In version 4.11.4, the `verify` method in JWT changed so that the third parameter, which was previously optional, is now required.

[andyhou-nothing]

What version of Hono are you using?

4.11.4

What runtime/platform is your app running on? (with version if possible)

Cloudflare workers

What steps can reproduce the bug?

Step 1: Upgrade to the latest version of Hono.
Step 2: Run existing legacy code that includes calls to the verify method (without passing the previously optional third parameter).
Step 3: An error occurs, indicating that the alg parameter must be specified.

What is the expected behavior?

This kind of widely used API should maintain backward compatibility

What do you see instead?

this is 4.11.4

this is 4.11.3

Additional information

No response

[yusukebe]

Hi @andyhou-nothing

This is not a bug. Intended. The old version has a vulnerability, and to address it, the alg is required. This is a breaking change, but removing the vulnerability is most important, so we include the change in the patch release. See:

• https://github.com/honojs/hono/releases/tag/v4.11.4
• GHSA-f67f-6cw9-8mq4

[insin]

I was just coming in to report this after updating Hono while doing minor + patch updates to a project and getting broken - should this not be version 5 since it's a breaking change?

[otsdr]

This change breaks the oidc-auth middleware, which doesn't specify the third argument of hono/jwt::verify

[omnifaced]

Hi! Since alg is now required, can hono export enum AlgorithmTypes?
Currently, imports are available only from dist - `hono/dist/types/utils/jwt/jwa'

Hi @andyhou-nothing

This is not a bug. Intended. The old version has a vulnerability, and to address it, the alg is required. This is a breaking change, but removing the vulnerability is most important, so we include the change in the patch release. See:

* https://github.com/honojs/hono/releases/tag/v4.11.4

* [GHSA-f67f-6cw9-8mq4](https://github.com/honojs/hono/security/advisories/GHSA-f67f-6cw9-8mq4)