Compare May 4, 2026 20:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant