Skip to content

docs: release notes for v0.25.0 #217

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
leifj merged 2 commits into from
Oct 15, 2026
Merged

docs: release notes for v0.25.0 #217

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0bbf4e2
docs: add release notes for v0.25.0
siros-release-notes-bot[bot] Oct 15, 2026
201d322
docs: correct v0.25.0 release notes
leifj Oct 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions RELEASE_NOTES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,30 @@
`release-notes:<tag>` markers; edit the prose inside a fence freely —
regeneration only ever rewrites the fence it was asked to rewrite. -->

<!-- release-notes:v0.25.0:start -->
## [v0.25.0] - 2026-10-15

### Added
- AuthZEN evaluation responses can now include verified relying party identifiers in `context.verifier_ids`, controlled by the new per-policy `constraints.return_verifier_ids` setting. Wallets answering `circuit_zk` requests get a verified identifier string without parsing certificates or resolving DIDs themselves. Off by default; clients can hint a preferred type via `context.verifier_id_type`; unknown type names are rejected at startup. (#204, #203)
- Types follow the OpenID4VP `client_id` scheme names, `semantic` being the only exception: `semantic`, `x509_san_dns`, `x509_san_uri`, `decentralized_identifier`, `openid_federation`.
- Everything is fail closed: nothing is emitted for a deny decision, a failed profile validation, or an identifier that was not verified.
- `semantic` comes from the access certificate only, and only for a certificate classified as natural or legal person by its WRPAC policy OIDs; an unclassified certificate yields none, since its `organizationIdentifier` could be a natural person's affiliation.
- `x509_san_dns` is the dNSName SAN as an A-label (internationalised names work when the `client_id` carries the A-label), ASCII lower case, no trailing dot. A U-label `client_id` is not converted and yields no entry. Empty labels, over-long names, whitespace, wildcards, and a `client_id` bound only through a wildcard SAN yield no entry. Shared test vectors are in `pkg/registry/testdata/x509_san_dns_verifier_id_vectors.json`.

### Fixed
- **BREAKING**: LoTE registry JWS signature verification now works. Previously `registries.lote.verify_jws: true` was silently ignored; now it requires the new `registries.lote.trust_anchor_bundle` (PEM file of CA certificates) or the service refuses to start. Verification applies to the LoTL itself and all resolved sources. Configs that set `verify_jws` without anchors will fail validation. (#211)
- DID policies now enforce `did.required_verification_methods`. This constraint was parsed but never checked; DIDs missing any listed verification method type are now denied. Deployments with this setting already configured may see denials after upgrading. (#209)
- Docker image now listens on `0.0.0.0:6001` by default (was `127.0.0.1:6001`), exposes port 6001, and its healthcheck correctly follows `GT_PORT` and uses GET instead of HEAD. (#206)
- WRPAC profile no longer warns when access certificates lack `keyUsage` `contentCommitment`/`nonRepudiation`; that bit is for non-repudiable content commitment, not entity authentication. Certificates with only `digitalSignature` now validate cleanly. (#210)
- Natural-person WRPAC certificates (NCP-n, QCP-n) are now correctly classified as `natural_person` and their semantic identifier is read from `serialNumber` only, not `organizationIdentifier`. (#204)

### Changed
- **Security:** minimum Go version is now 1.27.2 (was 1.27.0/1.27.1), clearing stdlib vulnerabilities GO-2026-6611/6612/6613/6617 in `net/http`. (#214)
- x509_san_dns client_id binding (`DNSSANMatches`, also used by the ETSI trust evaluation) now compares ASCII case-insensitively, as DNS names are, so a `client_id` differing from the SAN only in case now binds. It no longer matches an empty label against a wildcard SAN (`.example.com` against `*.example.com`). A non-ASCII `client_id` still never matches; present internationalised names as A-labels. (#204)
- Dependency updates: golang.org/x/net v0.60.0 (clears GO-2026-6610/6611/6612/6617), github.com/SUNET/vc v0.7.23, github.com/fxamacker/cbor/v2 v2.9.6, github.com/go-oidfed/lib v0.12.0 and github.com/prometheus/client_golang v1.25.0. (#212, #199, #215)
- GitHub Actions: ossf/scorecard-action updated to v2.5.0. (#216)
<!-- release-notes:v0.25.0:end -->

<!-- release-notes:v0.24.1:start -->
## [v0.24.1] - 2026-10-06

Expand Down
Loading