Allan Leary e36c7a8c5d Migrate JWT Verify and JWT Decode from jsonwebtoken to jose
jsonwebtoken is unmaintained and does not work correctly in the
browser at 9.x. Following the JWT Sign migration (#2473), switch the
remaining two JWT operations to jose and remove the jsonwebtoken
dependency. Unsigned (alg:none) tokens are now rejected by Verify,
and PKCS#1 RSA public keys are converted to SPKI for WebCrypto.
2026-07-07 09:43:50 +01:00
..