v2.3.0

What's Changed

• chore: revert nightly by @moabu in #14069
• fix(jans-cedarling): fix race condition in shutdown by @SafinWasi in #14076
• docs: add JARM doc by @ossdhaval in #13969
• docs(OIDC feature): created documentation for CIBA #4733 by @yuriyz in #14077
• fix(jans-auth-server): added request_uri validation in AuthorizeAction.getRequestedClaims by @yuriyz in #14086
• fix(config-api):audit endpoint changes by @pujavs in #14027
• fix(jans-cedarling): problem with normalizing token iss by @olehbozhok in #14084
• fix: remove gradle/wrapper/gradle-wrapper.jar from android projects by @duttarnab in #14089
• perf(jans-cedarling): optimize string types, logging path and entity serialization by @dagregi in #14090
• fix(jans-cedarling): remove outdated fields in Cedarling docs by @olehbozhok in #14096
• fix(jans-auth-server): escaped postLogoutUri in EndSessionUtils by @yuriyz in #14103
• fix(docs): OIDC consent by @ossdhaval in #14017
• fix(jans-fido2): align surefire JUnit engine version with jans-bom by @imran-ishaq in #14085
• feat(jans-cedarling): reject non-HTTPS issuer URLs at JWT fetch by @tareknaser in #14102
• perf(jans-cedarling): replace RwLock with ArcSwap to reduce lock contention by @dagregi in #14108
• fix(jans-auth-server): added validation for sector_identifier_uri in RedirectionUriService by @yuriyz in #14111
• fix(docs): fix incorrect placeholder by @ossdhaval in #14118
• feat(jans-cedarling): Synchronize JWT bootstrap defaults & enforce strict validation as default by @olehbozhok in #14098
• chore: avoid reloading attributes per user retrieval by @jgomer2001 in #14121
• feat(jans-cedarling): add CEDARLING_JWT_STATUS_LIST_REFRESH_INTERVAL_MAX bootstrap property by @olehbozhok in #14106
• ci: publish to PYPI by @moabu in #14116
• docs: add lost OpenSearch plugin entry by @jgomer2001 in #14129
• feat(jans-fido2): add Fido2MetricsConstants unit tests by @imran-ishaq in #14095
• fix: correct urls in Chart.yaml and README by @misba7 in #14146
• feat(jans-auth-server): how to test interception scripts? - sample unit test and docs #12663 by @yuriyz in #14147
• fix(cloud-native): regression after k8s python client upgraded to v36 by @iromli in #14157
• chore(cloud-native): update OCI image dependencies by @iromli in #14159
• ci: SLSA L3 by @moabu in #14152
• feat(jans-cedarling): warn at startup when JWT sig or status validation is disabled by @tareknaser in #14141
• feat(cedarling): Support static bearer token presentation for Lock Server API authorization by @yurem in #14151
• feat(cedarling): update cedarling-java build by @yurem in #14161
• refactor(jans-cedarling): replace explicit MemoryLogger eviction with SparKV earliest-expiration policy by @haileyesus2433 in #14162
• feat(jans-cedarling): remove wheel dependency from sidecar by @SafinWasi in #14125
• feat(jans-auth-server): added User Info JWT to Token Status List #14007 by @yuriyz in #14163
• feat: sync test-cases and README of java binding as per new policy store by @duttarnab in #14165
• perf(jans-cedarling): reduce clones through Arc sharing by @dagregi in #14173
• fix(jans-cedarling): disable token cache when max TTL is zero by @pradhankukiran in #14166
• fix(jans-pycloudlib): check if combined multi-parts secret already a valid JSON string by @iromli in #14183
• fix: improve OpenSSF scorecard security posture by @mo-auto in #14187
• fix(cloud-native): update pycloudlib to handle invalid multi-parts secret by @iromli in #14191
• feat(jans-lock): update integration with jans-lock and add integration tests by @yurem in #14169
• feat(jans-fido2): add JUnit 5 coverage for UserMetricsUpdateRequest DTO by @imran-ishaq in #14138
• feat(jans-fido2): fix test dependecies by @yurem in #14196
• feat(jans-cedarling): cap HTTP response body size on every remote fetch by @tareknaser in #14168
• chore: sync tarp with the latest cedarling changes by @duttarnab in #14182
