chore(deps): bump the patch-updates group across 1 directory with 49 updates

[dependabot]

Bumps the patch-updates group with 49 updates in the / directory:

Package	From	To
@changesets/cli	3.0.2	3.0.3
@biomejs/biome	2.5.12	2.5.14
@credo-ts/anoncreds	0.7.0	0.7.1
@credo-ts/askar	0.7.0	0.7.1
@credo-ts/core	0.7.0	0.7.1
@credo-ts/didcomm	0.7.0	0.7.1
@credo-ts/indy-vdr	0.7.0	0.7.1
@credo-ts/openid4vc	0.7.0	0.7.1
@credo-ts/question-answer	0.7.0	0.7.1
@credo-ts/react-native	0.7.0	0.7.1
@biomejs/cli-darwin-arm64	2.5.12	2.5.14
@biomejs/cli-darwin-x64	2.5.12	2.5.14
@biomejs/cli-linux-arm64-musl	2.5.12	2.5.14
@biomejs/cli-linux-arm64	2.5.12	2.5.14
@biomejs/cli-linux-x64-musl	2.5.12	2.5.14
@biomejs/cli-linux-x64	2.5.12	2.5.14
@biomejs/cli-win32-arm64	2.5.12	2.5.14
@biomejs/cli-win32-x64	2.5.12	2.5.14
@changesets/apply-release-plan	8.1.0	8.1.1
@changesets/config	4.0.0	4.0.1
@clack/core	1.5.0	1.5.1
@clack/prompts	1.8.0	1.8.1
@noble/curves	2.0.1	2.4.0
@openid4vc/oauth2	0.4.6	0.5.6
@openid4vc/openid4vci	0.4.6	0.5.6
@openid4vc/openid4vp	0.4.6	0.5.6
@openid4vc/utils	0.4.6	0.5.6
@peculiar/asn1-cms	2.6.0	2.9.4
@peculiar/asn1-csr	2.6.0	2.9.4
@peculiar/asn1-ecc	2.6.0	2.9.4
@peculiar/asn1-pfx	2.6.0	2.9.4
@peculiar/asn1-pkcs8	2.6.0	2.9.4
@peculiar/asn1-pkcs9	2.6.0	2.9.4
@peculiar/asn1-rsa	2.6.0	2.9.4
@peculiar/asn1-schema	2.7.0	2.9.4
@peculiar/asn1-x509-attr	2.6.0	2.9.4
@peculiar/asn1-x509	2.7.0	2.9.4
@peculiar/x509	1.14.3	2.1.0
@sd-jwt/core	0.19.0	0.21.0
@sd-jwt/sd-jwt-vc	0.19.0	0.21.0
asn1js	3.0.6	3.0.10
compression	1.8.1	1.8.2
ec-compression	0.0.1-alpha.12	2.0.0
is-core-module	2.16.2	2.17.0
joi	17.13.7	17.13.8
nanoid	3.3.18	3.3.19
pako	2.1.0	3.0.2
pvutils	1.1.3	1.2.0
type-is	2.0.1	2.1.0

Updates @changesets/cli from 3.0.2 to 3.0.3

Release notes

Sourced from @​changesets/cli's releases.

@​changesets/cli@​3.0.3

Patch Changes

• #2297 3f163da Thanks @​Andarist! - Fixed semver ranges (such as >=1.0.0 <2.0.0) getting cut off (>=2.0.0) when updating internal dependencies.

• #2276 ca9d110 Thanks @​Andarist! - Fixed pnpm 10 compatibility with npm 12 when reading registry information, packing, and publishing packages.

• Updated dependencies [3f163da, bfe9050, e522996]:

  • @​changesets/apply-release-plan@​8.1.1
  • @​changesets/config@​4.0.1

Changelog

Sourced from @​changesets/cli's changelog.

3.0.3

Patch Changes

• #2297 3f163da Thanks @​Andarist! - Fixed semver ranges (such as >=1.0.0 <2.0.0) getting cut off (>=2.0.0) when updating internal dependencies.

• #2276 ca9d110 Thanks @​Andarist! - Fixed pnpm 10 compatibility with npm 12 when reading registry information, packing, and publishing packages.

• Updated dependencies [3f163da, bfe9050, e522996]:

  • @​changesets/apply-release-plan@​8.1.1
  • @​changesets/config@​4.0.1

Commits

• c9269c0 Version Packages (#2291)
• ca9d110 Fix pnpm 10 publishing with npm 12 (#2276)
• 7be7fde Build(deps): Bump the production-dependencies group across 1 directory with 6...
• b430ce0 Move e2e tests to an on-demand workspace (#2275)
• 93314a8 test: add happy path tests for add (#2289)
• d13a39e test: use inline snapshots for publish plan tests (#2284)
• See full diff in compare view

Updates @biomejs/biome from 2.5.12 to 2.5.14

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.14

2.5.14

Patch Changes

• #9022 0d49e24 Thanks @​dyc3! - Added the nursery rule noReturnInFinally. This rule disallows return statements in Promise.prototype.finally() callbacks, including inside nested blocks and conditional branches. Returns in nested functions are ignored by the rule.

  // Invalid: return in finally callback
  Promise.resolve(1).finally(() => { return 2 })
  // Valid: no return in finally callback
  Promise.resolve(1).finally(() => { console.log(2) })

  Returning a value from a Promise.prototype.finally() callback does not replace the original promise's fulfillment value, which can be confusing. Returned promises and thenables are awaited, and their rejection rejects the resulting promise.

• #11754 71eaa0d Thanks @​griff-rees! - Added the nursery rule noSvelteAtDebugTags, which disallows Svelte's {@debug} tag.

  <!-- Invalid: leftover debugging tag -->
  {@debug user}

  The {@debug} tag is a debugging aid and should be removed once you no longer need it, as it should not remain in production code. The rule provides a safe fix that removes the tag.

• #11725 5eb5f09 Thanks @​m1handr! - Added the nursery rule useValidTestTitle, which enforces valid titles for unit test cases and suites.

• #11735 9bd70c7 Thanks @​ematipico! - Fixed #8471: source.fixAll.biome ignored formatter.formatWithErrors. It now applies safe fixes without formatting files that have parse errors when the option is disabled.

• #11715 f05a3c3 Thanks @​ematipico! - Fixed #7771: Grit plugins that use sequential no longer panic when Biome processes files.

• #11766 c2542c6 Thanks @​dyc3! - Fixed validation of readonly and accessor modifiers: combining them in either order now reports that they cannot be used together.

• #11461 22e9966 Thanks @​FoundDream! - Fixed #11423: Multiline template interpolations now preserve the indentation of their closing brace when the source indentation is not a multiple of tabWidth.

   const value = `
        ${
          condition
            ? "yes"
            : "no"
  -}
  +     }
   `;

• #11766 c2542c6 Thanks @​dyc3! - Fixed #11763: TypeScript class members using override accessor, such as override accessor value = 1, now parse correctly. The reversed order, accessor override, now reports that override must precede accessor.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.14

Patch Changes

• #9022 0d49e24 Thanks @​dyc3! - Added the nursery rule noReturnInFinally. This rule disallows return statements in Promise.prototype.finally() callbacks, including inside nested blocks and conditional branches. Returns in nested functions are ignored by the rule.

  // Invalid: return in finally callback
  Promise.resolve(1).finally(() => { return 2 })
  // Valid: no return in finally callback
  Promise.resolve(1).finally(() => { console.log(2) })

  Returning a value from a Promise.prototype.finally() callback does not replace the original promise's fulfillment value, which can be confusing. Returned promises and thenables are awaited, and their rejection rejects the resulting promise.

• #11754 71eaa0d Thanks @​griff-rees! - Added the nursery rule noSvelteAtDebugTags, which disallows Svelte's {@debug} tag.

  <!-- Invalid: leftover debugging tag -->
  {@debug user}

  The {@debug} tag is a debugging aid and should be removed once you no longer need it, as it should not remain in production code. The rule provides a safe fix that removes the tag.

• #11725 5eb5f09 Thanks @​m1handr! - Added the nursery rule useValidTestTitle, which enforces valid titles for unit test cases and suites.

• #11735 9bd70c7 Thanks @​ematipico! - Fixed #8471: source.fixAll.biome ignored formatter.formatWithErrors. It now applies safe fixes without formatting files that have parse errors when the option is disabled.

• #11715 f05a3c3 Thanks @​ematipico! - Fixed #7771: Grit plugins that use sequential no longer panic when Biome processes files.

• #11766 c2542c6 Thanks @​dyc3! - Fixed validation of readonly and accessor modifiers: combining them in either order now reports that they cannot be used together.

• #11461 22e9966 Thanks @​FoundDream! - Fixed #11423: Multiline template interpolations now preserve the indentation of their closing brace when the source indentation is not a multiple of tabWidth.

   const value = `
        ${
          condition
            ? "yes"
            : "no"
  -}
  +     }
   `;

• #11766 c2542c6 Thanks @​dyc3! - Fixed #11763: TypeScript class members using override accessor, such as override accessor value = 1, now parse correctly. The reversed order, accessor override, now reports that override must precede accessor.

