Release v2026-08-25

This release introduces major protocol enhancements, key structural refactorings to support multi-vertical expansion, payments security improvements (3DS2) and structured request constraints, independent capability versioning, and grocery vertical readiness.

📊 Executive Summary

• 📂 Multi-Vertical Refactoring: Foundation laid for supporting Food and Lodging verticals alongside Shopping, with polymorphic token binding and vertical-agnostic payment constructs.
• 🛒 Grocery Vertical Readiness: Introduction of Location Search & Lookup capabilities, deterministic operating hours, fulfillment location context, and fractional quantities with sale-basis pricing steps.
• 🔑 Payments Security & Structured Constraints: Implementation of vendor-agnostic 3D Secure (3DS2) authentication flows via Actions, response-carried $requestConstraints (with path targeting & anyOf), and split PAN / Network Token credentials.
• 📅 Payment Terms & Schedules: Deferred payments, deposits, and installment schedules, along with multi-instrument Split Payments.
• 📦 Capability Versioning & Architecture: Tightened the core version release contract for UCP and version negotiation strategy while also introducing support for namespace ordering (map_order).
• 🤝 Identity & Consent Overhaul: Modernized UCP’s identity and consent architecture—introducing reverse-DNS consent, delegated IdPs, and canonical profile keys—while launching the loyalty extension for interoperable reward ecosystems.

---

✨ New Capabilities & Detailed Changes

1. Core Protocol & Infrastructure

• ⚡ Actions Primitive (#582): Introduces a horizontal, extension-defined actions[] array to Cart, Checkout, and Catalog. Allows businesses to request out-of-band actions (like authentication or form-filling) from the platform.
• 🏷️ Namespace Reservation & Ordering (#657): Reserves the ucp protocol namespace and adds map_order to enforce registry ordering.
• 🔒 Namespace Authority Binding (#530, #627): Defines how platforms verify that a business has authority over a reverse-DNS namespace via DNS/host matching.
• 📦 Capability Versioning (#614): Clarified and tightened the core version release contract, establishing formal guidelines for date-based capability versioning and forward compatibility across protocol updates.
• 📂 Vertical Refactoring (#723, #736, #741, #761): Restructured the repository layout into domain verticals (Shopping, Payment, Common) and centralized common primitives in common/types/ and refactors payment extensions into dev.ucp.common.payment.*.
• 🌐 Polymorphic Token Binding (#746): Refactors token binding to be vertical-agnostic and polymorphic across multiple verticals.

2. Grocery & Location Capabilities

• 🔍 Location Search + Lookup (#589, #642, #753, #765, #766): Adds capability to search for physical store locations and lookup details (address, hours, geocoding) with location context hints and correlation.
• 🕒 Deterministic Operating Hours (#687): Standardizes how businesses publish regular and exception hours with timezone handling for pickup locations.
• 🏷️ Explicit Destination Types (#688): Requires explicit tagged destination types (shipping vs pickup) in fulfillment methods to prevent ambiguous union matches.
• ⚖️ Fractional Quantities & Sale-Basis (#597, #653): Allows purchasing products in non-integer quantities (e.g., weighted items by kg, lb), defines price/quantity steps, and enforces an integer bound cap.
• 🗺️ Fulfillment Location Context (#671): Connects negotiated fulfillment methods directly to specific location contexts across Catalog, Cart, and Checkout.

3. Payments & Security

• 🔑 3DS2 Authentication (#458): Implements vendor-agnostic 3D Secure (3DS2) support (Device Data Collection and Challenge flows) using the Actions primitive.
• ⚠️ Response-Carried Request Constraints (#655, #744, #757): Introduces $requestConstraints allowing businesses to return transaction-specific schema validation rules for subsequent requests, including path targeting and anyOf constraint evaluation.
• 💳 Instrument Requirements & Credential Splitting (#424): Expresses instrument requirements via constraints and splits PAN and Network Token into explicit, distinct credential types.
• 📅 Payment Terms & Schedules (#602, #603): Introduces payment schedules (simple and well-defined terms) supporting deferred payments, deposits, and installments at checkout.
• 🥞 Split Payments (#409): Adds support for split payments across multiple instruments.

4. Identity, Consent & Loyalty

• 🌐 Delegated Identity Providers (#423): Standardizes accelerated IdP sign-in flows and delegation mechanisms.
• 🎁 Loyalty Extension (#340): Formalizes the Loyalty capability across Catalog, Cart, and Checkout, transitioning from legacy discount-based workarounds.
• 🤖 Web Bot Auth (WBA) Interop (#483): Introduces WBA interop to allow automated agentic auth negotiation.
• 🔐 Canonical Profile Keys (#566): Promotes keys[] (JWK Set) as the sole canonical signing key field.
• 🛡️ Extensible Buyer Consent (#451): Restructures buyer consent from fixed booleans into a dynamic, reverse-DNS keyed map supporting granular, per-segment opt-in purposes.

