2.2.0

What's Changed

• Fix Private Key Exposure in JWKS by @manpace in #528
• v2.2.0 by @peppelinux in #529

• feat(openid4vci): bind access and refresh tokens to DPoP key (RFC 9449)
• feat(openid4vci): reject PAR jti replay (RFC 9126)
• feat(openid4vci): verify key_attestation (WUA) in credential proof when present
• doc(openid4vci): document OpenID Federation integration for trust evaluation
• feat(openid4vp): validate mdoc SessionTranscript for OpenID4VP profile (ISO 18013-7)
• feat: openid4vci add proof jwt specific checks

• Introduced the proof_jwt_required flag in integration_test/conf/openid4vci_frontend.yaml to control proof JWT requirements at the credential endpoint.
• Removed the scopes field from backend configuration in test files, aligning with updated claim handling logic. [1] [2]
• Removed redundant or misplaced security configuration sections from backend test configs.

Full Changelog: 2.1.0...2.2.0

2.1.0

What's Changed

• chore: purged pending presentation_definition and general performance and security in pytest with mongo by @peppelinux in #523
• ci: radon, pip-audit, flake conf and further improvements by @peppelinux in #525
• fix: openid4vp, wallet_attestation validation by @saralongobardiacn in #516
• 2.1.0 by @peppelinux in #524

Full Changelog: 2.0.1...2.1.0

2.0.1

What's Changed

• Fix/519 autodoc warnings for failed imports by @manpace in #521

dependencies updated

New Contributors

• @manpace made their first contribution in #521

Full Changelog: 2.0.0...2.0.1

2.0.0-2

fix: pydantic version in setup.-py for gh-pages CD

2.0.0-1

fix: pypi CD alpine version

2.0.0

What's Changed

• direct_post.jwt could be not necessarly encrypted by @PascalDR in #446
• x509_san_uri removal by @PascalDR in #448
• chore: small improvements in x509 example chain build, unit test by @peppelinux in #447
• Add request post method by @PascalDR in #450
• breaking change: custom client_ids and {rp, leaf}_certificate_chains_by_ca by @PascalDR in #449
• Wallet capabilities evaluation: signature algs by @PascalDR in #454
• OpenID4VCI Satosa Frontend by @saralongobardiacn in #444
• Update trust documentation by @saralongobardiacn in #462
• Fix/openid4vi - openid4vci docs properties by @saralongobardiacn in #464
• Reachable .well-know paths by @PascalDR in #466
• Refactor integration test by @saralongobardiacn in #459
• Wallet Metadata Parameters Evaluation #455 by @saralongobardiacn in #465
• Credential issuer metadata endpoint by @PascalDR in #467
• Oauth authorization server metatadata endpoint by @PascalDR in #468
• [dev] Execution of integration test: dependencies missing by @saralongobardiacn in #470
• Optional wallet attestation by @PascalDR in #476
• feat: openid4vci dpop requirement configuration by @saralongobardiacn in #475
• rev: MongoDB schema and collection naming review by @saralongobardiacn in #479
• feat: openid4vci dpop_signing_alg_values_supported configuration by @saralongobardiacn in #481
• pymdoccbor generalization allowing fixes by @peppelinux in #480
• Optional signed request by @PascalDR in #484
• [Interoperability] Oauth2 par request by @PascalDR in #485
• fix: integration_test by @saralongobardiacn in #483
• Implementation of wallet header proofs by @PascalDR in #488
• fix: RemoteFlowType.CROSS_DEVICE is always detected by @saralongobardiacn in #490
• [WWWallet] Fix authorization endpoint for enable request uri handling and SATOSA backend callback by @PascalDR in #487
• fix: duckle refactor, fix boolean mismatch for is_active_presentation_definition method and move duckle utils in own package by @saralongobardiacn in #492
• X509 chain regression fixes by @peppelinux in #458
• fix: naive vs aware datetime comparison warning by @peppelinux in #493
• move to pydantic v3.0 (pydantic>=2.11.9) and py3.12 - 3.15 support by @saralongobardiacn in #496
• X509 chain fix3 by @peppelinux in #499
• Implemented jwt vc issuer metadata endpoint handler by @PascalDR in #500
• Revert "Implemented jwt vc issuer metadata endpoint handler" by @peppelinux in #502
• fix: cryptography datetime alignments and X509 chain subtree constraints by @peppelinux in #504
• fix: improved checks in decoding JWT by @mciofo in #507
• CD Docs generation by @PascalDR in #505
• Register as and client metadata for algorithm negotiation of attestations and pops in openid4vp by @saralongobardiacn in #508
• fix: handling routing SATOSA backend for authorization endpoint by @saralongobardiacn in #512
• 2.0.0 by @peppelinux in #456

