jose 6.0.10 → 6.0.11

package/README.md

@@ -118,10 +118,10 @@ Please note that certain algorithms may not be available depending on the runtim
 
 | Version                                         | Security Fixes 🔑 | Other Bug Fixes 🐞 | New Features ⭐ | Runtime and Module type         |
 | ----------------------------------------------- | ----------------- | ------------------ | --------------- | ------------------------------- |
-| [v6.x](https://github.com/panva/jose/tree/v6.x) | ✅                | ✅                 | ✅              | Universal[^universal] ESM[^cjs] |
-| [v5.x](https://github.com/panva/jose/tree/v5.x) | ✅                | ❌                 | ❌              | Universal[^universal] CJS + ESM |
-| [v4.x](https://github.com/panva/jose/tree/v4.x) | ✅                | ❌                 | ❌              | Universal[^universal] CJS + ESM |
-| [v2.x](https://github.com/panva/jose/tree/v2.x) | ✅                | ❌                 | ❌              | Node.js CJS                     |
+| [v6.x](https://github.com/panva/jose/tree/v6.x) | [Security Policy] | ✅                 | ✅              | Universal[^universal] ESM[^cjs] |
+| [v5.x](https://github.com/panva/jose/tree/v5.x) | [Security Policy] | ❌                 | ❌              | Universal[^universal] CJS + ESM |
+| [v4.x](https://github.com/panva/jose/tree/v4.x) | [Security Policy] | ❌                 | ❌              | Universal[^universal] CJS + ESM |
+| [v2.x](https://github.com/panva/jose/tree/v2.x) | [Security Policy] | ❌                 | ❌              | Node.js CJS                     |
 
 ## Specifications
 
@@ -145,7 +145,8 @@ The algorithm implementations in `jose` have been tested using test vectors from
 [sponsor-auth0]: https://a0.to/signup/panva
 [WebCryptoAPI]: https://w3c.github.io/webcrypto/
 [Fetch API]: https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API
+[Security Policy]: https://github.com/panva/jose/security/policy
 
-[^cjs]: CJS style `let jose = require('jose')` is possible in Node.js versions where `process.features.require_module` is `true` by default (^20.19.0 || ^22.12.0 || >= 23.0.0) or with the `--experimental-require-module` Node.js CLI flag.
+[^cjs]: CJS style `let jose = require('jose')` is possible in Node.js versions where the `require(esm)` feature is enabled by default (^20.19.0 || ^22.12.0 || >= 23.0.0).
 
 [^universal]: Assumes runtime support of [WebCryptoAPI][] and [Fetch API][]

package/dist/webapi/jwks/remote.js

@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v6.0.10';
+    const VERSION = 'v6.0.11';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const customFetch = Symbol();

package/dist/webapi/lib/jwt_claims_set.js

@@ -10,7 +10,12 @@ function validateInput(label, input) {
     }
     return input;
 }
-const normalizeTyp = (value) => value.toLowerCase().replace(/^application\//, '');
+const normalizeTyp = (value) => {
+    if (value.includes('/')) {
+        return value.toLowerCase();
+    }
+    return `application/${value.toLowerCase()}`;
+};
 const checkAudiencePresence = (audPayload, audOption) => {
     if (typeof audPayload === 'string') {
         return audOption.includes(audPayload);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "6.0.10",
+  "version": "6.0.11",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "browser",