php-web-token-jwt-framework (4.2.7-2) unstable; urgency=medium

  * Skip failing tests on 32-bit and big endian architectures

 -- David Prévot <taffit@debian.org>  Tue, 10 Nov 2026 10:15:41 +0100

php-web-token-jwt-framework (4.2.7-1) unstable; urgency=medium

  [ Florent Morselli ]
  * Parse the signatures of a JSON general JWS in linear time
    (GHSA-jgv7-g4jg-6hqv)
  * Bound the JSON values a token may hold before decoding it
    (GHSA-2xq2-pp89-x7fr)
  * Blind the RSA private key operations (GHSA-2qpx-pwmq-r27r)
  * Reject RSA representatives equal to the modulus (GHSA-2qpx-pwmq-r27r)
  * Refuse a direct encryption key shorter than the CEK (GHSA-jc6j-46g2-xwqc)
  * Require an empty encrypted key with dir, ECDH-ES and ECDH-SS
    (GHSA-5cc5-v8qv-6cw7)
  * Bound RSA keys to the limits of OpenSSL before computing with them
    (GHSA-96f8-m4jr-72xj)
  * Keep the keys out of the exception traces of a rejected JWE
    (GHSA-7hp7-mg7x-hww4)
  * Keep the decrypted content of a nested token out of the exception traces
    (GHSA-7hp7-mg7x-hww4)
  * Make the OpenSSL refusal of an ECDH public key final (GHSA-wwq7-mh3q-hwrh)
  * Share the PBES2 iteration count cap between the recipients of a token
    (GHSA-3vqw-452c-g726)
  * Let the loaders bound the number of recipients and signatures
    (GHSA-3vqw-452c-g726)
  * Decrypt exactly one RSA-OAEP block of the modulus length
    (GHSA-wwcr-82mc-w3pw)
  * Refuse AES key wrapping keys shorter than the algorithm key size
    (GHSA-4mxj-75j2-j8hc)
  * fix(core): repair the conditional swap of the elliptic curve points
  * fix(checker): accept a value only when the callable returns true
  * Keep an x5u entry from naming a local file
  * fix: refuse header checkers that a loader factory cannot apply
  * fix(key-mgmt): include the request headers in the key of the JKU/X5U cache
  * Compute ECDH-SS from the two static keys only
  * fix(core): reject the bytes outside the alphabet on the sodium path
  * fix(bundle): stop merging the alias lists of a service by position
  * fix(key-mgmt): keep the JKU/X5U requests whose headers cannot be serialized
  * fix(bundle): keep the key attribute of the alias lists

  [ David Prévot ]
  * Update copyright (email address)
  * Set upstream metadata fields: Bug-Database, Bug-Submit, Repository,
   Repository-Browse, Security-Contact

 -- David Prévot <taffit@debian.org>  Mon, 09 Nov 2026 10:13:05 +0100

php-web-token-jwt-framework (4.2.5-1) unstable; urgency=medium

  * Initial release (Symfony build-dependency)

 -- David Prévot <taffit@debian.org>  Sun, 08 Nov 2026 14:57:00 +0100