v5.0.0

5.0.0 (2026-07-02)

⚠ BREAKING CHANGES

• DigestMethod is not used when keyEncryptionAlgorithm is RSA 1.5 so has been removed from the encrypted payload
• keyEncryptionDigest values of sha256 or sha512 correctly use the http://www.w3.org/2001/04/xmlenc namespace when encrypting

Bug Fixes

• correct digest method and digest method algorithm id (#136) (586edd3)

v4.0.1

4.0.1 (2026-06-25)

Bug Fixes

• bump @xmldom/xmldom to 0.8.13 to address CVE-2026-34601 (#128) (5980ce6)

v4.0.0

4.0.0 (2026-03-31)

Features

• moving AES-128-CBC AES-256-CBC to the list of insecure algorithms (#123) (b03887a)

BREAKING CHANGES

• CBC algorithms are now marked insecure

v3.1.0

Add support for sha256/512 encryption key OAEP digest methods (#115)

v2.0.0

• BREAKING CHANGE: Drops support for Node 8
• Replaces node-forge with native crypto functions

v1.3.0

[SEC] Bumps xmldom minor version.
[SEC] Bumps glob-parent patch version

v1.2.3

Updated the xmldom dependency due to a vulnerability (CVE-2021-21366) in earlier versions.

v1.2.2

• Dev
  Remove test files to prevent false positive from SAST checks.

V1.2.0

fix: Moved sinon to devDependency to reduce prod dependency weight.

v1.1.0

Enhancements:

• feat: Add support for AES-GCM family (#67)
• feat: Add warning when insecure algorithm is used. (#68)