2.20.0

What's Changed

✨ New Features

• Complete pre-registered certificates over SCEP enrolment by @klaraf755 in #1968
• Add comment threads across supported resources by @klaraf755 in #2105
• Handle comment events and deliver notifications by @klaraf755 in #2116
• Configure content signing profiles that sign and timestamp documents by @ivosh in #2120
• Add platform branding with logo and colours, shown before sign-in by @Jakub-Bartal-01 in #2081
• Check certificate purpose before content and raw signing by @ivosh in #2148
• Give each user named views of an inventory listing by @Jakub-Bartal-01 in #2158
• Add a cryptographic asset inventory built from CBOMs by @karolhrdina in #2167
• Manage tokens on Cryptography Provider API v2 connectors by @LukasNajman in #2171
• Rate cryptographic assets for post-quantum readiness by @vyskocilm in #2227
• Run discoveries against Discovery Provider API v2 connectors by @lubomirw in #2175
• Sign, verify and generate random data on Cryptography Provider v2 by @klaraf755 in #2287
• Import keys into token profiles by @3keyroman in #2374
• Import certificates and keys from files by @3keyroman in #2377
• Download certificate with private key as PKCS#12 by @3keyroman in #2381

🔧 Enhancements

• Choose which event data a notification profile includes by @3keyroman in #1938
• Require the registration challenge to renew or rekey registered certificates by @klaraf755 in #1936
• Enrich external notifications with event subject object data by @3keyroman in #1954
• Resolve owner and object recipients for approval notifications by @3keyroman in #1957
• Complete pre-registered certificates over CMP enrolment by @klaraf755 in #1989
• Return the required flag when listing custom attributes by @klaraf755 in #2011
• Serve request, renew and identify attribute schemas from the authority connector by @klaraf755 in #2092
• Validate key usage and extended key usage values in CSRs by @klaraf755 in #2142
• Use connector-provided request attributes and restore their merge modes by @klaraf755 in #2164
• Show attribute values as configurable listing columns by @Jakub-Bartal-01 in #2162
• Keep the subject and SANs when renewing or rekeying by @klaraf755 in #2174
• Sort inventory listings by any offered column by @Jakub-Bartal-01 in #2178
• Surface request-attribute validation warnings under lenient mode by @klaraf755 in #2181
• Filter cryptographic keys by enabled state and creation date by @Jakub-Bartal-01 in #2217
• List the users assigned to a group by @klaraf755 in #2211
• Add support for Cryptography Provider v2 in Token Profile Management by @LukasNajman in #2212
• Sync CBOMs in pages and let operators retry skipped ones by @karolhrdina in #2245
• Require External Account Binding on ACME profiles that configure a key by @klaraf755 in #2239
• Manage keys on Cryptography Provider v2 tokens by @LukasNajman in #2261
• Pre-authorize identifiers listed on an ACME profile by @klaraf755 in #2248
• Configure CBOM sync and asset ingest in platform settings by @vyskocilm in #2282
• Import discovered keys into the key inventory by @lubomirw in #2333
• Use keys on Cryptography Provider v2 tokens in signing profiles by @ivosh in #2334
• Export keys from Cryptography Provider v2 tokens as encrypted PKCS#8 by @3keyroman in #2358
• Expire proxy requests when Core stops waiting by @3keyroman in #2369
• Generate a CSR for a key on a Cryptography v2 connector by @lubomirw in #2355
• Express certificate extensions as ASN.1 modules and their values as JER by @klaraf755 in #2348
• Give certificates and protocols a PQC verdict, and explain every verdict by @vyskocilm in #2411
• Recount CBOM crypto asset totals from the full document by @vyskocilm in #2363
• Show each scheduled job's live schedule state and skipped runs by @karolhrdina in #2415
• Let SCEP and CMP use keys on cryptography provider v2 tokens by @LukasNajman in #2439
• Add opt-in JSON console log format by @lubomirw in #2458
• Accept RFC 9440, XFCC and Traefik client certificate headers by @3keyroman in #2547

