Skip to content

Upgrading jwt 1 to 2

Unknown1.5.6 → 2.10.3Security1Deprecated4New5Changed5Fixed15Other8

Full comparisonBack to jwt
Fetching 27 releases from GitHub…11 / 27
UnknownUpgrade verdict

DepDelta is still reading the notes for 16 of 27 releases, so breaking changes can't be ruled out yet.

In plain terms
  • DepDelta is still reading the release notes in this range, so it can't rule out breaking changes yet.
  • This page updates as the notes come in.
Must act Top 4 of 5 that need code or config changes

Ruby requirement changed in 2.4.0.beta1: >= 0 → >= 2.5.

What you must change

Security1
Rejects nil and empty HMAC keys when signing and verifying, addressing CVE-2026-45363.
High · CVSS 7.4
2.10.3GitHub ReleaseSummarizedView source

Deprecations to plan for

Deprecated4
Adds deprecation warnings for deprecated methods and classes.
2.10.0GitHub ReleaseSummarizedView source
Adds deprecation warnings for rbnacl backed functionality.
rbnacl
2.10.0GitHub ReleaseSummarizedView source
Adds a deprecation warning for the HMAC algorithm HS512256 (HMAC-SHA-512 truncated to 256-bits).
HS512256
2.8.0GitHub ReleaseSummarizedView source
Adds a deprecation warning for decoding content not compliant with RFC 4648.
2.8.0GitHub ReleaseSummarizedView source

API changes

Generated by DepDelta from published Ruby source. Not mixed with prose notes.

