Skip to content

v0.68.0

Latest
Latest

Choose a tag to compare

View all tags
@osanderson osanderson released this 01 Nov 05:30
Immutable release. Only release title and notes can be modified.
v0.68.0
104b04d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.68.0 (2026-11-01)

⚠ BREAKING CHANGES

  • server: X5CAttesterChain refuses an attestation whose x5c carries, below the signing certificate, a certificate with the subject and public key of the anchor a verified chain ends at, even when it is not byte-identical to the configured anchor. Send x5c as the signing certificate and its intermediates only. See UPGRADING.md for v0.68.0.
  • server: X5CAttesterChain with the default LeafPolicy refuses an attestation whose signing certificate lists the ISO/IEC 18013-5 mDL JWS or VICAL signer, ISO/IEC TS 23220-4 mdoc document signer or reader, RFC 9336 document signing, or RFC 6187 SSH extended key usage, or that chains only through a CA restricted to such roles. Issue attesters a dedicated certificate, or set LeafPolicy to AnyAttesterLeaf or your own AttesterLeafPolicyFunc. See UPGRADING.md for v0.68.0.

Bug Fixes

  • client: send authorization_details without HTML escaping (9988f69)
  • extension: encode RARSet output without HTML escaping (7b25c0c)
  • resource: refuse typed-nil access-token key sources and stores (4e31c30)
  • server: refuse a re-issued or cross-signed anchor in attester x5c (6ce2b00)
  • server: refuse more signing roles in DefaultAttesterLeafPolicy (db7e273)
  • server: refuse typed-nil trust fields before validating them (0403b7e)
Assets 3
Loading