• #11790 17d0ff0 Thanks @​ematipico! - Fixed #10248: noUselessFragments now allows fragments with props in Astro files, such as <Fragment slot="name">{text}</Fragment> inside template expressions.

... (truncated)

Commits

• af4365d ci: release (#11711)
• 7ee3a6c fix(useExhaustiveSwitchCases): add option requireExplicitCase (#11777)
• 02ea438 feat(json_analyze): implement noJsonUnsafeValues (#9758)
• 64fd314 feat(json_analyze): implement useConsistentObjectKeys (#9797)
• a9c4aa0 feat(html): detect undeclared custom Vue directives (#11651)
• 1fc17e3 feat: expand useIncludes (#11739)
• 71eaa0d feat(lint/html/svelte): add noSvelteAtDebugTags (#11754)
• 9bd70c7 fix: various bug fixes (#11735)
• c7c4e2b fix(analyzer): various bugs (#11720)
• 5eb5f09 feat(biome_js_analyze): implement useValidTestTitle rule (#9176) (#11725)
• Additional commits viewable in compare view

Updates @credo-ts/anoncreds from 0.7.0 to 0.7.1

Changelog

Sourced from @​credo-ts/anoncreds's changelog.

0.7.1

Patch Changes

• 9f4278b: Add DidDocument.findVerificationMethodsByPurpose and DidDocument.findVerificationMethodsByTypeAndPurpose.

  The relationship-aware methods resolve inline and referenced methods and return them in requested relationship order while preserving entry order within each relationship. The type-filtered method accepts one or more verification-method representations and delegates relationship traversal to the purpose-only method. DIDComm JSON-LD, JWT credentials, presentation selection, DIDComm messaging, AnonCreds data integrity, Cheqd signing, peer DID conversion, and did:webvh signing now use the appropriate shared lookup. AnonCreds credential signing prefers verification methods authorized for assertionMethod, with declared verificationMethod entries as a fallback.

• b75467c: Move the W3C Data Integrity credential attachment format (Aries RFC 0809) out of @credo-ts/anoncreds and into @credo-ts/didcomm, where the rest of the format already lived. The format is not anoncreds specific: binding a credential to an anoncreds link secret is one of its binding methods, next to the didcomm signed attachment method and to not binding the credential at all. Issuing a plain W3C credential over this format no longer requires depending on @credo-ts/anoncreds.

  • Added DidCommDataIntegrityCredentialFormatService to @credo-ts/didcomm. DataIntegrityDidCommCredentialFormatService in @credo-ts/anoncreds is now a deprecated alias for it and will be removed in the next major version.
  • Added the DidCommDataIntegrityLinkSecretBindingProvider interface and its injection token, implementing the anoncreds_link_secret binding method. @credo-ts/anoncreds provides AnonCredsLinkSecretBindingProvider and the AnonCredsModule registers it, so agents using anoncreds keep the binding method with no changes. Using the binding method without the AnonCredsModule registered now fails with an explanatory error rather than an unresolved dependency.
  • Fixed deleteCredentialById deleting every credential of this format through the anoncreds holder service. Credentials that were not bound to a link secret are now removed as the plain W3cCredentialRecord or W3cV2CredentialRecord they are stored as.

• fd5016d: feat: the Cache interface get, set and remove methods now accept a CacheOptions parameter with a scope that is either 'context' (default) or 'global', allowing globally reusable data to be shared across agent contexts. The X.509 CRL summary cache, the Indy VDR pool lookup cache and the AnonCreds registry cache use the global scope, as they only hold publicly anchored data. The DID resolver caches documents of public did methods in the global scope, and documents of other did methods per agent context; the list of public did methods can be configured with the new publicDidMethods option of the dids module (default ['web', 'indy', 'sov', 'cheqd', 'hedera', 'webvh']).

  Behavior changes to be aware of:

  • InMemoryLruCache now namespaces keys by contextCorrelationId by default. This fixes potential cross-context sharing of context-scoped entries (e.g. records cached by CachedStorageService) in multi-tenant setups. Single-context agents are not affected.
  • RedisCache stores global-scope entries under a global: key prefix. Existing context-scoped Redis entries for the caches that moved to the global scope become cache misses after upgrading and expire through their TTL, causing a one-time refetch.

