v0.64.0

0.64.0 (2026-11-04)

⚠ BREAKING CHANGES

• verifier: Transaction has a MdocEncryptionInfo field a TransactionStore must persist (verifiertest.TestTransactionStoreContract checks it; TransactionCodec-based stores, sqlstore's included, already do), and verifier.Reason has a new value, ReasonMdocDCAPIResponse.

Features

• cose: sign and verify ES384 and ES512 (ae5878f)
• haip: check Wallet Attestations' Token Status List status (79d259a)
• issuer: check key attestations' Token Status List status (6bc166d)
• mdoc: accept P-384 and P-521 document signer and device keys (a69b3d4)
• proximity: accept P-384 and P-521 ephemeral keys and signers (98e383e)
• statuslist: allocate random, never-reused status list indices (9725b06)
• statuslist: cache verified status list tokens and reuse the fetch transport (be9910c)
• statuslist: parse a status claim still in JSON (255dbd5)
• statuslist: sign CWT status and identifier lists on P-384 and P-521 (b6813d6)
• verifier: manage org-iso-mdoc Digital Credentials API requests in Transactions (61a5574)
• verifier: verify mdocs signed on P-384 and P-521 (30cf80e)
• walletflow: keep fetched status lists in a statuslist.Cache (936d98a)

sqlstore: v0.5.0

0.5.0 (2026-11-04)

Features

• sqlstore: add a durable statuslist.IndexStore (a7f9ff7)

v0.63.0

0.63.0 (2026-11-03)

⚠ BREAKING CHANGES

• walletflow: PendingDeferred has Format, VCT and DocType fields. A DeferredStore of your own must keep them (walletflow/storetest's contract checks every field); sqlstore's and the mobile stores do. RefreshCredential and Deferred.Poll return ErrReissueRequired when the issuer's configuration now issues another type of credential.
• statuslist: statuslist.Checker, CheckX5C and CheckCWTX5Chain refuse a check whose VerifyOptions sets neither Issuer, IssuerKey nor UnboundSigner; set UnboundSigner to statuslist.AnyListSigner where every signer under the roots may decide every credential's status. A Publisher with a sub-second TTL or Lifetime, or a TTL over its Lifetime, now fails to sign.
• mdocdcapi: VerifyResponse refuses a Pending whose ExpiresAt is zero; keep the Pending BuildRequest returns whole, ExpiresAt with it.
• verifier: a query asking for a format other than dc+sd-jwt or mso_mdoc, or for one Config.VPFormatsSupported doesn't list, is refused; list every format the Verifier asks for (MdocFormatSupport, SDJWTVCFormatSupport).
• verifier: under AssuranceProduction, NewTransactions refuses a store that doesn't implement verifier.SealingStore returning true (sqlstore's TransactionStore does when its codec, or its DB, has a Sealer), unless TransactionsConfig.UnsealedStore is set, and a Lifetime over an hour.
• issuer: under AssuranceProduction, New refuses a Notification Endpoint without a positive Limits.NotificationLifetime, and the deprecated MetadataHandler answers 500 rather than unsigned metadata when its signer is refused.
• issuer: under AssuranceProduction with AnonymousPreAuthorizedCode, CreatePreAuthorizedOffer refuses an offer with neither CreatePreAuthorizedOfferRequest.TxCode nor NoTxCode.
• issuer: with Config.AuthorizationServers set, an access token's authorization detail must list Config.Issuer in its locations to grant a configuration, and a pre-authorized Token Request's authorization_details must carry locations.
• issuer: under AssuranceProduction, New refuses an AttestationVerifier or ProofBindingKeys of your own that embeds an X5CAttestationVerifier or X5CProofBindingKeyResolver whose Revocation is nil, or an X5CAttestationVerifier with no explicit IssuerBinding, as it already refused them unwrapped.

