jose_plus 1.0.0

Javascript Object Signing and Encryption (JOSE) library supporting JWE, JWS, JWK and JWT

1.0.0

Note: This release has breaking changes.

• FIX: resolve all four library bugs; drive honest unit coverage to ~95% (#368). (c86bee17)
• FIX(ci): stop swallowing web test failures; pin dart:io fixture tests to vm (#363). (6102d835)
• FIX(release): add package-name entrypoints for jose_plus and x509_plus. (4bbcb7f3)
• FIX(jose_plus): normalize crypto_keys_plus/x509_plus constraints to caret syntax. (d0a1d55d)
• FEAT(crypto): RSASSA-PSS (PS256/384/512) + EdDSA/Ed25519. (6c5c6741)
• BREAKING FEAT: consolidate jose_plus, crypto_keys_plus, x509_plus into the workspace. (3fffc6cd)

0.4.8

• FIX: JWE JSON parsing now handles missing recipients / header by deriving a single recipient from the protected header and validates absent encrypted_key for non-dir algorithms.
• FEAT: Support unpadded Base64URL protected header (new parsing test).
• TEST: Added fallback, AAD, key wrap, and error path tests.
• CHORE: Refactored JsonWebEncryption.fromJson for clarity.

0.5.0 - 2026-05-11

Features

• add support for es256k algorithm (a2d046a)
• implement ECDH-ES key agreement (ECDH-ES, ECDH-ES+A*KW) (280ccaa)
• publish jose_plus (35d4471)
• remove dependency on package:collection (77f99be)
• support compressed data in jwe (4f1dd72)
• Updated dependencies: crypto_keys_plus and x509_plus (d24a89f)
• Updated dependencies: crypto_keys_plus to 0.5.0 and x509_plus to 0.3.3. (d2d8b1d)
• use clock package (a762b4a)
• use clock package (157694d)

Bug Fixes

• 26 (b91fb1e)
• add missing keyId when constructing a JWK with EcPublicKey (pull request #38 from tallinn1960) (b8d11f3)
• allow double values when converting to DateTime and Duration (pull request #33 from PixelToast) (3b204b1)
• check if the keyIds exist before checking for the keyId mismatch (a16a31c)
• check if the keyIds exist before checking for the keyId mismatch (4d5feb5)
• improved key resolution in JsonWebKeyStore (b07799a)
• jwe: fallback parsing for missing recipients/header, support unpadded protected header; refactor fromJson and add focused tests (fallback, AAD, key wrap, error paths). (ef8b783)
• key_ops JWK field according to the RFC (pull request #62 from sgt) (331df9f)
• make unprotected header in JWE optional (pull request #43 from heacare) (aefeeb0)
• merge upstream - fix JWK header key trust vulnerability (a0b51cd)
• parse jws from json with multiple signatures (#57) (87215b7)
• parsing jws from json (d4b19d2)
• parsing jws from json (05c04f4)
• proper error when there is a missing audience claim. (05f4db7)
• try all keys when kid is absent (8fd4860)
• type mismatch error on keyOperations getter (pull request #37 from samataro) (8afde0f)
• use 12 byte iv with AESGCM (pull request #39 from tallinn1960) (5b7e24d)

Code Refactoring

• support for archive ^4.0.0 (d6150a5)

0.4.7

• DEPS: Remove dependency on package:collection
• UPGRADE: Updated to use crypto_keys_plus 0.5.0 which uses pointycastle 4.0.0.
• UPGRADE: Updated to use x509_plus 0.3.3.

0.4.6

• FIX: parsing jws from json. (05c04f43)

0.4.5

• FIX: check if the keyIds exist before checking for the keyId mismatch. (4d5feb5a)

0.4.4

• FIX: proper error when there is a missing audience claim. (05f4db75)
• FEAT: use clock package. (157694d6)

0.4.3

• fix: proper error when there is a missing aud claim.

0.4.2

• feat: add sid to JWT claims.

0.4.1

• FIX: lower package:collection constraints.

0.4.0

• FIX: use x509_plus and crypto_keys_plus.

0.3.5+1

• FIX: try all keys when kid is absent. (8fd48600)
• FIX: parse jws from json with multiple signatures (#57). (87215b78)
• FIX: key_ops JWK field according to the RFC (pull request #62 from sgt). (331df9ff)
• FIX: improved key resolution in JsonWebKeyStore. (b07799aa)

0.3.5

• REFACTOR: support for archive ^4.0.0. (d6150a5a)
• FEAT: support compressed data in jwe. (4f1dd72d)

0.3.4

• FEAT: Support latest package:http (#50)

0.3.3

• FIX: allow double values when converting to DateTime and Duration (pull request #33 from PixelToast). (3b204b10)
• FIX: type mismatch error on keyOperations getter (pull request #37 from samataro). (8afde0fd)
• FIX: add missing keyId when constructing a JWK with EcPublicKey (pull request #38 from tallinn1960). (b8d11f32)
• FIX: use 12 byte iv with AESGCM (pull request #39 from tallinn1960). (5b7e24da)
• FIX: make unprotected header in JWE optional (pull request #43 from heacare). (aefeeb04)
• FEAT: add support for es256k algorithm. (a2d046a3)

0.3.2

• Compatible with version 0.3.0 of crypto_keys

0.3.1

• JsonWebKey.parsePem handles CERTIFICATE
• DefaultJsonWebKeySetLoader: if possible, use HTTP headers to determine cache expiration.

0.3.0

• Migrate null safety

0.2.2

• Bump asn1lib to 0.8.1.

0.2.1+1

• Fix docs

0.2.1

• Added JsonWebKey constructors for creating EC and RSA keys
• Added factory constructor for creating a JsonWebKey from crypto keys
• Added factory constructor for creating a JsonWebKey from a pem string
• Support for P-256K curve

0.2.0

• Support RSAES-OAEP
• Allow x509 parameters in JWK
• JsonWebAlgorithm class
• Generating random non-symmetric keys
• cryptoKeyPair getter on JsonWebKey returning a KeyPair from crypto_keys package
• Breaking Change: loading jwk set from package or file url no longer supported by default. The new class JsonWebKeySetLoader can be used to override this behavior or manage the way jwk sets are loaded from an url.

0.1.2

• Add allowedAlgorithms argument also in JWT

0.1.1

• Fix security issue: JWS with algorithm none was previously verified, now you can specify which algorithms are allowed and by default none is not allowed.

0.1.0

• Initial version