• 907cc54: refactor(vc): rename anoncreds Data Integrity bridge APIs to W3C credential namespace. Replaces Data Integrity-specific symbols and types (IAnonCredsDataIntegrityService, AnonCredsDataIntegrityServiceSymbol, ANONCREDS_DATA_INTEGRITY_CRYPTOSUITE, DataIntegrityProof, dataIntegrityCryptosuites) with W3C credential equivalents. Generic JSON-LD verification now rejects anoncreds-2023 proofs and requires anoncreds W3C credential path. Introduces shouldSignWithAnonCredsW3cService() and shouldVerifyWithAnonCredsW3cService() to clarify service responsibilities.

• cfe86fa: X509 trusted certificates now can be provided in a new format. Previously it was a list of base64/pem/der encoded certificates, but now you can also provide a list of objects in the format [{issuance: string[], status? :string[]}]. This is used for the new status indicator on mdoc. First, it looks for the used issuance trusted certificates and then validates the status, if available, with the status trusted certificates associated with the issuance property.

• b75467c: Support issuing Verifiable Credentials Data Model 2.0 credentials over the W3C Data Integrity credential attachment format (Aries RFC 0809). The format previously advertised data_model_versions_supported: ['1.1'] and rejected a data model 2.0 credential, even though the agent was already able to secure one with a DataIntegrityProof.

  The data model version is negotiated on the wire as the RFC describes: the offer advertises the version of the credential it carries, and the holder echoes its choice as data_model_version on the request. Which cryptosuite secures the credential is not negotiated, as RFC 0809 leaves that choice to the issuer.

  • The base JSON-LD context of the offered credential now determines the advertised data_model_versions_supported, so offering a credential in the https://www.w3.org/ns/credentials/v2 context works without further configuration. Offers for data model 1.1 credentials are unaffected.
  • Added the cryptosuite data integrity credential format option, naming the Data Integrity cryptosuite used to secure a data model 2.0 credential, for example eddsa-jcs-2022. When omitted, the first registered cryptosuite supporting the key type of the issuer verification method is used. It is ignored for data model 1.1, which is secured with a linked data signature suite instead. The anoncreds-2023 cryptosuite is rejected, as it is only produced through the anoncreds link secret binding method.
  • W3cDataIntegrityApi.getSupportedCryptosuites accepts an optional public JWK type, returning only the cryptosuites that support that key type.
  • A received data model 2.0 credential is verified and stored as a W3cV2CredentialRecord. Deleting a credential of this format looks the record up in both the data model 1.1 and 2.0 stores, so the record type on the credential exchange record stays 'w3c' for both versions.
  • The anoncreds link secret binding method is rejected for data model 2.0 credentials, both when creating an offer and when issuing, as that binding method is defined for data model 1.1 and the anoncredsvc-2023 cryptosuite only.
  • Fixed the comparison of the offered and the received credential subject, which rejected any claim with a falsy value: a credential carrying a claim such as 0, false or '' was refused by the holder as not matching the offer. Claims are now compared by presence.

• cfe86fa: TokenStatusList is a new standard module on the agent. It allows you to create/update/fetch token status lists. It is up to the user to host this, this can be easily done with the statusList you receive from the agent.tokenStatusList.createTokenStatusList(...) function. Updating the statuslist allows you to change the status list credential state from valid to invalid, but also update the expiry time, rotate certificates, change signing algorithm, etc. Signatures are the default and mac should only be used if the user is aware of the security implications and has good reason to do so.

• Updated dependencies [9f4278b]

• Updated dependencies [f127ff5]

• Updated dependencies [5cfcadb]

• Updated dependencies [84dfcf4]

• Updated dependencies [b75467c]

• Updated dependencies [e80900a]

• Updated dependencies [8ded8d2]

• Updated dependencies [fd5016d]

• Updated dependencies [d45aec0]

• Updated dependencies [5cfcadb]

... (truncated)

Commits

• fc21fb6 chore(release): new version (#2772)
• fae21ee Merge branch 'main' into feat/signature-suite-registration
• b75467c feat(didcomm): support VCDM 2.0 credentials over RFC0809 (#2898)
• a412444 Merge branch 'main' into feat/signature-suite-registration
• 9f4278b feat(DidDocument): keyType and Purpose-aware Verification Method helpers (#2934)
• 78094a9 don't register signature suite in w3cv2 module
• 7073e76 Merge branch 'main' into feat/signature-suite-registration
• 339f4cc feat(json-ld): abstract json-ld document loader into a module (#2921)
• 3c380a7 Merge branch 'main' into feat/signature-suite-registration
• 907cc54 refactor(vc): anoncreds data integrity namespace change (#2813)
• Additional commits viewable in compare view

Updates @credo-ts/askar from 0.7.0 to 0.7.1

Changelog

Sourced from @​credo-ts/askar's changelog.

