v0.20.0

0.20.0 (2026-11-12)

Features

• sdk,cmdline: HTTP range TDF loading and partial decrypt (DSPX-5113, DSPX-5115) (#420) (9437084)
• sdk,cmdline: move HTTP range TDF loading in cmdline DSPX-5113 (#440) (059c369)
• sdk: DSPX-4584 stream the TDF manifest, remove the ~21.7M segment ceiling (#399) (35da51f)
• sdk: support ML-KEM rewrap session keys (#388) (8b3f321)

Bug Fixes

• main: bump org.bouncycastle:bcprov-jdk18on from 1.84 to 1.85 (#408) (1daa64a)
• sdk: align TDF3 IV construction (#412) (214e19e)
• sdk: don't re-run codegen when attaching sources (#419) (8fc820c)
• sdk: DSPX-1561 reject manifests with no key access objects (#433) (4e6bc91)
• sdk: DSPX-4589 zip64 EOCD sentinels, truncated archive detection, and UTF-8 entry names (#398) (e31db09)
• sdk: harden ZipReader central directory parsing against hostile fields (DSPX-5103) (#418) (a09eeb9)
• sdk: missed one on the previous pull (#415) (1ab8a3c)
• sdk: read a manifest.json entry from TDF archives (#406) (f7e0c10)
• sdk: read platform base keys from structured configuration (#429) (4092636)
• sdk: read the TDF spec version from all three places (#411) (0a10e74)
• sdk: reject empty TDF manifests (#422) (762fe40)
• sdk: reject key access entries without URLs (#423) (525e5b0)
• sdk: update dependencies (#410) (b3f293e)
• sdk: without this the enforcer step fails (#414) (1065499)