  • removed: const JWT.DEFAULT_OPTIONS
  • removed: const JWT.NAMED_CURVES
  • removed: static method JWT.asn1_to_raw(_, _)
  • removed: static method JWT.base64url_decode(_)
  • removed: static method JWT.base64url_encode(_)
  • removed: static method JWT.decode_verify_signature(_, _, _, _, _)
  • removed: static method JWT.decoded_segments(_, _ = …, _ = …, _ = …)
  • removed: static method JWT.encoded_header(_ = …, _ = …)
  • removed: static method JWT.encoded_payload(_)
  • removed: static method JWT.encoded_signature(_, _, _)
  • removed: static method JWT.raw_to_asn1(_, _)
  • removed: static method JWT.secure_compare(_, _)
  • removed: static method JWT.sign(_, _, _)
  • removed: static method JWT.sign_ecdsa(_, _, _)
  • removed: static method JWT.sign_hmac(_, _, _)
  • removed: static method JWT.sign_rsa(_, _, _)
  • removed: static method JWT.signature_algorithm_and_key(_, _)
  • removed: static method JWT.verify_ecdsa(_, _, _, _)
  • removed: static method JWT.verify_rsa(_, _, _, _)
  • removed: static method JWT.verify_signature(_, _, _, _)
  • removed: static method JWT.verify_signature_algo(_, _, _, _)
  • added: static method JWT.openssl_3?()
  • added: static method JWT.openssl_3_hmac_empty_key_regression?()
  • added: static method JWT.openssl_version()
  • added: static method JWT.rbnacl?()
  • added: static method JWT.rbnacl_6_or_greater?()
  • removed: method Decode.verify()
  • removed: method Json.decode_json(_)
  • removed: method Json.encode_json(_)
  • removed: method Verify.verify_aud()
  • removed: method Verify.verify_aud_array(_, _)
  • removed: method Verify.verify_expiration()
  • removed: method Verify.verify_iat()
  • removed: method Verify.verify_iss()
  • removed: method Verify.verify_jti()
  • removed: method Verify.verify_not_before()
  • removed: method Verify.verify_sub()
  • removed: module Json
  • removed: property Decode.header: reader
  • removed: property Decode.payload: reader
  • removed: property Decode.signature: reader
  • removed: static method Decode.base64url_decode(_)
  • added: class Base64
  • added: class Base64DecodeError < DecodeError
  • added: class ClaimsValidator
  • added: class Encode
  • added: class EncodeError < StandardError
  • added: class EncodedToken
  • added: class InvalidCritError < DecodeError
  • added: class JSON
  • added: class JWKError < DecodeError
  • added: class MissingRequiredClaim < DecodeError
  • added: class RequiredDependencyError < StandardError
  • added: class Token
  • added: class UnsupportedEcdsaCurve < IncorrectAlgorithm
  • added: class X5cKeyFinder
  • added: const Decode.ALGORITHM_KEYS
  • added: constructor ClaimsValidator(_)
  • added: constructor Encode(_)
  • added: constructor EncodedToken(_)
  • added: constructor Token(payload:, header: …)
  • added: constructor X5cKeyFinder(_, _ = …)
  • added: method ClaimsValidator.validate!()
  • added: method Configuration.configuration()
  • added: method Configuration.configure()
  • added: method Encode.segments()
  • added: method EncodedToken.header()
  • added: method EncodedToken.payload()
  • added: method EncodedToken.signature()
  • added: method EncodedToken.signing_input()
  • added: method EncodedToken.valid_signature?(algorithm:, key:)
  • added: method EncodedToken.verify_signature!(algorithm:, key: …, key_finder: …)
  • added: method Token.detach_payload!()
  • added: method Token.encoded_header()
  • added: method Token.encoded_payload()
  • added: method Token.encoded_signature()
  • added: method Token.jwt()
  • added: method Token.sign!(algorithm:, key:)
  • added: method Token.signature()
  • added: method Token.signing_input()
  • added: method Token.to_s()
  • added: method X5cKeyFinder.from(_)
  • added: module Claims
  • added: module Configuration
  • added: module Deprecations
  • added: module JWA
  • added: module JWK
  • added: property EncodedToken.encoded_header: reader
  • added: property EncodedToken.encoded_payload: accessor
  • added: property EncodedToken.encoded_signature: reader
  • added: property EncodedToken.jwt: reader
  • added: property EncodedToken.to_s: reader
  • added: property Token.header: reader
  • added: property Token.payload: reader
  • added: static method Base64.loose_urlsafe_decode64(_)
  • added: static method Base64.url_decode(_)
  • added: static method Base64.url_encode(_)
  • added: static method Claims.payload_errors(_, *)
  • added: static method Claims.valid_payload?(_, *)
  • added: static method Claims.verify!(_, _)
  • added: static method Claims.verify_payload!(_, *)
  • added: static method Deprecations.context()
  • added: static method Deprecations.emit_warnings()
  • added: static method Deprecations.store(_)
  • added: static method Deprecations.warning(_, only_if_valid: …)
  • added: static method JSON.generate(_)
  • added: static method JSON.parse(_)
  • added: static method JWA.create(_)
  • added: static method JWA.find(_)
  • added: static method JWA.register_algorithm(_)
  • added: static method JWA.resolve(_)
  • added: static method JWA.resolve_and_sort(algorithms:, preferred_algorithm:)