Features

• issuer: give Prepare the claims an authorization detail asks for (71f8042)

Bug Fixes

• compare every JOSE typ as a media type (b01f66f)
• issuer: accept jwt proofs that carry a key attestation as OpenID4VCI allows (bcfbabb)
• issuer: keep an X5C verifier's checks when it's wrapped (9737c88)
• issuer: keep New's own copy of the Config, and hand out copies from Metadata (b20a02f)
• issuer: refuse a PerCredential that drops a Credential's claims (088099d)
• issuer: require a notification lifetime, and signed metadata, under production (cc93ded)
• issuer: require a Transaction Code for anonymous pre-authorized offers in production (46918b9)
• issuer: require locations in authorization details when authorization_servers is set (024cfd2)
• issuer: state the granted scope in the pre-authorized Token Response (d695107)
• mdocdcapi: give a request an expiry its response is checked against (27777cf)
• proximity: accept a compressed EDeviceKey (475715c)
• proximity: generate the NFC-only engagement key from crypto/rand (3cb662d)
• proximity: leave the NFC data-field limits out of the reader's Handover Request (753c6f3)
• proximity: select the NFC data application as ISO/IEC 18013-5 Table 8 has it (905b016)
• proximity: take mdoc central client mode when a static handover offers both (3e4315e)
• read Request Object, signed metadata and Key Attestation times as range-checked NumericDates (adc1966)
• refuse a small-order Ed25519 key when verifying JWS and COSE signatures (9226ce0)
• sdjwtvc: refuse _sd_alg anywhere but the payload's top level (b9f7e04)
• statuslist: bind a Status List Token's signer by default, and size tokens to match (778cae4)
• verifier: describe a discarded presentation with fixed text (22c7b9d)
• verifier: discard the rest of a credential set option a failed presentation leaves incomplete (d18eb94)
• verifier: find an SD-JWT VC's array index among the disclosed elements (1bf2b70)
• verifier: refuse a request for a format the Verifier doesn't verify or advertise (c9b687a)
• verifier: require a sealing transaction store and a bounded lifetime in production (caf2329)
• wallet: finish sending a signed presentation when its context is cancelled (ccbe7f5)
• walletflow: clean a tx_code's description before it reaches the PIN prompt (d3ae36b)
• walletflow: keep a refreshed or deferred credential the type the holder agreed to (bf739ec)
• walletflow: never present a revoked copy while a valid one is left (06544d6)
• wallet: refuse a Verifier's redirect_uri to a Wallet invocation scheme (22e760d)

sqlstore: v0.4.0

0.4.0 (2026-11-03)

⚠ BREAKING CHANGES

• sqlstore: on a DB with a Sealer, DB.Transactions(TransactionCodec{}) now seals transactions, and no longer reads the unsealed ones it wrote

Bug Fixes

• sqlstore: seal verifier transactions with the DB's Sealer by default (0dd269f)

v0.62.0

0.62.0 (2026-11-02)

⚠ BREAKING CHANGES

• verifier: TransactionsConfig.RequestURIBase or RedirectURI with userinfo (even a bare "@") or a non-ASCII host is refused by NewTransactions. Give an internationalized domain name as its xn-- A-label.
• verifier: a sealed verifier transaction record written by v0.61.0 or earlier no longer opens (sqlstore.ErrRecordFormat): a request in flight at the upgrade fails, and a completed one's result is lost. Upgrade with no request in flight, or accept those failing. Unsealed records are unaffected.
• oid4vci: a token request (code exchange, CIBA or refresh) whose authorization_details drop all of the grant's credential_identifiers is refused with invalid_authorization_details; keep some, or send no authorization_details. An openid_credential object with an empty credential_identifiers, locations or claims array, an empty location, a malformed claims path or a repeated claims path is refused.

