3.0.0

Lockbox 3 makes biometric credentials prompt on every use and survive a change to the enrolled biometrics, and fixes API and keychain-identity problems found in review. It contains source-breaking changes and requires Swift 6.3. Read Migrating to Lockbox 3 before upgrading.

Biometric credentials

• save() and retrieve() prompt on every call. Lockbox 2 reused an authenticated context, so later calls could succeed without a prompt.
• After the enrolled biometrics change, retrieve() throws the new BiometricServiceError.biometricChanged before prompting, hasCredentials is false, and save() replaces the credentials without forget().
• save() deletes the old item and then adds the new one, so it never updates an item that a biometric change has invalidated.
• The biometric state is recorded on the keychain item, replacing the baseline files in Application Support.
• retrieve() returns BiometricService.Credentials, and BiometricServiceResult is removed.
• hasCredentials and forget() are async, and all keychain work runs off the main actor.
• BiometricService(accessGroup:) replaces group:, and the synchronizable parameter is removed.

Users with credentials saved by Lockbox 2 sign in once more after upgrading.

Keychain fixes

• generic(...) and internet(...) take a single protection:, either an accessibility or an access-control policy. Keychain Services rejected items that set both.
• Saving with a new access control now applies it to an existing item.
• allGenericPassword handles are scoped to each item's own access group, so remove() deletes only that item.
• getString() throws KeychainError.invalidUTF8 for data that isn't UTF-8, instead of returning nil.
• KeychainError equality compares the status only.
• .synchronizable(nil) clears an earlier value, as the "later criterion wins" rule documents.

Internet-password identity

These change which stored item a handle finds; the migration guide shows how to move affected items.

• Hosts are lowercased.
• URLs without a scheme, such as example.com:8443/login, map to an https host, port, and path.
• The .url criterion defaults to the .default authentication type, matching internet(url:).

Other changes

• Removed the unused operation parameter from evaluate(policy:reason:).
• Renamed KeychainRecord.description to itemDescription.
• CONTRIBUTING.md records why Lockbox depends on swift-docc-plugin.

Full Changelog: 2.0.0...3.0.0