  • added: static method JWK.classes()
  • added: static method JWK.create_from(_, _ = …, _ = …)
  • added: static method JWK.import(_, _ = …, _ = …)
  • added: static method JWK.new(_, _ = …, _ = …)
  • added: static method Verify.verify_claims(_, _)
  • added: class Audience
  • added: class Crit
  • added: class Error < Struct.new(:message, keyword_init: true)
  • added: class Expiration
  • added: class IssuedAt
  • added: class Issuer
  • added: class JwtId
  • added: class NotBefore
  • added: class Numeric
  • added: class Required
  • added: class Subject
  • added: class VerificationContext < Struct.new(:payload, keyword_init: true)
  • added: constructor Audience(expected_audience:)
  • added: constructor Crit(expected_crits:)
  • added: constructor Expiration(leeway:)
  • added: constructor Issuer(issuers:)
  • added: constructor JwtId(validator:)
  • added: constructor NotBefore(leeway:)
  • added: constructor Required(required_claims:)
  • added: constructor Subject(expected_subject:)
  • added: method Audience.verify!(context:, **)
  • added: method Crit.verify!(context:, **)
  • added: method Expiration.verify!(context:, **)
  • added: method IssuedAt.verify!(context:, **)
  • added: method Issuer.verify!(context:, **)
  • added: method JwtId.verify!(context:, **)
  • added: method NotBefore.verify!(context:, **)
  • added: method Numeric.verify!(context:)
  • added: method Required.verify!(context:, **)
  • added: method Subject.verify!(context:, **)
  • added: method VerificationMethods.claim_errors(*)
  • added: method VerificationMethods.valid_claims?(*)
  • added: method VerificationMethods.verify_claims!(*)
  • added: module DecodeVerifier
  • added: module VerificationMethods
  • added: module Verifier
  • added: static method DecodeVerifier.verify!(_, _)
  • added: static method Numeric.new(*)
  • added: static method Numeric.verify!(payload:, **)
  • added: static method Verifier.errors(_, *)
  • added: static method Verifier.verify!(_, *)
  • added: class Compat
  • added: constructor Compat(_)
  • added: method Compat.verify!()
  • added: class Container
  • added: class DecodeConfiguration
  • added: class JwkConfiguration
  • added: constructor Container()
  • added: constructor DecodeConfiguration()
  • added: constructor JwkConfiguration()
  • added: method Container.reset!()
  • added: method DecodeConfiguration.to_h()
  • added: property Container.decode: accessor
  • added: property Container.deprecation_warnings: reader
  • added: property Container.jwk: accessor
  • added: property Container.strict_base64_decoding: accessor
  • added: property DecodeConfiguration.algorithms: accessor
  • added: property DecodeConfiguration.leeway: accessor
  • added: property DecodeConfiguration.required_claims: accessor
  • added: property DecodeConfiguration.verify_aud: accessor
  • added: property DecodeConfiguration.verify_expiration: accessor
  • added: property DecodeConfiguration.verify_iat: accessor
  • added: property DecodeConfiguration.verify_iss: accessor
  • added: property DecodeConfiguration.verify_jti: accessor
  • added: property DecodeConfiguration.verify_not_before: accessor
  • added: property DecodeConfiguration.verify_sub: accessor
  • added: property JwkConfiguration.kid_generator: accessor
  • added: set Container.deprecation_warnings(_)
  • added: set JwkConfiguration.kid_generator_type(_)
  • added: class Ecdsa
  • added: class Eddsa
  • added: class Hmac
  • added: class HmacRbNaCl
  • added: class HmacRbNaClFixed
  • added: class None
  • added: class Ps
  • added: class Rsa
  • added: class Wrapper
  • added: const Ecdsa.NAMED_CURVES
  • added: constructor Ecdsa(_, _)
  • added: constructor Eddsa(_)
  • added: constructor Hmac(_, _)
  • added: constructor HmacRbNaCl(_, _)
  • added: constructor HmacRbNaClFixed(_, _)
  • added: constructor None()
  • added: constructor Ps(_)
  • added: constructor Rsa(_)
  • added: constructor Wrapper(_)
  • added: method Ecdsa.sign(data:, signing_key:)
  • added: method Ecdsa.verify(data:, signature:, verification_key:)
  • added: method Eddsa.sign(data:, signing_key:)
  • added: method Eddsa.verify(data:, signature:, verification_key:)
  • added: method Hmac.sign(data:, signing_key:)
  • added: method Hmac.verify(data:, signature:, verification_key:)
  • added: method HmacRbNaCl.sign(data:, signing_key:)
  • added: method HmacRbNaCl.verify(data:, signature:, verification_key:)
  • added: method HmacRbNaClFixed.sign(data:, signing_key:)
  • added: method HmacRbNaClFixed.verify(data:, signature:, verification_key:)
  • added: method None.sign(*)
  • added: method None.verify(*)
  • added: method Ps.sign(data:, signing_key:)
  • added: method Ps.verify(data:, signature:, verification_key:)
  • added: method Rsa.sign(data:, signing_key:)
  • added: method Rsa.verify(data:, signature:, verification_key:)
  • added: method SigningAlgorithm.header(*)
  • added: method SigningAlgorithm.raise_sign_error!(_)
  • added: method SigningAlgorithm.raise_verify_error!(_)
  • added: method SigningAlgorithm.sign(*)
  • added: method SigningAlgorithm.valid_alg?(_)