• chore(jans-cedarling): improve wasm optimization build flags by @olehbozhok in #14202
• fix(jans-fido2): align AppleAttestationProcessorTest mocks with getAp… by @imran-ishaq in #14198
• ci: publish Java artifacts to GitHub Packages + Releases (jenkins offboarding A) by @mo-auto in #14199
• ci: repoint artifact consumers off jenkins/maven.jans.io to GitHub (offboarding B) by @mo-auto in #14210
• build: migrate Maven deps off jenkins/maven.jans.io to Central + Packages (offboarding B3) by @mo-auto in #14212
• test(jans-fido2): add JUnit 5 coverage for Fido2MetricsData DTO by @imran-ishaq in #14139
• fix(ci): build cedarling uniffi native lib in build-test (unblock nightly) by @mo-auto in #14218
• docs: refactor navigation for quick start guides by @ossdhaval in #14216
• ci: chain nightly/release pipeline via workflow_run (offboarding C) by @mo-auto in #14215
• fix(ci): publish agama-inbound jar so the auth-server image can build by @mo-auto in #14228
• fix(ci): clean leftover draft nightly releases before recreating by @mo-auto in #14229
• fix(docker-fido2): retry external cert/MDS downloads to survive transient errors by @mo-auto in #14230
• fix(docker-fido2): make FIDO MDS TOC seed download best-effort by @mo-auto in #14232
• docs(jans-cedarling): fix per-file trusted-issuer format by @tareknaser in #14209
• fix: treat secret as in rfc4226 by @jgomer2001 in #14237
• ci(jans-cedarling): upgrade OPA version by @SafinWasi in #14241
• feat(jans-fido2): add Fido2UserMetrics rate-calculation unit tests by @imran-ishaq in #14193
• Update ExternalResourceOwnerPasswordCredentialsService.java by @ayushjain0702 in #14149
• fix(cedarling-flask-sidecar): regenerate uv.lock to sync python-dotenv specifier by @mo-auto in #14250
• ci(docker): split all-in-one into post-matrix job, exclude shibboleth from build_all by @mo-auto in #14252
• feat(jans-cedarling): make Cedar schema optional by @olehbozhok in #14214
• feat(jans-cedarling): updating policies from URL by ttl by @haileyesus2433 in #14174
• feat(jans-cedarling): Cedarling PostgreSQL Extension by @haileyesus2433 in #13856
• ci(docker): pass JANS_SOURCE_VERSION as build-arg from current commit SHA by @mo-auto in #14269
• fix(jans-auth-server): p-256 signature happens with X or Y curve being less than 32 bytes, breaking RFC 7518 §6.2.1.2 by @ayushjain0702 in #14256
• ci: run the Java integration test-suite on GitHub against AIO (jenkins offboarding D) by @mo-auto in #14225
• fix(cloud-native): unable to generate auth keys by @iromli in #14275
• ci: remove docker-jans-monolith (jenkins offboarding E) by @mo-auto in #14277
• ci: final jenkins.jans.io / maven.jans.io reference cleanup (jenkins offboarding F) by @mo-auto in #14314
• test(jans-auth-server): improved ECDSAPublicKeyTest by @ayushjain0702 in #14317
• ci: drop the last jenkins.jans.io reference (offboarding follow-up) by @mo-auto in #14316
• fix!(jans-cedarling): default entities can be silently overridden by request-supplied entities by @olehbozhok in #14258
• fix(jans-cli-tui): typo in auidit logs search by date by @devrimyatar in #14323
• fix(jans-cedarling): update Cedarling build triggers to workflow_run by @haileyesus2433 in #14328
• The FIDO Alliance conformance suite expects every attestation/assertion by @imran-ishaq in #14265
• docs: fix typography by @SafinWasi in #14330
• fix(config-api): config-api fido2 metrics parameter null check by @pujavs in #14274
• Fix(jans fido2) cosmetic error message grammer fix by @ayushjain0702 in #14334
• fix(ci): resolve go-vet PR-check failures by @mo-auto in #14340
• feat(jans-cedarling): improve policy store URI detection using content-type by @dagregi in #14201
• feat(jans-tarp): add Claude and Ollama LLM providers from AI assistant; remove Gemini and DeepSeek by @duttarnab in #14331
• perf(jans-cedarling): zero-copy JSON marshal via goccy/go-json by @dagregi in #14348
• fix(ci): by passing the pgrx-managed pg_config explicitly so the matrix version is the only one active. by @haileyesus2433 in #14346
