@hilbras/keystone 1.4.0 → 1.5.0

package/CHANGELOG.md

@@ -95,6 +95,24 @@ Fastify ecosystem upgrades — all plugins updated to latest major versions.
 - **@fastify/static** 8.3.0 → 10.1.4
 - **@fastify/swagger-ui** 5.2.6 → 6.1.1
 
+## [1.5.0] - 2026-09-20
+
+Auth & infrastructure upgrades — jose 6, ioredis 6, bullmq 6, simplewebauthn 14, nodemailer 10.
+
+### Changed
+
+- **jose** 5.10.0 → 6.2.12 — `KeyLike` type removed, replaced with `CryptoKey`.
+- **ioredis** 5.11.1 → 6.0.0
+- **bullmq** 5.80.2 → 6.3.8
+- **@simplewebauthn/server** 13.3.2 → 14.0.2 — `AuthenticatorTransportFuture` renamed to `AuthenticatorTransport`.
+- **nodemailer** 9.0.3 → 10.0.10
+
+### Fixed
+
+- **jose 6 migration** — Replaced `KeyLike` with `CryptoKey` in secrets provider, tokens service, and database/environment secrets providers.
+- **simplewebauthn 14 migration** — Renamed `AuthenticatorTransportFuture` to `AuthenticatorTransport` in webauthn service.
+
+[1.5.0]: https://github.com/Hilbras/Keystone/releases/tag/v1.5.0
 [1.4.0]: https://github.com/Hilbras/Keystone/releases/tag/v1.4.0
 [1.3.0]: https://github.com/Hilbras/Keystone/releases/tag/v1.3.0
 [1.2.0]: https://github.com/Hilbras/Keystone/releases/tag/v1.2.0

package/README.md

@@ -20,6 +20,10 @@ Keystone is a **standalone identity platform**, not a wrapper around another ide
 
 ---
 
+## What's new in v1.5.0
+
+- **Auth & infrastructure upgrades** — jose 6, ioredis 6, bullmq 6, @simplewebauthn/server 14, nodemailer 10. Updated KeyLike→CryptoKey for jose 6 and AuthenticatorTransportFuture→AuthenticatorTransport for simplewebauthn 14.
+
 ## What's new in v1.4.0
 
 - **Fastify ecosystem upgrades** — fastify-plugin 6, @fastify/cookie 11, @fastify/cors 11, @fastify/static 10, @fastify/swagger-ui 6. All plugins updated to latest major versions with no code changes required.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hilbras/keystone",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "type": "module",
   "files": [
     "dist",
@@ -41,17 +41,17 @@
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/auto-instrumentations-node": "^0.80.0",
     "@opentelemetry/sdk-node": "^0.222.0",
-    "@simplewebauthn/server": "^13.3.2",
+    "@simplewebauthn/server": "^14.0.2",
     "argon2": "^0.45.1",
-    "bullmq": "^5.80.2",
+    "bullmq": "^6.3.8",
     "commander": "^15.0.0",
     "dotenv": "^18.0.1",
     "drizzle-orm": "^0.45.2",
     "fastify": "^5.12.5",
     "fastify-plugin": "^6.0.0",
-    "ioredis": "^5.4.0",
-    "jose": "^5.6.0",
-    "nodemailer": "^9.0.3",
+    "ioredis": "^6.0.0",
+    "jose": "^6.2.12",
+    "nodemailer": "^10.0.10",
     "otpauth": "^9.5.2",
     "postgres": "^3.4.4",
     "prom-client": "^15.1.3",

package/src/services/secrets/database.ts

@@ -1,6 +1,6 @@
 import crypto from "node:crypto";
 import { eq, and, or, gt, isNull } from "drizzle-orm";
-import { importPKCS8, importSPKI, exportPKCS8, exportSPKI, generateKeyPair, type KeyLike } from "jose";
+import { importPKCS8, importSPKI, exportPKCS8, exportSPKI, generateKeyPair } from "jose";
 import { db } from "../../db/index.js";
 import { secrets, type Secret } from "../../db/schema.js";
 import { config } from "../../config.js";

package/src/services/secrets/environment.ts

@@ -1,5 +1,5 @@
 import crypto from "node:crypto";
-import { importPKCS8, importSPKI, exportPKCS8, exportSPKI, generateKeyPair, type KeyLike } from "jose";
+import { importPKCS8, importSPKI, exportPKCS8, exportSPKI, generateKeyPair } from "jose";
 import { config } from "../../config.js";
 import type { SecretsProvider, SigningKeyPair } from "./provider.js";
 import { hashPassword, verifyPassword } from "./password.js";

package/src/services/secrets/provider.ts

@@ -1,9 +1,7 @@
-import type { KeyLike } from "jose";
-
 export interface SigningKeyPair {
   keyId: string;
-  privateKey: KeyLike | Uint8Array;
-  publicKey: KeyLike;
+  privateKey: CryptoKey | Uint8Array;
+  publicKey: CryptoKey;
 }
 
 export interface SecretsProvider {

package/src/services/tokens.ts

@@ -7,7 +7,6 @@ import {
   decodeProtectedHeader,
   exportJWK,
   type JWTPayload,
-  type KeyLike,
 } from "jose";
 import { eq, and, gt, isNull } from "drizzle-orm";
 import { db } from "../db/index.js";

package/src/services/webauthn.ts

@@ -7,7 +7,7 @@ import {
   verifyAuthenticationResponse,
   type RegistrationResponseJSON,
   type AuthenticationResponseJSON,
-  type AuthenticatorTransportFuture,
+  type AuthenticatorTransport,
 } from "@simplewebauthn/server";
 import { db } from "../db/index.js";
 import {
@@ -114,7 +114,7 @@ export async function verifyAndStoreRegistration(
     credentialId: credential.id,
     publicKey: Buffer.from(credential.publicKey).toString("base64url"),
     counter: credential.counter,
-    transports: (credential.transports || []) as AuthenticatorTransportFuture[],
+    transports: (credential.transports || []) as AuthenticatorTransport[],
     aaguid: info.aaguid || null,
     deviceName: deviceName || null,
   });
@@ -124,7 +124,7 @@ export async function verifyAndStoreRegistration(
 
 export async function buildAuthenticationOptions(email?: string) {
   let allowCredentials:
-    | { id: string; type: "public-key"; transports?: AuthenticatorTransportFuture[] }[]
+    | { id: string; type: "public-key"; transports?: AuthenticatorTransport[] }[]
     | undefined;
   let userId: string | undefined;
 
@@ -136,7 +136,7 @@ export async function buildAuthenticationOptions(email?: string) {
       allowCredentials = credentials.map((c) => ({
         id: c.credentialId,
         type: "public-key" as const,
-        transports: (c.transports || []) as AuthenticatorTransportFuture[],
+        transports: (c.transports || []) as AuthenticatorTransport[],
       }));
     }
   }
@@ -167,7 +167,7 @@ export async function verifyAuthentication(response: AuthenticationResponseJSON,
       id: credential.credentialId,
       publicKey: Buffer.from(credential.publicKey, "base64url"),
       counter: credential.counter,
-      transports: (credential.transports || []) as AuthenticatorTransportFuture[],
+      transports: (credential.transports || []) as AuthenticatorTransport[],
     },
     requireUserVerification: false,
   });