5. Shopping Enhancements & Fixes

• 📣 Attribution (#391): Adds support for platform-driven referral and ad attribution context.
• 📄 Policies (#572): Adds a policies[] snapshot to Cart, Checkout, Catalog, and Order to carry return, refund, and warranty terms.
• 🔗 Shopping Permalink (#523): Adds permalink capabilities to recreate cart states via URL (useful for email/QR codes).
• 🛠️ Cart ID Fix (#633, #646): Standardizes cart.id as omitted in update requests to simplify client implementations.
• 🏷️ Discount Allocation Totals Path Fix (#558): Corrects totals path in discount allocation documentation examples.

---

🚨 Breaking Changes

The following changes are backward-incompatible and require schema updates:

• Fulfillment Schema Restructure (#507, #581, #763)
  • Configuration Flags: Renamed flags to drop the allows_ prefix (multi_destination, method_combinations).
  • Fulfillment Option: Upgraded fulfillment_option.description from a flat string to a structured description object.
  • Multi-Destination: Remodeled multi_destination configuration from a map to an array of objects.
  • Method Types: Opened fulfillment_available_method.type enum to string.
  • Merchant Consolidation: Consolidated merchant configurations into business_fulfillment_config.json and deleted merchant_fulfillment_config.json.
• Buyer Consent Overhaul (#451)
  • Dynamic Map: Restructured consent in buyer_consent.json from fixed boolean fields to a dynamic map keyed by reverse-DNS identifiers (dev.ucp.consent.*), returning complex consent_purpose objects with granular segment-level opt-ins.
• Profile Keys Promotion (#566)
  • Canonical Signing Keys: Removed signing_keys[] from profile.json and promoted keys[] (JWK Set) as the sole canonical signing ...

Release v2026-04-08

What's Changed

✨ New Features

• feat(cart): Cart capability for basket building by @igrigorik in #73
• feat(extends): multi-parent support + deterministic schema resolution by @igrigorik in #96
• feat(errors): spec error handling for UCP negotiation failures by @igrigorik in #128
• feat(context): add intent field for relevance and personalization by @igrigorik in #95
• feat: Add first-class errors concept by @richmolj in #147
• feat: add ec_color_scheme query parameter to embedded checkouts by @westeezy in #157
• feat: signing for UCP requests & responses by @igrigorik in #156
• feat: Allow fulfillment method type (and id) to be optional on Fulfillment method updates by @matthutchinson in #143
• feat: add available_instruments to payment handler configurations by @raginpirate in #187
• feat: Adding currency field to top level of Order by @deinck6 in #210
• feat(errors): business logic error response for checkout and cart by @alexpark20 in #216
• feat(catalog): Catalog Search+Lookup capabilities for product discovery by @igrigorik in #55
• feat: extend discount capability to cart by @igrigorik in #246
• feat!: signals for authorization & abuse by @igrigorik in #203
• feat: eligibility claims & verification contract by @igrigorik in #250
• feat: formalize totals contract by @igrigorik in #261
• feat: extend warning to support disclosure contract by @igrigorik in #267
• feat(embedded): add link delegation extension by @westeezy in #247
• feat: Add ec.totals.change to Embedded Checkout Protocol by @lemonmade in #272
• feat!: update Order capability by @richmolj in #254
• feat!: Update the Order schema to make currency a required field by @deinck6 in #283
• feat: Add an optional label field on Order to hold additional identifiers by @jingyli in #326
• feat: get product operation for catalog.lookup by @igrigorik in #195
• feat!: Embedded protocol transport binding for cart capability + reauth mechanism in ECP by @jingyli in #244
• feat(order): Get Order operation w/ platform-auth by @richmolj in #276
• feat!: align embedded protocol errors with UCP error conventions by @westeezy in #325
• feat!: identity linking OAuth 2.0 foundation with capability-driven scopes by @amithanda in #354
• feat: attribution field for platform referral context by @igrigorik in #391

