Release v3.9.0 (11/05/2026)

🚀 Release v3.9.0 (20261105)

🚀 New Features

PKCS#11 Enhancements

• Added CKK_EC key type validation in pkcs11_key_get_ec_params() and pkcs11_key_get_ec_point() APIs.
• Added PKCS11_NO_LOGIN build option to disable C_Login() support for deployments using no-auth-required keys.

Build System Improvements

• Updated CMake configuration to use target_include_directories() for improved build maintainability.

🛠 Fixes & Improvements

Build & Configuration

• Fixed build and link issues across TA, CA, and CA2 device configurations.
• Resolved PKCS#11 debug attribute compilation issues and AES-CCM test build errors.

PKCS#11

• Corrected PIN validation and C_SetPIN() authentication requirements.
• Updated CKA_ALWAYS_AUTHENTICATE handling for CA devices.
• Improved slot initialization robustness by continuing initialization when individual slots fail.

Memory Management & Thread Safety

• Fixed potential double-free, null pointer dereference, race condition, and memory leak issues.
• Enhanced thread safety for object search operations and certificate cache handling.

Certificate Handling

• Improved certificate cache robustness, error recovery, and subject length reporting.
• Prevented invalid memory allocation and stale object state during certificate operations.

Platform Support

• Added ATCA_NO_HEAP guard protection for custom interface configurations.