• fix(jans-cedarling): fix collection of cedarling-java binding jar in the Janssen Build and Publish script by @duttarnab in #14359
• docs(jans-cedarling): use iss not issuer in attribute checklist by @tareknaser in #14361
• docs: add request object doc by @ossdhaval in #14126
• feat(jans-auth-server): add support for Identity Assertion JWT Authorization Grant #14142 by @yuriyz in #14178
• fix(jans-linux-setup): typo fix identity_assertion_identity_assertion -> identity_assertion_identityassertion by @yuriyz in #14367
• ci: manual release-trigger, terraform-provider AIO tests, provider spec sync by @mo-auto in #14355
• Enforce the WebAuthn assertion checks during verification by @imran-ishaq in #14267
• feat(jans-cedarling): support splitting Cedar schema across multiple files by @olehbozhok in #14259
• feat(cloud-native): sync identity assertion templates by @iromli in #14370
• fix(ci): suffix release image tags and sync Cargo.lock on bump by @mo-auto in #14373
• fix(jans-fido2): reject Apple attestation without x5c by @imran-ishaq in #14273
• fix(ci): config-api release URL, flask-sidecar uv.lock, tf-authz post-build by @mo-auto in #14381
• fix(ci): purge the deploy target version so a re-release overwrites (409) by @mo-auto in #14389
• refactor(jans-cedarling): consolidate refresh metrics, remove authz duplication, and optimize refresh rebuilds by @haileyesus2433 in #14362
• fix(ci): all-in-one re-run poll + build release packages from the tag by @mo-auto in #14392
• fix(ci): build all-in-one on the release/nightly chain (was silently skipped) by @mo-auto in #14394
• fix(ci): all-in-one poll needs actions:read (was silently 403 → timeout) by @mo-auto in #14399
• fix(ci): give the all-in-one poll a GH_TOKEN (was failing every gh api call) by @mo-auto in #14401
• feat(jans-fido2): implement android-key attestation for conformance by @imran-ishaq in #14271
• feat(jans-fido2): reject metadata-fetch failure in enforced attestation on mode by @imran-ishaq in #14342
• test(jans-fido2): assert REVOKED MDS status is rejected (CONF-19) by @imran-ishaq in #14344
• fix(jans-cedarling): replace sleep-based flush with interval tick by @dagregi in #14404
• feat(jans-cedarling): embed git commit and build timestamp in Cedarling binary and log at startup by @olehbozhok in #14390
• refactor(docs): update build instructions by @ossdhaval in #14384
• Update checksum verification commands in ubuntu.md by @manojs1978 in #14398
• chore(jans-cedarling): Improve perfomance using faster HashMap(ahash) by @haileyesus2433 in #14405
• feat: allows users to explore the policy-store archive (.cjar) file r… by @duttarnab in #14413
• ci: adds context7 by @moabu in #14418
• fix(jans-cedarling): reject non-string extension claims instead of panicking by @tareknaser in #14411
• refactor(jans-cedarling): inline sparkv into cedarling to simplify crates.io publishing by @olehbozhok in #14407
• feat(jans-cedarling): add authzen API endpoints by @SafinWasi in #14397
• perf(jans-cedarling): drop global mutex from uuid7 hot path by @dagregi in #14430
• perf(jans-cedarling): cut Java/UniFFI marshalling overhead on hot path by @haileyesus2433 in #14438
• perf(jans-cedarling): make SparKV backing map generic (HashMap + BTreeMap) by @olehbozhok in #14431
• feat: show alert and remove client if it is expired by @duttarnab in #14444
• ci(jans-cedarling): fix audit rate limit + add crates.io publish workflow by @mo-auto in #14453
• docs: add llms.txt by @ossdhaval in #14420
• docs(jans-cedarling): add kotlin tutorial by @duttarnab in #14464
• ci(jans-cedarling): wire cedarling crates.io publish into nightly + release flows by @mo-auto in #14455
• fix(jans-cedarling): flush telemetry on receive by @dagregi in #14466
• docs(jans-cedarling): clarify exp/nbf validation is conditional in authz table by @tareknaser in #14473