📝 Documentation Updates

• docs: Remove google mention for line item id description by @ptiper in #119
• docs: fix broken image path in core-concepts.md by @dltkdgkr123 in #87
• docs: update CONTRIBUTING.md to reference super_linter_local.py script by @drewolson-google in #138
• docs: Adding endorsed partners Block, Fiserv, Klarna, and Splitit to the documentation by @MitkoDeyanovMitev in #149
• docs(mcp): fix MCP examples & errors by @igrigorik in #141
• docs: Adding endorsed partner Affirm to the documentation by @dwdii in #166
• docs: Modernize diagrams by @gaureshpai in #99
• docs: rename Technical Committee to Tech Council (TC) by @ptiper in #168
• docs: Allow JSON and ucp-schema CLI not found errors to propagate up the call stack by @dwdii in #174
• docs: use fulfillment instead of shipping in order totals example by @muzaffersenkal in #76
• docs: Add endorsed partner Checkout.com to the documentation by @dwdii in #194
• docs: Update Contribution Guide link in README.md to .github repo. by @amithanda in #204
• docs: update broken links to CONTRIBUTING.md by @nearlyforget in #209
• docs: fix broken links and add dynamic versioning by @wry-ry in #226
• docs: update architecture diagrams and convert mobile version to JPG by @amithanda in #266
• docs: Update create checkout and update checkout request samples by @aksbro-gpu in #293
• docs: clarify the expectation for non-date protocol version by @alexpark20 in #324
• docs: fix outdated services+capability examples in docs by @igrigorik in #335
• docs: extract shared EP core, group transports in nav by @igrigorik in #339
• docs: omit deprecated checkout id from playground payload by @gaureshpai in #332
• docs: adds descriptions to links in llms-txt by @nicholasjameshall in #419
• docs: Fix typos and improve formatting in versioning by @pemamian in #416
• docs: enrich core-concepts with comprehensive UCP protocol overview by @amithanda in #336
• docs: add centralized glossary and acronym standards by @gsmith85 in #241
• docs: add extensibility and forward compatibility guidelines by @gsmith85 in #290
• docs: Modernize diagram in signatures.md by @gaureshpai in #331
• docs: Correct profile examples in docs Playground widget by @dkoch74 in #236
• docs: remove entity wrapper from MCP response examples by @jamesandersen in #360
• docs: fix accuracy issues in documentation pages by @pjordan in #365
• docs: fix inconsistencies in specification examples by @pjordan in #363
• docs: Update signature requirements in documentation (format only) by @TioBorracho in #242
• docs: update line item ids to differentiate from item ids by @thompson-tomo in #112

🛠 Other Changes

• fix: Remove page level HTML tags from playground.md by @wry-ry in #124
• fix: update broken URLs in demo and documentation to use correct ucp.dev paths by @kiliczsh in #67
• chore: manage dependencies with uv by @drewolson-google in #126
• chore: respect .gitignore for biome linting by @drewolson-google in #130
• fix(schema): publish UCP annotated schemas by @igrigorik in #125
• chore: add script to run super linter locally by @drewolson-google in #132
• fix: Add UCP-Agent header to the openapi.json. by @semenovm in #120
• refactor: rename and version service transport definitions by @lemonmade in #154
• chore: Update Shopify TC rep: Lee Richmond > Aaron Glazer by @igrigorik in #165
• fix: update all broken schema references in documentation by @wry-ry in #160
• chore: remove unused quicktype dependency by @wry-ry in #197
• chore: add CODEOWNERS file by @nearlyforget in #167...

Release v2026-01-23

What's Changed

• refactor!: updates for 2026-01-23 release by @wry-ry in #115
• fix: Regenerate package-lock with public registry urls by @kcthota in #108

New Contributors

• @kcthota made their first contribution in #108

Full Changelog: v2026-01-11...v2026-01-23

Release v2026-01-11

What's Changed

• docs: fix broken Google Pay Handler link in payment handler guide by @yanheChen in #4
• chore: add config for ruff by @wry-ry in #33
• chore: add *.code-workspace to .gitignore and .gitignore to cspell ignored files by @wry-ry in #36
• chore: increase verbosity of super-linter by @wry-ry in #42
• chore: allow super-linter to post status checks to PRs by @wry-ry in #43
• chore: more logging and config for linter by @wry-ry in #44
• chore: fix ruff format command args by @wry-ry in #45
• docs: Add salesforce logo to advisory partners folder by @aksbro-gpu in #46
• fix: updated hosted json refs to correct filenames with absolute paths by @wry-ry in #30
• style: Remove conflicting python lint rules and format with ruff by @drewolson-google in #52
• fix: update ECP card instrument example objects by @lemonmade in #26
• style: Fix ruff lint checks by @drewolson-google in #53
• docs: update Etsy logo to current version by @wry-ry in #57
• chore: correctly set up cspell to use config by @wry-ry in #59
• docs: add enhancement-proposal.md and update CONTRIBUTING.md by @wry-ry in #61
• docs: Refactor GOVERNANCE.md by @amithanda in #65
• chore: add mkdocs "mike" plugin config to version documentation by @wry-ry in #106
• docs: define capability maturity levels by @igrigorik in #86
• docs: add versioning page by @wry-ry in #110
• fix: update git tag to start with v by @wry-ry in #114
• chore: update mike to use a branch instead of release by @wry-ry in #111

New Contributors

• @yanheChen made their first contribution in #4
• @aksbro-gpu made their first contribution in #46
• @amithanda made their first contribution in #65

Full Changelog: https://github.com/Universal-Commerce-Protocol/ucp/commits/v2026-01-11