jose

Performance

• avoid copying AES-GCM output

• deduplicate pending jwks key imports

• encode single-signature JWS input once

• normalize General JWE shared headers once

• normalize jwks selection metadata once

• use native encoding for larger ASCII strings

Fixes

• jose: consume serialization members once

• jose: reject empty protected and JWE AAD members

• jose: validate serialized header values

• jwe: conceal invalid decrypted CEK lengths

• jwe: enforce AES-GCM tag boundaries

• jwe: validate explicit encryption parameters

• jwk: accept empty octet-sequence keys

• jwk: normalize key resolution inputs

• jwks: enforce verification key metadata

• jwks: order overlapping remote reloads

• jwks: reject invalid remote duration values

• jwk: validate ext and key_ops parameters

• jws: reject mixed payload encoding modes

• jws: validate unencoded payload strings

• jwt: enforce explicit verification policies

• jwt: prevent replacing protected headers

• jwt: reject invalid duration inputs

• jwt: validate builder claim values

• jwt: validate unsecured protected headers

• key: validate generation and import options

• reject mixed b64 modes for empty General JWS payloads

• x509: reject DER truncated past its outer length