0.7.1

Patch Changes

• 8b8690a: Add connectionParameters to the Askar postgres database config. The parameters are added to the postgres connection url and passed to the underlying driver, allowing e.g. ssl options (sslmode, sslrootcert, etc.) to be configured without setting environment variables. See https://docs.rs/sqlx/latest/sqlx/postgres/struct.PgConnectOptions.html#parameters for supported parameters.

• bc4638e: Add support for the ISO/IEC TS 18013-7:2025 Annex C (org-iso-mdoc) Digital Credentials API.

  • KMS: HPKE (RFC 9180) key agreement algorithms HPKE-0, HPKE-3 and HPKE-7, following the naming of draft-ietf-jose-hpke-encrypt. These are integrated-encryption algorithms, so encryption/decryption must be omitted and encrypt returns an encapsulatedKey. Implemented in the askar backend (the recipient private key stays inside askar; only the Diffie-Hellman output leaves it) and in the node backend.
  • Mdoc module: createDcApiVerificationSession / verifyDcApiResponse for verifiers and resolveDcApiRequest / createDcApiResponse for wallets, backed by a new MdocVerificationSessionRecord.
  • verifyDcApiResponse matches the response against the device request of the session and throws a MdocDeviceRequestNotSatisfiedError when a doc request is not satisfied. By default every requested element must be disclosed and issuer signed; in the docRequests passed to createDcApiVerificationSession, pass { intentToRetain, optional, source } instead of the intentToRetain boolean to mark an element as optional or as device signed. The match is returned as deviceRequestMatch, with per doc request the valid and failed documents, and per document the result of the docType and claims checks.
  • resolveDcApiRequest matches the stored mdocs with the same rules and returns the same structure (through Holder.matchDeviceRequest of @owf/mdoc): per doc request the validCredentials and failedCredentials, each with its record and the docType and claims checks, so a wallet can show an mdoc of the requested doctype together with the requested claims it is missing. An age_over_NN request is answered with the age attestation the mdoc has (18013-5 7.2.5). A requested element that is not issuer signed, but that the device key is authorized for in the MSO, is matched as device signed when its value is passed in deviceNameSpaces to resolveDcApiRequest: pass the same value in the deviceNameSpaces of the credential to createDcApiResponse. A credential can also pass elements to disclose only some of the requested elements.
  • Reader authentication on an incoming request is resolved through the same trust layers as credential verification: the certificates passed to resolveDcApiRequest, then the global getTrustedIssuersForVerification callback (with the new mdocReaderAuth verification type, called per doc request), then the deprecated getTrustedCertificatesForVerification callback, then the statically configured trusted certificates. Resolving a reader authenticated request throws when none of these are configured. Return the leaf certificate from the callback to trust a reader on the certificate it presented itself.

• bc4638e: Only pick a response encryption key from client_metadata.jwks that the key management backends of the agent can actually perform the ECDH-ES key agreement with. Previously the first recognized enc key was used, which failed later on if e.g. a verifier included a P-521 key and the configured KMS backend (such as Askar) does not support that curve. The Askar and Node key management backends now also take the curve of the external public key into account in isOperationSupported.

• cfe86fa: X509 trusted certificates now can be provided in a new format. Previously it was a list of base64/pem/der encoded certificates, but now you can also provide a list of objects in the format [{issuance: string[], status? :string[]}]. This is used for the new status indicator on mdoc. First, it looks for the used issuance trusted certificates and then validates the status, if available, with the status trusted certificates associated with the issuance property.

• cfe86fa: TokenStatusList is a new standard module on the agent. It allows you to create/update/fetch token status lists. It is up to the user to host this, this can be easily done with the statusList you receive from the agent.tokenStatusList.createTokenStatusList(...) function. Updating the statuslist allows you to change the status list credential state from valid to invalid, but also update the expiry time, rotate certificates, change signing algorithm, etc. Signatures are the default and mac should only be used if the user is aware of the security implications and has good reason to do so.