Bug Fixes

• name what an origin carries beyond its scheme, host and port (80fd636)
• oid4vci: refuse narrowing that drops credential_identifiers, and malformed objects (1790fe1)
• verifier: bind sealed transaction fields to who may read the result (53c9dd2)
• verifier: check request_uri_base and redirect_uri as endpoint URLs (585c081)
• walletflow: make a revocation CheckStatus finds final (97bd6e4)

v0.61.0

0.61.0 (2026-11-02)

⚠ BREAKING CHANGES

• TransactionsConfig.RequestURIBase with a query or a fragment, RedirectURI with a fragment, and an origin ending in a bare '?' or '#' are refused.
• verifier: verifier.AESGCMSealer refuses a key that's one byte repeated or all printable text. Generate 32 bytes with crypto/rand and decode an encoded key before passing it.
• certchain: a presented certificate chain (x5c or x5chain, from an issuer, wallet, verifier, attester or mdoc reader) with an RSA key over 4096 bits, or with an exponent other than 65537, is refused. Configured trust anchors aren't checked.
• deps: an issuer running fapigo/server beside issuer gets FAPIgo v0.69.0's behavioural changes: Wallet Attestation x5c RSA keys over 4096 bits or with e != 65537 are refused; IssueAccessToken and IssueRefreshToken refuse a TokenBinding or AttestedClient changed after the server returned it; pushed request parameters are bounded; a request_uri allows at most eight BeginAuthorization calls; a query or bare '#' in the issuer, endpoint or redirect URIs is refused; and fapigo/sqlstore refuses a SQLite file not in WAL mode. See UPGRADING.md.

Bug Fixes

• certchain: refuse RSA keys over 4096 bits or with e != 65537 (61fdd1e)
• deps: pin FAPIgo v0.69.0 and fapigo/sqlstore v0.4.0 (ce226cf)
• refuse a bare '?' or '#' in origins and the verifier's URLs (d20c9dc)
• verifier: refuse a weak AESGCMSealer key (8ece9cd)

v0.60.0

0.60.0 (2026-11-02)

Features

• walletflow: check an mdoc's identifier list in CheckStatus (24f61ff)

sqlstore: v0.3.0

0.3.0 (2026-11-02)

⚠ BREAKING CHANGES

• sqlstore: Migrate and CheckSchema refuse a SQLite database not in WAL mode. Open it with ?_pragma=busy_timeout(10000)&_pragma=journal_mode(WAL).
• deps: an issuer running fapigo/server beside issuer gets FAPIgo v0.69.0's behavioural changes: Wallet Attestation x5c RSA keys over 4096 bits or with e != 65537 are refused; IssueAccessToken and IssueRefreshToken refuse a TokenBinding or AttestedClient changed after the server returned it; pushed request parameters are bounded; a request_uri allows at most eight BeginAuthorization calls; a query or bare '#' in the issuer, endpoint or redirect URIs is refused; and fapigo/sqlstore refuses a SQLite file not in WAL mode. See UPGRADING.md.

Bug Fixes

• deps: pin FAPIgo v0.69.0 and fapigo/sqlstore v0.4.0 (ce226cf)
• sqlstore: refuse a SQLite database not in WAL mode (220a6ac)

v0.59.0

0.59.0 (2026-11-01)

Features

• issuer: let a ProofBindingKeyResolver say a key's trust is undecided (068f51c)

Bug Fixes

• issuer: name VerifiedPreAuthorizedCode in the production pre-authorized code error (2ca4819)
• oid4vci: refuse narrowing that drops locations or claims (835fb89)
• storage: copy a pre-authorized code's configuration IDs on Issue (4424cf5)
• verifier: refuse a plaintext result in a sealed transaction record (a5506c4)

v0.58.0

0.58.0 (2026-11-01)

⚠ BREAKING CHANGES

• deps: an issuer whose Authorization Server verifies Wallet Attestations with server.X5CAttesterChain now refuses, with invalid_client, an attestation signed by a certificate listing (or chaining only through a CA restricted to) the ISO/IEC 18013-5 mDL JWS or VICAL signer, ISO/IEC TS 23220-4 mdoc document signer or reader, RFC 9336 document signing, or RFC 6187 SSH extended key usage; issue attesters a dedicated certificate. It also refuses an x5c carrying a re-issued or cross-signed copy of a trust anchor (same subject and public key): send the signing certificate and its intermediates only. A deployment running fapigo/sqlstore v0.2.0 with a Sealer upgrades every instance at once, since v0.2.0 can't open records v0.3.0 seals, then runs SealRecords once.

Bug Fixes

• deps: pin FAPIgo v0.68.0 and fapigo/sqlstore v0.3.0 (de45f51)