Issues

• Check conditions explicitly rather than through assertRequired, and break the import cycles through utility

  node-saml/node-saml#508 · Filter by author cjbarth opened on Oct 14, 2026 · v6

• Read privateKey and decryptionPvk at construction, and refuse a key the option can't use

  node-saml/node-saml#507 · Filter by author cjbarth opened on Oct 14, 2026 · v6

• Make the checks on incoming messages private, and run each one once

  node-saml/node-saml#503 · Filter by author cjbarth opened on Oct 13, 2026 · v6

• Remove the parsed-query argument of validateRedirectAsync

  node-saml/node-saml#495 · Filter by author cjbarth opened on Oct 9, 2026 · v6

• Verify signatures made with dsa-sha1

  enhancement
  node-saml/node-saml#491 · Filter by author cjbarth opened on Oct 8, 2026 · v6

• Verify Redirect-binding signatures only with xml-crypto's algorithms

  node-saml/node-saml#489 · Filter by author cjbarth opened on Oct 8, 2026 · v6

• Remove the getSigner export

  node-saml/node-saml#488 · Filter by author cjbarth opened on Oct 8, 2026 · v6

• Reject a metadataContactPerson or metadataOrganization that does not match its documented shape

  node-saml/node-saml#483 · Filter by author cjbarth opened on Oct 5, 2026 · v6

• Reject a signature with more than one reference instead of ignoring it

  node-saml/node-saml#465 · Filter by author cjbarth opened on Sep 28, 2026 · v6

• The HTTP-POST binding sends a DEFLATE-compressed AuthnRequest

  bug
  node-saml/node-saml#463 · Filter by author cjbarth opened on Sep 28, 2026

• Require assertion-ID replay protection (SAML profiles §4.1.4.5)

  node-saml/node-saml#459 · Filter by author cjbarth opened on Sep 28, 2026 · v6

• Close deep imports under lib/ with an exports map

  node-saml/node-saml#458 · Filter by author cjbarth opened on Sep 28, 2026 · v6

• Under ifPresent, reject an unsigned Response that carries InResponseTo when its assertion carries none

  node-saml/node-saml#457 · Filter by author cjbarth opened on Sep 28, 2026 · v6

• Under ifPresent, validate the assertion's InResponseTo even when the Response carries none

  enhancementsecurity
  node-saml/node-saml#453 · Filter by author cjbarth opened on Sep 27, 2026 · v6

• Tie each pending request ID to the session that started it

  enhancementsecurity
  node-saml/node-saml#450 · Filter by author cjbarth opened on Sep 25, 2026 · v6

• Reject replayed assertions by remembering their IDs (SAML profiles §4.1.4.5)

  enhancement
  node-saml/node-saml#449 · Filter by author cjbarth opened on Sep 25, 2026 · 5.2.0

• [BUG] [SECURITY] Upgrade @xmldom/xmldom to 0.9.12

  bug
  node-saml/node-saml#444 · Filter by author nikhiljain12 opened on Sep 23, 2026 · v6
  2

• Remove the injected-dependency argument from validatePostRequestAsync

  node-saml/node-saml#443 · Filter by author cjbarth opened on Sep 22, 2026 · v6

• Deprecate deep imports under lib/, and export from the root the types its API uses

  node-saml/node-saml#441 · Filter by author cjbarth opened on Sep 22, 2026 · 5.2.0

• Response/@Destination is never checked on received messages

  node-saml/node-saml#437 · Filter by author cjbarth opened on Sep 22, 2026 · v6
  1

• SubjectConfirmation Method is never checked, so a non-bearer confirmation is accepted as bearer

  node-saml/node-saml#435 · Filter by author cjbarth opened on Sep 22, 2026 · v6
  1

• Require consumeAsync on CacheProvider

  node-saml/node-saml#431 · Filter by author cjbarth opened on Sep 22, 2026 · v6

• Remove the validateSignature export

  node-saml/node-saml#429 · Filter by author cjbarth opened on Sep 17, 2026 · v6
  1

• Remove Profile.getSamlResponseXml()

  node-saml/node-saml#424 · Filter by author cjbarth opened on Sep 17, 2026 · v6

• Reject an unrecognized signature or digest algorithm instead of falling back to SHA-1

  node-saml/node-saml#423 · Filter by author cjbarth opened on Sep 17, 2026 · v6