Warning
⚠️ This is a security release. Update JWTKit as soon as possible. If you use vapor/jwt, update to version 5.2.0 alongside it. ⚠️
This release addresses several security advisories, including issues in JWT header parsing, X.509 certificate validation, and identity-token audience handling. Applications verifying identity tokens should migrate to verify(..., expectedAudience:) or expectedAudiences:. The audience-free API remains available for compatibility but is deprecated and warns at runtime.
What's Changed
- Cache HMAC key by @ptoffy in #261
- Use outside base64 implementation by @ptoffy in #257
- Bump Swift Crypto and 6.4 watchOS version requirement by @ptoffy in #263
Full Changelog: 5.7.1...5.8.0