chore: warn about input that 7.0 rejects

[cjbarth]

Refs #594, #620, #622, #629, #633.

Five bug fixes planned for 7.0 each turn input that 6.x accepts into an error. #648 covers the sixth, #647, in #649. Nothing warns about these five, so the first a caller would hear of any of them is 7.0 failing. This adds the warning that has to come first.

Each warning is a DeprecationWarning printed once per process. Nothing else changes: every input below is signed or verified exactly as before.

7.0 issue	Input that 6.x takes	Warning
#594	verifying a Reference whose URI is neither empty nor starts with #, which is resolved as a same-document ID	XML_CRYPTO_REFERENCE_URI_WITHOUT_FRAGMENT
#622	verifying a Transform with no Algorithm attribute, which is skipped	XML_CRYPTO_TRANSFORM_WITHOUT_ALGORITHM
#633	verifying an InclusiveNamespaces element outside the exc-c14n namespace, whose PrefixList is applied, under a Transform or under CanonicalizationMethod	XML_CRYPTO_INCLUSIVE_NAMESPACES_NAMESPACE
#629	signing with a location.reference that selects a text node, comment or processing instruction	XML_CRYPTO_LOCATION_REFERENCE_NOT_ELEMENT
#620	signing with isEmptyUri: true on a reference whose xpath selects anything but the document element	XML_CRYPTO_EMPTY_URI_NOT_DOCUMENT_ELEMENT

The #633 warning matters most to existing users: xml-crypto 6.3.2 and earlier wrote such an element when signing with xml-exc-c14n#WithComments and a prefix list, so documents signed that way stop verifying in 7.0. The warning says to sign them again.

Left out on purpose

• addReference() does not validate xpath, so a reference without one fails with XPath parse error #584 (addReference() without xpath): that reference already fails in 6.x, with XPath parse error from computeSignature(). 7.0 only names the error, so there is nothing to warn about.
• Let a line-wrapped Algorithm verify without weakening consumers' algorithm checks #628 and Fail fast when a SignedXml instance is reused #631: what 7.0 will reject isn't decided in either, so there is nothing a warning could name yet.

README

A new section under "Upgrading", "Input that 7.0 rejects", lists the five, with the specification text behind the four that follow one. The location.reference rule is this library's own and not something XMLDSig requires, so that entry cites none.

Tests

The warnings have no tests, like the other deprecations. Two tests are new, in test/input-rejected-in-7.spec.ts, for the two inputs nothing exercised, so that 6.x keeps taking them until 7.0:

• a Reference loads past a Transform that has no Algorithm;
• an empty-URI reference to an element other than the document element still signs.

Existing tests already cover the other three.

Checks

• npm run build && npm test && npm run lint pass (552 tests).
• With the built library, each case in its own process: signing and verifying by ID, with URI="" over the document element, and with a PrefixList print no warning. Each of the five inputs above prints its own warning and no other.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Documentation
  • Added guidance on inputs accepted in version 6.x that will be rejected or may no longer verify in version 7.0.
• Compatibility Notices
  • Deprecation warnings now identify nonconforming reference URIs, transforms missing an algorithm, invalid reference selections, and misplaced InclusiveNamespaces elements.
  • Current processing is retained for these cases, but some signatures may stop verifying or cause an error in version 7.0.
• Tests
  • Added coverage for transforms missing an algorithm and empty-URI references selected from non-root elements.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 863a958e-7456-4cff-b88a-fcb1e0fab5a8

📥 Commits

Reviewing files that changed from the base of the PR and between 6004896 and afb971a.

📒 Files selected for processing: 4

• README.md
• src/exclusive-canonicalization.ts
• src/signed-xml.ts
• test/input-rejected-in-7.spec.ts

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

📝 Walkthrough

The pull request adds deprecation warnings for selected XML signature inputs that are documented as rejected in version 7.0. Current processing remains in place for the warned cases. Tests cover missing transform algorithms and empty-URI references targeting non-root nodes.

Changes: Input deprecation warnings

Layer / File(s)	Summary
Verification input warnings src/exclusive-canonicalization.ts, src/signed-xml.ts, test/input-rejected-in-7.spec.ts, README.md	Verification warns about non-fragment reference URIs, transforms without an Algorithm, and out-of-namespace InclusiveNamespaces elements. The test covers a missing transform Algorithm. The README lists these verification cases and the signing cases.
Signing input warnings src/signed-xml.ts, test/input-rejected-in-7.spec.ts	Signing warns when location.reference selects a non-element node or an empty-URI reference targets a non-root node. The test checks that signing still emits URI="".

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Other

Suggested reviewers: shunkica

Merge Risk: ⚪ Minimal · up to 7e8f8

Merge Risk: ⚪ Minimal · up to 7e8f8

This change adds deprecation warnings and documentation for inputs that 7.0 will reject. Signing and verification behavior is otherwise unchanged. No merge-blocking risk is identified.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 3 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: adding warnings for inputs that version 7.0 will reject.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 3 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 84.21053% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 86.30%. Comparing base (6004896) to head (7e8f879).

Files with missing lines	Patch %	Lines
src/signed-xml.ts	76.92%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #660      +/-   ##
==========================================
- Coverage   86.33%   86.30%   -0.04%     
==========================================
  Files           9        9              
  Lines        1317     1336      +19     
  Branches      340      344       +4     
==========================================
+ Hits         1137     1153      +16     
- Misses        102      104       +2     
- Partials       78       79       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.