6.0.0 (2026-07-15)

issuance: advertise classic and fully-specified mdoc alg ids (#819) (2791988), closes #814
client: decouple mdoc namespace from path in field management (#830) (3acddf6)
enforce single-use credential_offer_uri resolution (#829) (c9c18f7), closes #796
security: harden tenant/session isolation and outbound webhook safety (#820) (546b68d)
improve e2e execution and stabilize OIDF test lifecycle (#823) (02a1dd8)
make webhooks selectable (#802) (cdb84fc)
resolve malformed mDOC issuer items and offer form generation (#812) (3a518da)
sdk versioning (#815) (f800b24)
send trusted_authorities to wallets by default (#766) (#821) (655de85)
support DCQL claim_sets in OpenID4VP (#828) (bb79c9f)
wire mdoc status issuance and verification (#846) (e74f13f)

add csc as additional kms option (#825) (bd0a8b6)
add CWT status list negotiation, verifier support, tests, and docs (#844) (f15667c)
add ISO 18013-7 Annex C (org-iso-mdoc) Digital Credentials API support (#836) (df24900), closes #1
issuance: add issuer registration certificate import/generate in metadata (#818) (9cbd662)
add published demo backend image with embedded config bootstrap (#841) (23781f2)
add schema metadata name support and refresh generated APIs (#850) (2951898)
oid4vci: default pre-authorized flow to built-in AS (#827) (b7653d9)
issuance: enforce id-only authorization server references (#839) (366f480)
implement credential offer by reference for vci (#795) (ba40c5a)
move refresh-token policy to auth server config and unify credential field editing (#831) (cb93d24)
support nested credential fields with children (#799) (cc2ac00)
kms: tenant config support and admin/key management UI alignment (#826) (4c49428)
update issuance config and certificate import (#805) (2a4df45), closes #798

authorization server references must now be id-only. Existing inline/full-object configs are no longer accepted. See migration docs for required config updates.

This release is also available on:

Navigation Menu