1.11.13 (2026-10-26)

• Security Patches
  • GHSA-wfpv-qxp8-x5gm, GHSA-wh8p-p48q-3vw2: Bound incremental JWE zip: "DEF" decompression to 1 MiB by default. Applications requiring larger compressed plaintexts can set jose:zip_size_maximum/1 or the zip_size_maximum application environment key.
  • GHSA-44hw-rpw9-mwg4: Require the canonical ECDSA signature length for ES256, ES384, ES512 and ES256K.
  • GHSA-6gxw-6f7r-cjr6: Reject AEAD tags other than 128 bits before provider dispatch, and in the AES-GCM fallback.
  • GHSA-3m45-vrpj-xmrq: Bound RSA private-key prime recovery with random trials, reused modular squares and deadlines checked before expensive operations; validate recovered factors against the supplied exponents. Keys above 8192 bits or exhausting the recovery budget must supply CRT parameters.
  • GHSA-fpj2-9h59-32pp: Reject mismatched shared-secret key types instead of recursing indefinitely.
  • GHSA-h4gx-8jq2-mfhc: Strengthen encrypted PKCS#8 DER and PEM exports to PBKDF2-HMAC-SHA256 with 600,000 iterations and 16-byte salts. Previously exported keys remain readable. Use native PBKDF2 when available.
  • GHSA-vwvr-f994-6j9j: Substitute a random CEK of the required length on RSA JWE unwrap failure, then authenticate the content. Low-level RSA padding helpers still report errors; this mitigation does not guarantee constant-time RSA. Prefer RSA-OAEP or RSA-OAEP-256.
  • GHSA-xvr2-gggj-h2pp: Correct the shipped crypto_fallback default to false and document the variable-time pure Erlang curve implementations. Explicitly enabled fallback remains variable-time and should not handle long-lived private keys where timing is observable.
• Fixes
  • Return compressed JWE authentication failures without invoking decompression, including external AAD.
  • Preserve native Ed448/X448 selection when fallback SHAKE256 is unavailable; include X25519/X448 agreement in provider checks.
  • Add public API security regressions and independent legacy PKCS#8 import checks.
  • Treat a random base sharing a factor with the modulus as a failed RSA prime recovery trial, so inconsistent (n, e, d) keys are rejected instead of imported with a composite factor.
  • Return <<>> from Concat KDF for a zero key length instead of looping indefinitely, and reject negative lengths with badarg.
  • Erlang/OTP 29 compatibility: decode X25519/X448 PKCS#8 private keys, encode EC SubjectPublicKeyInfo DER, and replace deprecated catch Expr expressions.
• Notes
  • Deployments relying on unavailable native algorithms must explicitly enable crypto_fallback and review the timing limitations. Native providers remain preferred.
  • Tested on Erlang/OTP 28 and 29.

1.11.12 (2025-11-20)

• Fixes
  • Properly handle nil from Elixir maps when encoding with the builtin json Erlang/OTP module; see #184
  • Drop required Elixir version back from 1.16 -> 1.13; see #185

1.11.11 (2025-11-17)

• Fixes
  • EC key decode/encode issues in OTP 28; see #180, #181, #182, #179
  • EdDSA key issues with OTP 27.1.3+; see #177
• Notes
  • This will hopefully be one of the last 1.x releases, next release will be 2.x

• Fixes
  • Various type spec fixes; see #165 and #166.

• Fixes
  • Removes use of dynamic() type spec so OTP 24 and OTP 25 are still supported for now.

• Security Patches
  • CVE-2023-50966: Add jose:pbes2_count_maximum/0. By default, the maximum iterations are set to 10,000 and it will raise an error if p2c is larger than this value.
• Changes
  • Declare Poison as an optional dependency, thanks to [@lnikkila][https://github.com/lnikkila]; see #144.
  • Ensure jiffy:encode/1 returns a binary, thanks to @ssepml; see #145.
  • Various type spec additions and dialyzer/dialyxir integrations, thanks to @whatyouhide and @maennchen.
  • Doc updates and fixes, thanks to @aymanosman and @adamu; see #158 and #159.

1.11.6 (2023-07-18)

• Fixes
  • Use sha256 instead of sha when validating RSA signing supportability, thanks to @pavledjo; see #142.

• Fixes
  • Remove dependency on parse_transform for jose_base64 and jose_base64url.

• Enhancements
  • Add support for native crypto operations for Ed25519 and Ed448, thanks to @brettbeatty; see #123.
  • Add support for native crypto operations for ChaCha20-Poly1305 and XChaCha20-Poly1305, when available.
  • Add support for libsodium operations for XChaCha20-Poly1305, when available.
  • Add support for thoas JSON encode/decode, thanks to @michaelklishin; see #126.
  • Add support for ES256K which uses the secp256k1 curve and RS1 signatures (see 291dbb8).
  • Add support for ECDH-1PU JOSE.JWK.box_encrypt_ecdh_1pu and ECDH-ES JOSE.JWK.box_encrypt_ecdh_es and document the deprecated JOSE.JWK.box_encrypt.
  • Add support for ECDH-SS JOSE.JWK.box_encrypt_ecdh_ss.
  • Hide kty field when inspecting %JOSE.JWK{} strict, thanks to @spencerdcarlson; see #139
• Fixes
  • Version mismatch causing rebar3 to constantly try to update; see #122.
  • Fix Ed25519 and Ed448 key DER/PEM encode/decode for OTP 25.
  • Fix Ed25519ctx, Ed25519ph, Ed448, and Ed448ph when dealing with contexts so the implementation matches IETF RFC 8032.
  • Drop direct usage of crypto:hmac/4, thanks to @thalesmg; see #136
  • Replace incorrect usage of -include_lib with -include, thanks to @Richiban; see #140
  • Update the CI jobs so they actually run the Elixir tests, thanks to @moogle19; see #137
  • Change the master branch to main.

• Fixes
  • Add PEM/DER compatibility layer for PKCS-8 incompatibilities with various versions of OTP, crypto, and public_key; see #82