• chore(jans-cedarling): unified cross-binding benchmark contract for unsigned + multi-issuer paths by @haileyesus2433 in #14441
• ci(release): distribute release uploads to a second account (rate-limit workaround) by @mo-auto in #14470
• fix(jans-cedarling)!: fail closed when a status list refresh fails by @tareknaser in #14450
• perf(jans-cedarling/bindings/python): cut PyO3 conversion overhead on hot path by @haileyesus2433 in #14461
• chore(deps-dev): bump org.apache.maven.plugins:maven-resources-plugin from 3.4.0 to 3.5.0 in /jans-scim by @dependabot[bot] in #14286
• chore(deps-dev): bump org.jacoco:jacoco-maven-plugin from 0.8.14 to 0.8.15 in /jans-scim by @dependabot[bot] in #14293
• chore(deps): bump com.github.spotbugs:spotbugs-maven-plugin from 4.9.8.2 to 4.10.2.0 in /jans-scim by @dependabot[bot] in #14299
• chore(deps-dev): bump org.apache.maven.plugins:maven-dependency-plugin from 3.10.0 to 3.11.0 in /jans-scim by @dependabot[bot] in #14301
• feat(jans-auth-server): add support for rfc9207 - OAuth 2.0 Authorization Server Issuer Identification by @yuriyz in #14460
• chore(deps): bump io.grpc:grpc-bom from 1.80.0 to 1.82.0 in /jans-casa by @dependabot[bot] in #14305
• build(deps): bump com.fasterxml.jackson.core:jackson-databind from 2.21.2 to 2.22.0 in /jans-casa in the maven group across 1 directory by @dependabot[bot] in #14416
• chore(deps-dev): bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.5 to 3.5.6 in /agama by @dependabot[bot] in #14282
• fix(jans-cedarling): make constants BUILD_COMMIT and BUILD_TIMESTAMPprivate by @olehbozhok in #14501
• ci: configure macOS SDK by @moabu in #14499
• feat(jans-fido2): honor per-endpoint MetadataServer rootCert as MDS TOC trust anchor by @imran-ishaq in #14352
• fix(jans-fido2): use a consistent BouncyCastle provider for all COSE signature algorithms by @imran-ishaq in #14354
• fix(jans-fido2): verify AIK certificate AAGUID extension against auth… by @imran-ishaq in #14364
• feat(jans-orm): add attestationTrusted flag to Fido2RegistrationData by @imran-ishaq in #14388
• fix(jans-fido2): enforce packed attestation certificate requirements by @imran-ishaq in #14372
• feat(jans-fido2): enforce fido-u2f attestation certificate requirements by @imran-ishaq in #14380
• feat(jans-fido2): validate allowCredentials, userHandle and rawId in assertion by @imran-ishaq in #14383
• feat(jans-fido2): add attestation trust policy and attestationTrusted flag for monitor mode by @imran-ishaq in #14386
• fix(jans-fido2): verify packed attestation certificate AAGUID extension by @imran-ishaq in #14366
• chore(jans-cedarling): update dependencies by @olehbozhok in #14509
• feat: add Cedarling UniFFI iOS XCFramework build to build-packages wo… by @duttarnab in #14474
• feat(jans-fido2): enforce TPM attestation certificate requirements by @imran-ishaq in #14510
• fix(jans-cedarling): fix validating exp/nbf JWT payload by @olehbozhok in #14517
• perf(jans-cedarling)!: take authorize request as JSON string by @dagregi in #14506
• feat(jans-lock): lock should unpack Cedarling policy store at startup to init it by @yurem in #14448
• fix(jans-config-api):from admin-ui configuration, remove license-expi… by @duttarnab in #14528
• refactor(jans-pycloudlib): remove legacy compression support for external secrets by @iromli in #14432
• fix(jans-cli-tui): dipslay no scopes available message by @devrimyatar in #14534
• ci: remove npm auth token. by @moabu in #14535
• feat(jans-auth-server): redis - added ability to specify user for redis connection and keyPrefix support #14520 by @yuriyz in #14532
• fix: update lock server policy handling for Docker build by @moabu in #14538
• fix(jans-auth-server): added safeguards for sector_identifier_uri in Dynamic Client Registration #14540 by @yuriyz in #14541
• fix(jans-cedarling): update benchmarks token expiration by @dagregi in #14537
• refactor(jans-cedarling): defer audit entry serialization off hot path by @dagregi in #14531
• ci: remove registry-url by @moabu in #14544
