[ZhuchkaTriplesix]

OxyJWT 0.9.0 Release

Summary of Changes

This release includes performance improvements, security hardening, and API enhancements:

1. Security:

   • Strict rejection of unrecognized or invalid crit (Critical) header parameters across verified and unverified decode paths (RFC 7515 §4.1.11, RFC 7797) (security(jws): reject unrecognized 'crit' header extensions on ordinary verified decode #132).

2. Performance:

   • Pre-encoded static headers: Uses pre-encoded immutable base64 slices for default headers ({"typ":"JWT","alg":"<ALG>"}), eliminating header serialization and base64 allocation. HS256 encode benchmark reached ~895,000 ops/s (+10% gain) (perf(core): pre-encode static headers and move fast-path claim validations to Rust #150).
   • Native claim verification in Rust: Moved iat, unrequested aud rejection, and sub validation into Rust, allowing the fast-path decode to return claims directly without secondary Python passes (perf(api): extend decode fast-path to handle audience, issuer and subject without decode_complete fallback #136, perf(core): pre-encode static headers and move fast-path claim validations to Rust #150).
   • Direct JWK deserialization: Materializing a decoding key from a JWK Python dict now avoids intermediate serde_json::Value DOM trees; parsed in a single pass via orjson.dumps and streaming jsonwebtoken::jwk::Jwk parsing (10× to 21× speedup) (perf(keys): eliminate triple JSON round-trip in DecodingKey.from_jwk #140).
   • Zero-copy header algorithm extraction: Static matching for standard headers without base64 or JSON decoding; streaming serde visitor for non-standard headers (perf(rust): avoid full JSON header parsing in decode when only alg is needed #138).
   • Streaming claims deserialization: decode_complete streams JSON tokens into PyDict without building an intermediate Rust DOM (perf(claims): avoid serde_json::Value DOM allocation and manual PyDict construction for claims decoding #137).
   • Borrowed payload & GIL optimization: encode_json builds signing input directly from borrowed bytes; sub-microsecond non-crypto helpers run attached to the GIL to eliminate py.detach overhead (perf(api): avoid redundant payload copy in encode_json and optimize py.detach on fast unverified paths #139).

3. API & Typing:

   • Export encode_json at top-level (oxyjwt.encode_json) and on PyJWT.encode_json with full typing and parity coverage (fix(api): export encode_json in top-level oxyjwt and add comprehensive tests #148).
   • Accept raw bytes directly in DecodingKey.from_jwk, PyJWK, and PyJWKSet.from_json (perf(keys): eliminate triple JSON round-trip in DecodingKey.from_jwk #140).

Verification

• cargo test --manifest-path rust/Cargo.toml: 23 passed
• cargo fmt --manifest-path rust/Cargo.toml --check: clean
• cargo clippy --manifest-path rust/Cargo.toml --all-targets -- -D warnings: clean
• pytest: 327 passed, 1 skipped, 0 failures
• mypy python/oxyjwt tests/typing: 0 issues in 11 files
• mkdocs build --strict -f docs-site/mkdocs.yml: cleanly built