• Updated dependencies [9f4278b]

• Updated dependencies [f127ff5]

• Updated dependencies [5cfcadb]

• Updated dependencies [84dfcf4]

• Updated dependencies [e80900a]

• Updated dependencies [8ded8d2]

• Updated dependencies [fd5016d]

• Updated dependencies [d45aec0]

• Updated dependencies [5cfcadb]

• Updated dependencies [097c831]

• Updated dependencies [20d6ab1]

• Updated dependencies [bc4638e]

• Updated dependencies [bc4638e]

• Updated dependencies [bc4638e]

• Updated dependencies [907f12f]

• Updated dependencies [bc4638e]

• Updated dependencies [96dc69b]

• Updated dependencies [7dfafeb]

• Updated dependencies [3a3eb03]

• Updated dependencies [23c354e]

• Updated dependencies [907cc54]

• Updated dependencies [339f4cc]

• Updated dependencies [bc4638e]

• Updated dependencies [5cfcadb]

• Updated dependencies [f127ff5]

• Updated dependencies [cfe86fa]

• Updated dependencies [e97c18b]

• Updated dependencies [121dd14]

• Updated dependencies [b75467c]

• Updated dependencies [cfe86fa]

• Updated dependencies [0a58888]

• Updated dependencies [1e2088f]

  • @​credo-ts/core@​0.7.1

Commits

• fc21fb6 chore(release): new version (#2772)
• bc4638e feat: add support for iso 18013-7 dc api (#2922)
• 8b8690a feat: allow setting postgres connection params in askar (#2931)
• 0bc66a4 fix(askar): only auto-provision at initialization (#2667)
• f127ff5 feat: mdoc revocation for issuance and verification (#2803)
• See full diff in compare view

Updates @credo-ts/core from 0.7.0 to 0.7.1

Changelog

Sourced from @​credo-ts/core's changelog.

0.7.1

Patch Changes

• 9f4278b: Add DidDocument.findVerificationMethodsByPurpose and DidDocument.findVerificationMethodsByTypeAndPurpose.

  The relationship-aware methods resolve inline and referenced methods and return them in requested relationship order while preserving entry order within each relationship. The type-filtered method accepts one or more verification-method representations and delegates relationship traversal to the purpose-only method. DIDComm JSON-LD, JWT credentials, presentation selection, DIDComm messaging, AnonCreds data integrity, Cheqd signing, peer DID conversion, and did:webvh signing now use the appropriate shared lookup. AnonCreds credential signing prefers verification methods authorized for assertionMethod, with declared verificationMethod entries as a fallback.

• f127ff5: Mdoc revocation for issuance and verification

• 5cfcadb: Fail COSE Sign1 and Mac0 signing, and Mac0 verification, when no algorithm is declared instead of falling back to the first supported signature algorithm of the key. The Mac0 authenticate operation now also uses the algorithm provided by the caller. COSE Sign1 verification still falls back to the signature algorithm of the key, as @​owf/mdoc does not forward the alg of the deviceAuth Sign1 structure yet.

• 84dfcf4: sd-jwt vc does not require IAT to be required anymore

• e80900a: Fix selective disclosure of SD-JWT array elements when presenting with DCQL. Array elements that are selectively disclosable on their own were not disclosed, even when requested. They are now disclosed by their position in the array.

  DCQL claim sets of SD-JWT VC and W3C V2 SD-JWT VC credentials now include disclosed_paths: the paths to the claims the presentation discloses, including the claims that are not selectively disclosable. An array element has the position it has in the claims of the credential, where decoy digests don't count. A path stands for the claim and everything below it, so a claim that is disclosed as a whole has a single path. Pass them as the new disclosedPaths in DcqlCredentialsForRequest (done automatically by selectCredentialsForRequest).

  Disclosing an SD-JWT VC or W3C V2 SD-JWT VC based on disclosedPayload is deprecated, as it selects arrays as a whole. disclosedPaths will be required for these formats in the next breaking version.

  For the same reason, applyDisclosuresForPayload on SdJwtVcService and W3cV2SdJwtCredentialService is deprecated in favor of the new applyDisclosuresForPaths.

  IDisclosureFrame now also allows array positions in _sd, and the ClaimPath type is exported.

• 8ded8d2: Fix Ed25519Signature2018 incorrectly accepting Ed25519VerificationKey2020 verification methods (previously converted at runtime from multibase to base58), and register Ed25519Signature2020 with its own required Ed25519VerificationKey2020 verification method type instead of sharing acceptance with Ed25519Signature2018. Each suite now strictly enforces its own verification method type, with error messages identifying both the offending key type and the proof type.

  W3cJsonLdCredentialService#signCredential and #signPresentation now share a single suite-preparation path that resolves and validates the verification method against the suite's required key type before signing, replacing duplicated per-method logic.

