[jonathanp-okta]

✏️ Changes

Fixes #960, #964, #966, #967, #968.

• Bump vite/vitest to a patched major version (fixes high-severity Dependabot alert) — requires @types/node bump too #960 – dev tooling: bumps vite to ^8.3.5, vitest and @vitest/coverage-istanbul to 5.0.5 (exact pin) and @types/node to 24. npm ci now installs cleanly without --legacy-peer-deps, and the vite/vitest audit entries are gone.
• Fix outdated algorithm support flags for aws-jwt-verify (Node.js library listing) #964 – library data: aws-jwt-verify now has es256, es384, es512 and eddsa set to true in libraries-next.json (per the upstream v5.0.0 release notes). The library card and the algorithm filters both show it.
• Support SEC1-format EC private keys (BEGIN EC PRIVATE KEY) for ES256/384/512 #966 – SEC1 EC private keys: BEGIN EC PRIVATE KEY keys now work for ES256, ES384 and ES512 through a new SEC1 → PKCS#8 converter (sec1-ec-private-key.service.ts). The output is byte-identical to openssl pkcs8 -topk8, and tokens signed with these keys verify against the OpenSSL public key. The Encoder no longer swallows the real error as "Private key must not be empty".
• Remove/flag archived libraries in the current library directory (libraries-next.json) #967 – archived libraries: libraries get an archived: true flag, shown as a warning note on the card. Checked against the GitHub API for all 107 repos: 9 are archived (the issue's 6, plus gbrlsnchs/jwt, emarref/jwt and iain-logan/jwt). generate-library-data.ts now keeps the flag current.
• Support manually-supplied JWKS URI or JWKS JSON for signature verification #968 – JWKS in the Decoder: new JWKS public-key format that accepts pasted JWKS JSON or a JWKS URI. The key is selected by kid, and the format converts to and from PEM and JWK. Tokens are never sent to the JWKS host. The Encoder falls back to PEM if it would otherwise inherit "JWKS" as its private-key format after the Decoder used it.
• Dependency security: node-forge goes from ^1.3.1 to ^1.4.2, which patches the ASN.1 findings Semgrep flagged on the new SEC1 converter (asn1.fromDer uncontrolled recursion, and the asn1.derToOid integer overflow, CVE-2025-66030).

Rebased onto master after the Node 24 upgrade (#975), so this PR no longer touches the Node version.

🔮 Type of Change

Bug fixes and small features in the Decoder, Encoder and Libraries pages, plus dev tooling and a dependency security bump. No public API changes.

• Standard
• Emergency
• Significant

🔗 References

• Closes Bump vite/vitest to a patched major version (fixes high-severity Dependabot alert) — requires @types/node bump too #960, Fix outdated algorithm support flags for aws-jwt-verify (Node.js library listing) #964, Support SEC1-format EC private keys (BEGIN EC PRIVATE KEY) for ES256/384/512 #966, Remove/flag archived libraries in the current library directory (libraries-next.json) #967, Support manually-supplied JWKS URI or JWKS JSON for signature verification #968

• aws-jwt-verify v5.0.0 release notes

• GHSA-554w-wpv2-vw27, GHSA-65ch-62r8-g69g (node-forge)

• I added at least one link explaining why this change is needed.

📖 Documentation

No documentation update needed. New UI strings were added to the English and Japanese dictionaries (home and libraries).

• I reflected this change in the documentation, or explained why no update is needed.

🎯 Testing

On Node 24.15.0, from a clean node_modules:

• npm ci: succeeds without --legacy-peer-deps.
• npm run typecheck: clean.
• npm run lint: clean.
• npx vitest run: 14 files, 171 tests, all passing (includes new tests for SEC1 conversion, JWKS, the decoder JWKS store, the encoder and library support values).
• npm run build: succeeds.
• Playwright (Chromium + Firefox, 2 workers): 208 passed, 12 skipped (includes the new decoder-jwks.spec.ts).
• Manual UI QA, about 247 checks on both the dev server and the production build.
• npm audit: node-forge no longer listed.

Gaps a reviewer should know about:

• The Japanese strings for Remove/flag archived libraries in the current library directory (libraries-next.json) #967 and Support manually-supplied JWKS URI or JWKS JSON for signature verification #968 are machine-assisted translations and need a native-speaker check.

• Not tested: Safari, real mobile devices, OneTrust and analytics (disabled in dev), and a live public JWKS URI (a local server was used).

• Some failures reproduce on a clean master checkout and are not from this PR: a missing rel=noopener on the okta.com privacy link, the key box clearing after an Encoder tab round trip, and the tab order.

• One Playwright test (debugger.spec.ts "single jwt piece") failed once under parallel load and passed on rerun and in isolation. Treated as flaky.

• I described how I tested these changes.

• This change has test coverage, or I explained why it does not.

🚀 Deployment

Deployable at any time. No new environment variables, infrastructure or migrations. The JWKS URI feature makes a request to the URI the user provides; the token itself is never sent.

• This change can support multiple releases serving traffic at the same time.
• This can be deployed at any time, or I listed the prerequisites.

🔥 Rollback

Revert this PR to restore the previous behavior. Nothing is persisted server-side, and the change only affects the client UI, the library data file and dev tooling. Reverting the vite/vitest bump returns the install to needing --legacy-peer-deps.

• I explained the rollback and recovery process.

[github-actions]

Preview URL https://next-jwt-lkxrukac2-okta.vercel.app

[github-actions]

Preview URL https://next-jwt-3rsap4kul-okta.vercel.app

[github-actions]

Preview URL https://next-jwt-9n25henm7-okta.vercel.app