• feat(jans-auth-server): improved CIBA parameters validation #14553 by @yuriyz in #14554
• docs: fix llms.txt URL by @ossdhaval in #14559
• ci: clean up docs ops by @moabu in #14567
• ci: add .yamllint by @moabu in #14568
• ci: fix dangerous workflow pattern by @moabu in #14569
• fix(jans-cli-tuı): don't diplay 'no matching' after deleting ssa by @devrimyatar in #14572
• chore: fix security vulns by @moabu in #14573
• fix(jans-cedarling): update hardcoded status field in telemetry entry by @dagregi in #14555
• feat: common policy-based authorization cedarling module #14521 by @yurem in #14522
• chore(cloud-native): sync config-api dynamic conf by @iromli in #14591
• feat: reorder Tarp README by @duttarnab in #14558
• fix(jans-cedarling): fix running uniffi android bindings by @duttarnab in #14584
• feat(jans-lock): reuse jans-core-cedarling in Lock by @yurem in #14593
• fix(jans-auth-server): protected bypass via IPv6 transition addresses in sector_identifier_uri and client_id URL validation by @yuriyz in #14598
• fix(jans-auth-server): RFC 8215 Local-Use IPv4/IPv6 Translation prefix 64:ff9b:1::/48, reserved for local NAT64 by @yuriyz in #14599
• chore: adjust csp by @moabu in #14603
• docs: refactor fido and passkey docs by @ossdhaval in #14547
• feat(jans-core): remove jans-auth-client dependecy in jans-core by @yurem in #14613
• chore(cloud-native): set wget no-verbose without being quiet by @iromli in #14617
• feat(jans-fido2): deep-link passkey how-to to Casa and Agama deployment guides by @imran-ishaq in #14620
• feat(jans-cedarling): add conversion script by @SafinWasi in #14575
• chore: fix order by @moabu in #14619
• fix: add download with retry for jans-cli-tui by @moabu in #14622
• feat(jans-cedarling): expose policy annotations to the caller by @dagregi in #14596
• feat(jans-lock): update lock ORM model by @yurem in #14628
• feat(jans-lock): update deps jans-lock-server-service-deps-pack.zip by @yurem in #14630
• fix(jans-cli-tui): only one of one time use or rotate can be checked for SSA by @devrimyatar in #14626
• feat(jans-linux-setup): fallback to env var in case downloading fails by @devrimyatar in #14632
• chore(deps): bump com.fasterxml:aalto-xml from 1.3.4 to 1.4.0 in /jans-casa by @dependabot[bot] in #14503
• chore(deps): bump com.github.spotbugs:spotbugs-maven-plugin from 4.10.2.0 to 4.10.3.0 in /jans-scim by @dependabot[bot] in #14543
• chore(deps): bump com.fasterxml.jackson.core:jackson-databind from 2.22.0 to 2.22.1 in /jans-casa in the maven group across 1 directory by @dependabot[bot] in #14562
• chore(deps-dev): bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 in /jans-scim by @dependabot[bot] in #14601
• fix(docs): fix broken links by @ossdhaval in #14634
• chore(jans-cedarling): reduce PolicyStore visibility from pub to pub(crate) by @olehbozhok in #14624
• feat(jans-cedarling): add batch authorize APIs for unsigned and multi-issuer flows by @haileyesus2433 in #14615
• fix(config-api): security advisory on asset upload and agama repo download by @pujavs in #14652
• feat(cloud-native): add allowedDomain config for jans-config-api by @iromli in #14655
• fix(jans-fido2): capture ip address, user agent and session id in passkey metrics by @imran-ishaq in #14653
• test(agama): add transpiler subflow and web-interaction codegen conformance tests by @imran-ishaq in #14486
• feat(jans-auth-server): add explicty whitelisting for external uris called by AS (e.g. sector_identifier_uri) #14637 by @yuriyz in #14666
• fix(jans-fido2): fall back to cached MDS TOC when download fails by @imran-ishaq in #14665
• fix(cedarling-java): fix kotlin source by @yurem in #14669
• fix(cedarling-java): don't use cached remote relese files by @yurem in #14670
• fix: use nginx instead of traefik in helm quickstart by @misba7 in #14657

New Contributors

• @ayushjain0702 made their first contribution in #14149

Full Changelog: v2.1.0...v2.3.0