What's Changed
- test: mutation-testing audit — close test gaps, add Stryker tooling + manual CI by @yeojz in #865
- chore(deps-dev): bump vite from 8.0.14 to 8.0.16 by @dependabot[bot] in #864
- chore(deps): bump the github-actions group across 1 directory with 7 updates by @dependabot[bot] in #872
- chore(deps-dev): bump the dev-dependencies-minor group across 1 directory with 10 updates by @dependabot[bot] in #871
- chore(deps): bump commander from 14.0.3 to 15.0.0 by @dependabot[bot] in #866
- fix: reject unknown hash algorithms instead of silently substituting by @yeojz in #874
- test(fuzz): cover scalar HOTP counter tolerance semantics by @yeojz in #876
- chore(deps-dev): bump vite from 8.1.5 to 8.2.0 by @dependabot[bot] in #875
- fix: constrain esbuild for VitePress by @yeojz in #877
- chore(deps-dev): resolve dependabot alerts via pnpm overrides by @yeojz in #878
- chore(deps-dev): migrate to TypeScript 6.0.3 by @yeojz in #879
- docs: collapse API section by default by @yeojz in #880
- release(packages): v13.5.0 by @github-actions[bot] in #881
Full Changelog: v13.4.1...v13.5.0
Important behaviour change in this bugfix release.
Note
This is a bugfix release but has potentially breaking behaviour for library users passing invalid inputs (which is more likely in non-TypeScript or loosely-typed environments).
This release (#874) makes hash algorithm validation consistent and strict across all crypto plugins. Previously, an unrecognised algorithm string was handled differently by each plugin:
| input | noble | node | web |
|---|---|---|---|
'SHA1'
| silently computed SHA-512 | worked (OpenSSL alias tolerance) | threw a raw TypeError
|
'totally-bogus'
| silently computed SHA-512 | threw | threw |
All three now reject anything outside sha1/sha256/sha512 (case-insensitive, single-separator aliases like SHA-1 or sha_256 accepted) by throwing the new AlgorithmUnsupportedError, instead of silently substituting a different digest.
A library dependents passing a correctly-spelled algorithm name ('sha1', 'SHA1', 'sha-256', etc.) sees no change other than clearer, stricter errors on genuinely invalid input. In TypeScript-strict environments this is mostly moot as algorithm is typed as 'sha1' | 'sha256' | 'sha512', so a hardcoded typo like 'SHA1' won't compile. It can still surface if the value comes from outside the type system (e.g. JSON.parse, process.env, or an as HashAlgorithm cast).
If you were relying on noble's old silent fallback to SHA-512 for a misspelled or unrecognised algorithm string, tokens generated/verified that way will stop matching after upgrading with no error on the old side, just tokens that quietly stop verifying.
To recover
- Change algorithm to
sha512, - or re-enroll the affected accounts.
See "Existing enrollments stopped verifying after an upgrade" for details.