  Also fixes missing @type: multibase typing for publicKeyMultibase/proofValue and missing capabilityInvocation, capabilityDelegation, and keyAgreement term definitions in the ed25519-2020 JSON-LD context, which caused JSON-LD framing/expansion failures when dynamically signing and verifying credentials and presentations with Ed25519Signature2020 DIDs.

• fd5016d: feat: the Cache interface get, set and remove methods now accept a CacheOptions parameter with a scope that is either 'context' (default) or 'global', allowing globally reusable data to be shared across agent contexts. The X.509 CRL summary cache, the Indy VDR pool lookup cache and the AnonCreds registry cache use the global scope, as they only hold publicly anchored data. The DID resolver caches documents of public did methods in the global scope, and documents of other did methods per agent context; the list of public did methods can be configured with the new publicDidMethods option of the dids module (default ['web', 'indy', 'sov', 'cheqd', 'hedera', 'webvh']).

  Behavior changes to be aware of:

  • InMemoryLruCache now namespaces keys by contextCorrelationId by default. This fixes potential cross-context sharing of context-scoped entries (e.g. records cached by CachedStorageService) in multi-tenant setups. Single-context agents are not affected.
  • RedisCache stores global-scope entries under a global: key prefix. Existing context-scoped Redis entries for the caches that moved to the global scope become cache misses after upgrading and expire through their TTL, causing a one-time refetch.

• d45aec0: fix(kms): respect the configured defaultBackend when no explicit backend is provided for a key management operation. Previously the first registered backend that supported the operation was always used and the defaultBackend option was silently ignored, which could result in keys being created in a different (e.g. software instead of hardware-backed) backend than configured. If the default backend does not support the requested operation, the first other backend that supports the operation is used and a warning is logged.

• 5cfcadb: Use the alg from the JWS header when verifying linked data proofs, and bind signing to the algorithm declared in the JWS header, instead of using the first supported signature algorithm of the key. Also fixes the JWS header validation for linked data proofs, which could previously be bypassed by adding an extra header parameter.

• 097c831: fix(vc): bind the holder to the credentialSubject when verifying JSON-LD (ldp_vp) presentations

  W3cJsonLdCredentialService.verifyPresentation verified the presentation proof and each embedded credential's issuer proof, but never checked that the presentation signer (holder) controls the credentialSubject.id of the embedded credentials. The underlying @digitalcredentials/vc / jsonld-signatures libraries do not perform this check either. As a result an ldp_vp could be used to present someone else's credential (a data object, not a secret) wrapped in a presentation signed with the attacker's own key. This check is already enforced for jwt_vp and SD-JWT presentations; the JSON-LD path now enforces it too, surfacing the result per credential under

... (truncated)

Commits

• fc21fb6 chore(release): new version (#2772)
• e80900a feat: support array paths and several dcql fixes (#2945)
• bc4638e feat: add support for iso 18013-7 dc api (#2922)
• 8ded8d2 fix(vc): signature suite separation (#2943)
• fae21ee Merge branch 'main' into feat/signature-suite-registration
• b75467c feat(didcomm): support VCDM 2.0 credentials over RFC0809 (#2898)
• a412444 Merge branch 'main' into feat/signature-suite-registration
• 9f4278b feat(DidDocument): keyType and Purpose-aware Verification Method helpers (#2934)
• 78094a9 don't register signature suite in w3cv2 module
• 7073e76 Merge branch 'main' into feat/signature-suite-registration
• Additional commits viewable in compare view

Updates @credo-ts/didcomm from 0.7.0 to 0.7.1

Changelog

Sourced from @​credo-ts/didcomm's changelog.

0.7.1

Patch Changes

• 9f4278b: Add DidDocument.findVerificationMethodsByPurpose and DidDocument.findVerificationMethodsByTypeAndPurpose.

  The relationship-aware methods resolve inline and referenced methods and return them in requested relationship order while preserving entry order within each relationship. The type-filtered method accepts one or more verification-method representations and delegates relationship traversal to the purpose-only method. DIDComm JSON-LD, JWT credentials, presentation selection, DIDComm messaging, AnonCreds data integrity, Cheqd signing, peer DID conversion, and did:webvh signing now use the appropriate shared lookup. AnonCreds credential signing prefers verification methods authorized for assertionMethod, with declared verificationMethod entries as a fallback.

• b75467c: Move the W3C Data Integrity credential attachment format (Aries RFC 0809) out of @credo-ts/anoncreds and into @credo-ts/didcomm, where the rest of the format already lived. The format is not anoncreds specific: binding a credential to an anoncreds link secret is one of its binding methods, next to the didcomm signed attachment method and to not binding the credential at all. Issuing a plain W3C credential over this format no longer requires depending on @credo-ts/anoncreds.

