The purpose of this release is to fix a security vulnerability where Options.UseWhitelist was bypassed for JWTs without a kid header. Keys excluded by the whitelist, such as keys with a use of enc, could verify JWTs without a kid header. JWTs without a kid header are now also checked against the JWK alg parameter.
See GHSA-29f5-h73v-w8j9 for details. All users of v3.5.0 through v3.9.1 who set Options.UseWhitelist should upgrade.
Thank you @HotWater-015 for the report!
Relevant pull requests: