Skip to content

v0.61.0

Choose a tag to compare

View all tags
@osanderson osanderson released this 02 Nov 11:18
Immutable release. Only release title and notes can be modified.
v0.61.0
462c749
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.61.0 (2026-11-02)

⚠ BREAKING CHANGES

  • TransactionsConfig.RequestURIBase with a query or a fragment, RedirectURI with a fragment, and an origin ending in a bare '?' or '#' are refused.
  • verifier: verifier.AESGCMSealer refuses a key that's one byte repeated or all printable text. Generate 32 bytes with crypto/rand and decode an encoded key before passing it.
  • certchain: a presented certificate chain (x5c or x5chain, from an issuer, wallet, verifier, attester or mdoc reader) with an RSA key over 4096 bits, or with an exponent other than 65537, is refused. Configured trust anchors aren't checked.
  • deps: an issuer running fapigo/server beside issuer gets FAPIgo v0.69.0's behavioural changes: Wallet Attestation x5c RSA keys over 4096 bits or with e != 65537 are refused; IssueAccessToken and IssueRefreshToken refuse a TokenBinding or AttestedClient changed after the server returned it; pushed request parameters are bounded; a request_uri allows at most eight BeginAuthorization calls; a query or bare '#' in the issuer, endpoint or redirect URIs is refused; and fapigo/sqlstore refuses a SQLite file not in WAL mode. See UPGRADING.md.

Bug Fixes

  • certchain: refuse RSA keys over 4096 bits or with e != 65537 (61fdd1e)
  • deps: pin FAPIgo v0.69.0 and fapigo/sqlstore v0.4.0 (ce226cf)
  • refuse a bare '?' or '#' in origins and the verifier's URLs (d20c9dc)
  • verifier: refuse a weak AESGCMSealer key (8ece9cd)
Assets 3
Loading