@sourceregistry/node-jwt 1.5.3 → 1.5.6

package/README.md

@@ -1,6 +1,7 @@
 # 🔐 @sourceregistry/node-jwt
 
 [![npm version](https://img.shields.io/npm/v/@sourceregistry/node-jwt?logo=npm)](https://www.npmjs.com/package/@sourceregistry/node-jwt)
+[![JSR](https://jsr.io/badges/@sourceregistry/node-jwt)](https://jsr.io/@sourceregistry/node-jwt)
 [![License](https://img.shields.io/npm/l/@sourceregistry/node-jwt)](https://github.com/SourceRegistry/node-jwt/blob/main/LICENSE)
 [![CI](https://github.com/SourceRegistry/node-jwt/actions/workflows/test.yml/badge.svg)](https://github.com/SourceRegistry/node-jwt/actions)
 [![Codecov](https://img.shields.io/codecov/c/github/SourceRegistry/node-jwt)](https://codecov.io/gh/SourceRegistry/node-jwt)
@@ -214,6 +215,30 @@ See runnable examples in:
 * ✅ Timing-safe signature comparison
 * ✅ No insecure defaults
 
+## ✅ Production Checklist
+
+Use this profile in production verification paths:
+
+```ts
+import { verify } from '@sourceregistry/node-jwt';
+
+const result = verify(token, publicKeyOrSecret, {
+  algorithms: ['RS256'],           // pin expected algorithm(s)
+  issuer: 'https://issuer.example',
+  audience: 'my-service',
+  clockSkew: 30,                   // seconds
+  maxTokenAge: 3600                // seconds
+});
+```
+
+Recommended operational checks:
+
+* Pin `algorithms` in every verify call (do not rely on implicit acceptance).
+* Always validate `issuer` and `audience` for external tokens.
+* Use short token lifetimes and enforce `maxTokenAge`.
+* Rotate keys regularly and configure JWKS cache `ttl` for your threat model.
+* Monitor and alert on verification failures (`INVALID_SIGNATURE`, `INVALID_CLAIM`, `INVALID_OPTIONS`).
+
 ---
 
 ## 🔏 ECDSA Signature Format: DER vs JOSE (New)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sourceregistry/node-jwt",
-  "version": "1.5.3",
+  "version": "1.5.6",
   "description": "A lightweight, zero-dependency TypeScript library for creating, verifying and decoding JSON Web Tokens (JWT).",
   "main": "./dist/index.cjs.js",
   "module": "./dist/index.es.js",
@@ -62,9 +62,10 @@
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/commit-analyzer": "^13.0.1",
     "@semantic-release/git": "^10.0.1",
-    "@semantic-release/npm": "^12.0.2",
+    "@semantic-release/npm": "^13.1.5",
     "@semantic-release/release-notes-generator": "^14.0.3",
-    "@types/node": "^25.3.0",
+    "@sourceregistry/semantic-release-jsr": "^1.0.1",
+    "@types/node": "^25.3.3",
     "@vitest/coverage-v8": "^4.0.18",
     "@vitest/ui": "^4.0.18",
     "typedoc": "^0.28.17",
@@ -81,15 +82,22 @@
       "@semantic-release/commit-analyzer",
       "@semantic-release/release-notes-generator",
       "@semantic-release/changelog",
-      "@semantic-release/npm",
+      [
+        "@semantic-release/npm"
+      ],
+      [
+        "@sourceregistry/semantic-release-jsr"
+      ],
       [
         "@semantic-release/git",
         {
           "assets": [
             "package.json",
+            "package-lock.json",
+            "jsr.json",
             "CHANGELOG.md"
           ],
-          "message": "node-jwt(release): 🚀 v${nextRelease.version}\n\n${nextRelease.notes}"
+          "message": "node-jwt(release): v${nextRelease.version}\n\n${nextRelease.notes}"
         }
       ]
     ]