  • Added DidCommDataIntegrityCredentialFormatService to @credo-ts/didcomm. DataIntegrityDidCommCredentialFormatService in @credo-ts/anoncreds is now a deprecated alias for it and will be removed in the next major version.
  • Added the DidCommDataIntegrityLinkSecretBindingProvider interface and its injection token, implementing the anoncreds_link_secret binding method. @credo-ts/anoncreds provides AnonCredsLinkSecretBindingProvider and the AnonCredsModule registers it, so agents using anoncreds keep the binding method with no changes. Using the binding method without the AnonCredsModule registered now fails with an explanatory error rather than an unresolved dependency.
  • Fixed deleteCredentialById deleting every credential of this format through the anoncreds holder service. Credentials that were not bound to a link secret are now removed as the plain W3cCredentialRecord or W3cV2CredentialRecord they are stored as.

• cfe86fa: X509 trusted certificates now can be provided in a new format. Previously it was a list of base64/pem/der encoded certificates, but now you can also provide a list of objects in the format [{issuance: string[], status? :string[]}]. This is used for the new status indicator on mdoc. First, it looks for the used issuance trusted certificates and then validates the status, if available, with the status trusted certificates associated with the issuance property.

• b75467c: Support issuing Verifiable Credentials Data Model 2.0 credentials over the W3C Data Integrity credential attachment format (Aries RFC 0809). The format previously advertised data_model_versions_supported: ['1.1'] and rejected a data model 2.0 credential, even though the agent was already able to secure one with a DataIntegrityProof.

  The data model version is negotiated on the wire as the RFC describes: the offer advertises the version of the credential it carries, and the holder echoes its choice as data_model_version on the request. Which cryptosuite secures the credential is not negotiated, as RFC 0809 leaves that choice to the issuer.

  • The base JSON-LD context of the offered credential now determines the advertised data_model_versions_supported, so offering a credential in the https://www.w3.org/ns/credentials/v2 context works without further configuration. Offers for data model 1.1 credentials are unaffected.
  • Added the cryptosuite data integrity credential format option, naming the Data Integrity cryptosuite used to secure a data model 2.0 credential, for example eddsa-jcs-2022. When omitted, the first registered cryptosuite supporting the key type of the issuer verification method is used. It is ignored for data model 1.1, which is secured with a linked data signature suite instead. The anoncreds-2023 cryptosuite is rejected, as it is only produced through the anoncreds link secret binding method.
  • W3cDataIntegrityApi.getSupportedCryptosuites accepts an optional public JWK type, returning only the cryptosuites that support that key type.
  • A received data model 2.0 credential is verified and stored as a W3cV2CredentialRecord. Deleting a credential of this format looks the record up in both the data model 1.1 and 2.0 stores, so the record type on the credential exchange record stays 'w3c' for both versions.
  • The anoncreds link secret binding method is rejected for data model 2.0 credentials, both when creating an offer and when issuing, as that binding method is defined for data model 1.1 and the anoncredsvc-2023 cryptosuite only.
  • Fixed the comparison of the offered and the received credential subject, which rejected any claim with a falsy value: a credential carrying a claim such as 0, false or '' was refused by the holder as not matching the offer. Claims are now compared by presence.

• cfe86fa: TokenStatusList is a new standard module on the agent. It allows you to create/update/fetch token status lists. It is up to the user to host this, this can be easily done with the statusList you receive from the agent.tokenStatusList.createTokenStatusList(...) function. Updating the statuslist allows you to change the status list credential state from valid to invalid, but also update the expiry time, rotate certificates, change signing algorithm, etc. Signatures are the default and mac should only be used if the user is aware of the security implications and has good reason to do so.

• Updated dependencies [9f4278b]

• Updated dependencies [f127ff5]

• Updated dependencies [5cfcadb]

• Updated dependencies [84dfcf4]

• Updated dependencies [e80900a]

• Updated dependencies [8ded8d2]

• Updated dependencies [fd5016d]

• Updated dependencies [d45aec0]

• Updated dependencies [5cfcadb]

• Updated dependencies [097c831]

• Updated dependencies [20d6ab1]

• Updated dependencies [bc4638e]

• Updated dependencies [bc4638e]

• Updated dependencies [bc4638e]

• Updated dependencies [907f12f]

• Updated dependencies [bc4638e]

• Updated dependencies [96dc69b]

... (truncated)

Commits

• fc21fb6 chore(release): new version (

[dependabot]

Labels

The following labels could not be found: pnpm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1a8361f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR