Skip to main content
interlace
Plugin: jwt

Changelog

Release history and version updates for eslint-plugin-jwt-security

Generated from the release history

Built from this package's CHANGELOG.md at deploy time, so it matches the version these docs describe. The full cross-package history lives on the changelog.

3.2.1

  • FixA computed or quoted option key is still a JWT option.

3.2.0

  • Fixevery JWT rule now sees jwt['sign'] as the same call as jwt.sign
  • Fixdecoded['exp'] is the same time claim as decoded.exp
  • Maintenanceno-decode-without-verify no longer casts an unnameable member
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.19.0

3.1.1

  • FixAdd an install-size badge to the README prelude, linking to each package's packagephobia page. npm renders the README from the last publish, so a badge only appears on npmjs.com after a release.
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.18.2

3.1.0

  • Feature🐛 Fix — a template literal is a string, in 82 rules that disagreed
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.18.0

3.0.3

  • Fixpoint meta.docs.url at documentation that exists #683
  • Fixno-decode-without-verify and require-expiration no longer report inside test files. #685
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.17.2

3.0.2

  • Five false positives that would have shipped a false claim. #635
  • DependenciesUpdated internal dependencies

3.0.1

  • no-xpath-injection now needs evidence rather than names, and every rule carries a CVSS. #563
  • DependenciesUpdated internal dependencies

3.0.0

  • no-algorithm-none no longer reports decoding, and the whole plugin now works #548
  • DependenciesUpdated internal dependencies

2.4.0

  • Presets now emit rule ids prefixed with the package's own name, so registering #531
  • no-decode-without-verify: detect jose's decodeJwt, and apply the #531

2.3.4

  • Stop matching JWT method names on files and receivers that have nothing to do with JWTs #475
  • DependenciesUpdated internal dependencies

2.3.3

  • Correct the declared ESLint floor: ^8.0.0 → ^8.40.0. #407
  • Test infrastructure only — no rule, config, or API behavior changes. These #329
  • Correct the ESLint peer range shown in the README Compatibility table. #423
  • Remove the superseded eslint-plugin-pg and eslint-plugin-jwt sources from #414
  • DependenciesUpdated internal dependencies

2.3.2

  • Ship the JavaScript without tsc's layout. #411
  • DependenciesUpdated internal dependencies

2.3.1

  • Complete the logo row across every published package. #377
  • Fix the ./oxlint subpath export, which pointed at src/oxlint.js — a file no build produces. require('<package>/oxlint') threw MODULE_NOT_FOUND on every published package, while every README documented that exact wiring for oxlint's jsPlugins. The export now points at the build output, dist/src/oxlint.js. #335
  • Fix SDK peer declarations that npm silently ignored #335
  • DependenciesUpdated internal dependencies

2.2.2

  • align codecov component names and update docs components
  • Ofri Peretz

1.0.0

  • no-algorithm-none - Prevent alg:"none" attack (CVE-2022-23540, CWE-347)
  • no-algorithm-confusion - Prevent RS256→HS256 key confusion (CWE-347)
  • require-algorithm-whitelist - Require explicit algorithm specification (CWE-757)
  • no-decode-without-verify - Prevent trusting decoded payloads (CWE-345)
  • no-weak-secret - Require 256-bit minimum secrets (CWE-326)
  • no-hardcoded-secret - Prevent secrets in source code (CWE-798)
  • require-expiration - Require exp claim or expiresIn (CWE-613)
  • require-issued-at - Require iat claim for freshness (CWE-294)
  • require-issuer-validation - Require issuer validation (CWE-287)
  • require-audience-validation - Require audience validation (CWE-287)
  • no-timestamp-manipulation - Prevent noTimestamp: true (CWE-294)
  • require-max-age - Require maxAge for replay prevention (CWE-294)
  • no-sensitive-payload - Prevent PII in token payload (CWE-359)
  • recommended - Balanced security (critical=error, high=warn)
  • strict - Maximum security with all 13 rules enabled
  • legacy - Migration mode with only critical rules
  • jsonwebtoken
  • jose
  • express-jwt
  • @nestjs/jwt
  • jwks-rsa
  • jwt-decode
  • AI-optimized error messages using formatLLMMessage
  • CWE references for all rules (9 CWEs covered)
  • OWASP Top 10 2021 coverage matrix (6 categories)
  • Full TypeScript support
  • Comprehensive test coverage (248 edge case tests)

3.2.2

  • FixThe README logo now links to the plugin's own documentation.

2.2.9

  • Rewrite description and keywords on every published package for npm search discovery. npm ranks on name, description, and keywords, and the registry only picks up these fields at publish — so this is metadata-only and takes effect for each package on its next release. #294
  • DependenciesUpdated internal dependencies

2.2.8

  • Docsdocs: dual-logo README header (Interlace mark + ESLint mark side by side) and closing Interlace footer — refreshes the README rendered on npmjs.com. No runtime changes. #269
  • DependenciesUpdated internal dependencies

2.2.7

  • Fix Codecov badge showing "unknown" — switch from flag to component URL format #252

2.2.6

  • CI-only: pin all coverage thresholds at 100% (integration target, merges last). #225

2.2.5

  • Align every security rule's meta.docs.cvss to the CVSS its finding actually #213

2.2.4

  • Fixfix(no-missing-null-checks): eliminate 53 false positives via three new narrowing patterns #143
  • DependenciesUpdated internal dependencies
  • align codecov component IDs with full package names
  • fix changelog header format across all packages
  • Ofri Peretz

View on GitHub →

Building secure JavaScript with Interlace? Star the repo to get new rules and CWE coverage as we ship them — or follow the AI-code-security benchmarks behind them.

Follow the benchmarksStar on GitHub

eslint-plugin-jwt-security

JSON Web Token security patterns and validation rules

Rules

All ESLint security rules provided by eslint-plugin-jwt-security