refactor!: WebCryptoAPI is now the only crypto used

BREAKING CHANGE: CJS-style require is now only possible when require(esm) support is present in the Node.js runtime
BREAKING CHANGE: private KeyObject instances can no longer be used for verify operations
BREAKING CHANGE: private KeyObject instances can no longer be used for encryption operations
BREAKING CHANGE: generateSecret, generateKeyPair, importPKCS8, importSPKI, importJWK, and importX509 now yield a CryptoKey instead of a KeyObject in Node.js
BREAKING CHANGE: drop support for Node.js 18.x and earlier
BREAKING CHANGE: runtime-specific npm releases (jose-browser-runtime, jose-node-cjs-runtime, and jose-node-esm-runtime) are no longer maintained or supported

Author: panva

.github/workflows/release.yml

@@ -14,14 +14,6 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       id-token: write
-    strategy:
-      fail-fast: false
-      matrix:
-        prepare-script:
-          - browser
-          - node-cjs
-          - node-esm
-          - universal
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -41,7 +33,7 @@ jobs:
           key: dist-${{ hashFiles('src/**/*.ts', 'tsconfig/*.json', '.github/workflows/*.yml', 'package-lock.json') }}
           fail-on-cache-miss: true
       - name: Prepare distribution
-        run: node tools/publish-${{ matrix.prepare-script }}
+        run: node tools/publish.cjs
       - run: npm publish --provenance
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
@@ -79,6 +71,6 @@ jobs:
         with:
           node-version: lts/*
           cache: 'npm'
-      - run: node tools/release-notes
+      - run: node tools/release-notes.cjs
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -1,7 +1,3 @@
-# crypto runtime copies
-src/runtime/*.ts
-!src/runtime/*.d.ts
-
 # Logs
 logs
 *.log

README.md

@@ -18,24 +18,18 @@ Support from the community to continue maintaining and improving this module is
 
 ## Dependencies: 0
 
-`jose` has no dependencies and it exports tree-shakeable ESM. CJS is also supported.
+`jose` has no dependencies and it exports tree-shakeable ESM[^cjs].
 
 ## Documentation
 
 `jose` is distributed via [npmjs.com](https://www.npmjs.com/package/jose), [deno.land/x](https://deno.land/x/jose), [cdnjs.com](https://cdnjs.com/libraries/jose), [jsdelivr.com](https://www.jsdelivr.com/package/npm/jose), and [github.com](https://github.com/panva/jose).
 
-**`example`** ESM import
+**`example`** ESM import[^cjs]
 
 ```js
 import * as jose from 'jose'
 ```
 
-**`example`** CJS require
-
-```js
-const jose = require('jose')
-```
-
 ### JSON Web Tokens (JWT)
 
 The `jose` module supports JSON Web Tokens (JWT) and provides functionality for signing and verifying tokens, as well as their JWT Claims Set validation.
@@ -122,11 +116,12 @@ Please note that certain algorithms may not be available depending on the runtim
 
 ## Supported Versions
 
-| Version                                         | Security Fixes 🔑 | Other Bug Fixes 🐞 | New Features ⭐ |
-| ----------------------------------------------- | ----------------- | ------------------ | --------------- |
-| [v5.x](https://github.com/panva/jose/tree/v5.x) | ✅                | ✅                 | ✅              |
-| [v4.x](https://github.com/panva/jose/tree/v4.x) | ✅                | ❌                 | ❌              |
-| [v2.x](https://github.com/panva/jose/tree/v2.x) | ✅                | ❌                 | ❌              |
+| Version                                         | Security Fixes 🔑 | Other Bug Fixes 🐞 | New Features ⭐ | Runtime and Module type         |
+| ----------------------------------------------- | ----------------- | ------------------ | --------------- | ------------------------------- |
+| [v6.x](https://github.com/panva/jose/tree/v6.x) | ✅                | ✅                 | ✅              | Universal[^universal] ESM[^cjs] |
+| [v5.x](https://github.com/panva/jose/tree/v5.x) | ✅                | ❌                 | ❌              | Universal[^universal] CJS + ESM |
+| [v4.x](https://github.com/panva/jose/tree/v4.x) | ✅                | ❌                 | ❌              | Universal[^universal] CJS + ESM |
+| [v2.x](https://github.com/panva/jose/tree/v2.x) | ✅                | ❌                 | ❌              | Node.js CJS                     |
 
 ## Specifications
 
@@ -148,3 +143,9 @@ The algorithm implementations in `jose` have been tested using test vectors from
 </details>
 
 [sponsor-auth0]: https://a0.to/signup/panva
+[WebCryptoAPI]: https://w3c.github.io/webcrypto/
+[Fetch API]: https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API
+
+[^cjs]: CJS style `let jose = require('jose')` is possible in Node.js versions where `process.features.require_module` is `true` by default (^20.19.0 || ^22.12.0 || >= 23.0.0) or with the `--experimental-require-module` Node.js CLI flag.
+
+[^universal]: Assumes runtime support of [WebCryptoAPI][] and [Fetch API][]

docs/README.md

@@ -20,14 +20,10 @@ Support from the community to continue maintaining and improving this module is
 
 `jose` is distributed via [npmjs.com](https://www.npmjs.com/package/jose), [deno.land/x](https://deno.land/x/jose), [cdnjs.com](https://cdnjs.com/libraries/jose), [jsdelivr.com](https://www.jsdelivr.com/package/npm/jose), [github.com](https://github.com/panva/jose).
 
-**`example`** ESM import
-```js
-import * as jose from 'jose'
-```
+**`example`** ESM import[^cjs]
 
-**`example`** CJS require
 ```js
-const jose = require('jose')
+import * as jose from 'jose'
 ```
 
 ### JSON Web Tokens (JWT)
@@ -99,3 +95,5 @@ The following are additional features and utilities provided by the `jose` modul
 - [JOSE Errors](util/errors/README.md)
 
 [sponsor-auth0]: https://a0.to/signup/panva
+
+[^cjs]: CJS style `let jose = require('jose')` is possible in Node.js versions where `process.features.require_module` is `true` or with the `--experimental-require-module` Node.js CLI flag.