  • added: method SigningAlgorithm.verify(*)
  • added: method Wrapper.alg()
  • added: method Wrapper.header(*, **)
  • added: method Wrapper.sign(*, **)
  • added: method Wrapper.valid_alg?(_)
  • added: method Wrapper.verify(*, **)
  • added: module Compat
  • added: module SigningAlgorithm
  • added: module Unsupported
  • added: property SigningAlgorithm.alg: reader
  • added: static method Ecdsa.curve_by_name(_)
  • added: static method Ecdsa.from_algorithm(_)
  • added: static method Hmac.from_algorithm(_)
  • added: static method HmacRbNaCl.from_algorithm(_)
  • added: static method HmacRbNaClFixed.from_algorithm(_)
  • added: static method Unsupported.sign(*)
  • added: static method Unsupported.verify(*)
  • added: method ClassMethods.from_algorithm(_)
  • added: method ClassMethods.sign(_, _, _)
  • added: method ClassMethods.verify(_, _, _, _)
  • added: module ClassMethods
  • added: module SecurityUtils
  • added: static method SecurityUtils.fixed_length_secure_compare(_, _)
  • added: static method SecurityUtils.secure_compare(_, _)
  • added: method ClassMethods.register_algorithm(_)
  • added: module ClassMethods
  • added: class EC < KeyBase
  • added: class HMAC < KeyBase
  • added: class KeyBase
  • added: class KeyFinder
  • added: class KidAsKeyDigest
  • added: class OKPRbNaCl < KeyBase
  • added: class RSA < KeyBase
  • added: class Set
  • added: class Thumbprint
  • added: const EC.BINARY
  • added: const EC.EC_KEY_ELEMENTS
  • added: const EC.EC_PRIVATE_KEY_ELEMENTS
  • added: const EC.EC_PUBLIC_KEY_ELEMENTS
  • added: const EC.KTY
  • added: const EC.KTYS
  • added: const EC.ZERO_BYTE
  • added: const HMAC.HMAC_KEY_ELEMENTS
  • added: const HMAC.HMAC_PRIVATE_KEY_ELEMENTS
  • added: const HMAC.HMAC_PUBLIC_KEY_ELEMENTS
  • added: const HMAC.KTY
  • added: const HMAC.KTYS
  • added: const OKPRbNaCl.KTY
  • added: const OKPRbNaCl.KTYS
  • added: const OKPRbNaCl.OKP_PRIVATE_KEY_ELEMENTS
  • added: const OKPRbNaCl.OKP_PUBLIC_KEY_ELEMENTS
  • added: const RSA.BINARY
  • added: const RSA.KTY
  • added: const RSA.KTYS
  • added: const RSA.RSA_ASN1_SEQUENCE
  • added: const RSA.RSA_KEY_ELEMENTS
  • added: const RSA.RSA_OPT_PARAMS
  • added: const RSA.RSA_PRIVATE_KEY_ELEMENTS
  • added: const RSA.RSA_PUBLIC_KEY_ELEMENTS
  • added: constructor EC(_, _ = …, _ = …)
  • added: constructor HMAC(_, _ = …, _ = …)
  • added: constructor KeyBase(_, _ = …)
  • added: constructor KeyFinder(_)
  • added: constructor KidAsKeyDigest(_)
  • added: constructor OKPRbNaCl(_, _ = …, _ = …)
  • added: constructor RSA(_, _ = …, _ = …)
  • added: constructor Set(_ = …, _ = …)
  • added: constructor Thumbprint(_)
  • added: method EC.[]=(_, _)
  • added: method EC.export(_ = …)
  • added: method EC.key_digest()
  • added: method EC.keypair()
  • added: method EC.members()
  • added: method EC.private?()
  • added: method EC.public_key()
  • added: method EC.signing_key()
  • added: method EC.verify_key()
  • added: method HMAC.[]=(_, _)
  • added: method HMAC.export(_ = …)
  • added: method HMAC.key_digest()
  • added: method HMAC.keypair()
  • added: method HMAC.members()
  • added: method HMAC.private?()
  • added: method HMAC.public_key()
  • added: method HMAC.signing_key()
  • added: method HMAC.verify_key()
  • added: method KeyBase.<=>(_)
  • added: method KeyBase.==(_)
  • added: method KeyBase.[](_)
  • added: method KeyBase.[]=(_, _)
  • added: method KeyBase.hash()
  • added: method KeyBase.kid()
  • added: method KeyFinder.key_for(_)
  • added: method KidAsKeyDigest.generate()
  • added: method OKPRbNaCl.export(_ = …)
  • added: method OKPRbNaCl.key_digest()
  • added: method OKPRbNaCl.members()
  • added: method OKPRbNaCl.private?()
  • added: method OKPRbNaCl.signing_key()
  • added: method OKPRbNaCl.verify_key()
  • added: method RSA.[]=(_, _)
  • added: method RSA.export(_ = …)
  • added: method RSA.key_digest()
  • added: method RSA.keypair()
  • added: method RSA.members()
  • added: method RSA.private?()
  • added: method RSA.public_key()
  • added: method RSA.signing_key()
  • added: method RSA.verify_key()
  • added: method Set.==(_)
  • added: method Set.add(_)
  • added: method Set.export(_ = …)
  • added: method Set.filter!()
  • added: method Set.length()
  • added: method Set.merge(_)
  • added: method Set.reject!()
  • added: method Set.select!()
  • added: method Set.union(_)
  • added: method Set.uniq!()
  • added: method Thumbprint.generate()
  • added: method Thumbprint.to_s()
  • added: property Set.keys: reader
  • added: property Thumbprint.jwk: reader
  • added: static method EC.import(_)
  • added: static method EC.to_openssl_curve(_)
  • added: static method HMAC.import(_)
  • added: static method OKPRbNaCl.import(_)
  • added: static method RSA.create_rsa_key(_)
  • added: static method RSA.create_rsa_key_using_accessors(_)
  • added: static method RSA.create_rsa_key_using_der(_)
  • added: static method RSA.create_rsa_key_using_sets(_)
  • added: static method RSA.decode_open_ssl_bn(_)
  • added: static method RSA.import(_)
  • added: static method RSA.validate_rsa_parameters!(_)