🐛 Bug Fixes

• Reach signature formatting connectors through the connector proxy by @ivosh in #2036
• Fix Date, Time and Datetime custom attributes being stored in an unreadable format by @ivosh in #2084
• Fix workflow actions that set Datetime custom attributes by @ivosh in #2121
• Fix 403 on Authority v3 operations with certificate reference attributes by @lubomirw in #2177
• Connector-origin auth and server errors surface as 502 by @lubomirw in #2189
• Attribute signing records to the authenticated caller by @3keyroman in #2223
• Keep the signing volume history when signing records are deleted by @3keyroman in #2225
• Apply custom attribute read permissions to attribute filters by @Jakub-Bartal-01 in #2216
• Refuse timestamping when no policy OID can be resolved by @3keyroman in #2222
• Record history for scheduled jobs running longer than two minutes by @karolhrdina in #2264
• Evaluate trigger conditions on empty fields instead of failing by @klaraf755 in #2259
• Stop duplicate scheduled jobs after nodes start together by @vyskocilm in #2266
• Keep OAuth2 providers editable when their JWK Set is unreachable by @lubomirw in #2289
• Surface a disabled secret as 422 instead of 500 by @klaraf755 in #2294
• Answer an empty CBOM identifier instead of failing the bulk delete by @vyskocilm in #2298
• Stop naming unissued certificates 'null' in notifications and audit logs by @klaraf755 in #2342
• Clear per-request log context when a request fails by @3keyroman in #2384
• Stop counting a missing registration secret as a failed attempt by @lubomirw in #2408
• Hide unreadable custom attributes from filter and column choices by @lubomirw in #2422
• Refuse attribute values whose version differs from their definition by @lubomirw in #2431
• Let certificate owners archive their own certificates by @lubomirw in #2432
• Stop revoked certificates from reverting to Issued by @lubomirw in #2427
• Stop compliance check reporting existing profiles as not found by @lubomirw in #2454
• Answer request attributes without a UUID with 422, not 500 by @klaraf755 in #2467
• Refuse a non-integer CBOM version before uploading it by @vyskocilm in #2460
• Skip CBOM sync when no repository answers at its URL by @vyskocilm in #2464
• Store attribute values once and keep staged protected metadata encrypted by @lubomirw in #2486
• Apply certificate custom attributes when a user's certificate already exists by @klaraf755 in #2456
• Refuse a listing page size above the documented maximum of 1000 by @Jakub-Bartal-01 in #2527
• Answer unknown search filter fields with 422 instead of 500 by @Jakub-Bartal-01 in #2528
• Prevent duplicate attribute definitions that left discoveries stuck in progress by @lubomirw in #2523
• Fix inventory filters on CRL, OCSP and signature validation status by @klaraf755 in #2533
• Push a certificate issued through a Location to the keystore by @klaraf755 in #2535
• Refuse a scheduled job name that is already taken by @lubomirw in #2553
• Return the real error status instead of 401 from the error page by @lubomirw in #2554
• Fix scheduled job not-found message by @lorentelimaethan in #2556
• Pin search_path for each Flyway migration behind PgBouncer by @lubomirw in #2570
• Repair Date, Time and Datetime attribute values stored before 2.20.0 by @lubomirw in #2573

🔒 Security

• Upgrade Bouncy Castle to 1.85 for CVE-2026-8763 and CVE-2026-13506 by @lubomirw in #2295
• Keep secrets out of request logs and audit records by @3keyroman in #2387

⚡ Performance

• Cache OPA authorization decisions by the caller's effective permissions by @klaraf755 in #2277
• Add database indexes that speed up inventory listings by @lubomirw in #2372
• Cache attribute filter fields to speed up listing searches by @lubomirw in #2412

📦 Dependencies

• Upgrade to Spring Boot 4.1 by @ivosh in #2540

📋 Other

• Relicense to Apache-2.0 by @3keyroman in #2241

New Contributors

• @karolhrdina made their first contribution in #2167
• @lorentelimaethan made their first contribution in #2556

Full Changelog: 2.19.0...2.20.0