New Contributors

• @mciofo made their first contribution in #507

Full Changelog: 1.1.0...2.0.0

1.1.0

What's Changed

• Implementation of CRLHelper and certificate revocation check by @PascalDR in #442

Full Changelog: 1.0.0...1.1.0

1.0.0-1

fix pypi CD

Full Changelog: 1.0.0...1.0.0-1

1.0.0

What's Changed

• feat: tolerance window in token lifetime validation by @Zicchio in #359
• Huge cleanups and optimizations by @peppelinux in #352
• Restore Response Tests by @PascalDR in #367
• Fix Trust params handling by @PascalDR in #366
• Custom trust handler docs by @PascalDR in #369
• Better trust materials handling by @PascalDR in #371
• Non conformant url requests by @PascalDR in #374
• Authorization Error Response Flow by @PascalDR in #376
• Better error handling jwt by @PascalDR in #379
• Better error handling by @PascalDR in #377
• feat: parsing ec key from x5c claim by @Zicchio in #375
• Removed error HTML template by @PascalDR in #380
• Fix attestation model by @PascalDR in #381
• feat: direct_post input normalization by @Zicchio in #384
• Added client metadata in authorization request and prevent private key leakage by @PascalDR in #386
• Public Key Test DirectTrustJar by @PascalDR in #385
• X509 trust handler by @PascalDR in #387
• Presentation submission parser implementation and mdoc support by @PascalDR in #391
• freeze: code for 1.0 by @peppelinux in #394
• chore: remove of duplicated vp parser map in satosa example backend config by @peppelinux in #402
• X5C chain RP relation by @PascalDR in #401
• Presentation submission regex fix by @saralongobardiacn in #404
• fix: missing iss in request and removal of useless pydantic warning about deprecated params by @peppelinux in #409
• Fix for integration tests by @PascalDR in #410
• Check that the first key is properly configured by @PascalDR in #406
• Added docs for x509 by @PascalDR in #417
• fix: handling of presentation sub in direct post by @Zicchio in #420
• fix: acceptance of submission path by @Zicchio in #421
• Issue resolution by @PascalDR in #427
• trust header (including x5c) rework by @Zicchio in #428
• Status list implementation by @PascalDR in #403
• Update x509 Trust Docs by @Zicchio in #431
• Removed oldies directory by @PascalDR in #429
• Fix broken unit test by @Zicchio in #433
• Invalid x5c store and status list fix by @PascalDR in #436
• Implement Duckle Support for Credential Queries by @saralongobardiacn in #424
• feat: authorization error response by @Zicchio in #411
• feat: refactor of jwt key selection for x5c by @Zicchio in #437

New Contributors

• @saralongobardiacn made their first contribution in #404

Full Changelog: 0.9.1...1.0.0

0.9.1

What's Changed

• fix: rm un-necessary test check by @Zicchio in #287
• fix: minor bug by @Zicchio in #288
• feat: docs by @Zicchio in #291
• chore: update request object typ by @Zicchio in #293
• feat: revision of direct trust cache by @Zicchio in #292
• feat: expanded integration test by @Zicchio in #294
• fix: qr code value by @Zicchio in #304
• Feature/#281 remove dependency with sd jwt python by @LadyCodesItBetter in #297
• Pr 306 by @LadyCodesItBetter in #308
• Pas merge by @LadyCodesItBetter in #315
• issuer validation handling in JWSHelper and split JWSHelper into se… by @LadyCodesItBetter in #319
• feat: review of remote flow detection by @Zicchio in #300
• Feature/sd jwt issuer verify iat exp by @LadyCodesItBetter in #321
• docs: Add table for environment variables in README.SATOSA.md by @LadyCodesItBetter in #323
• Expand Request Object configurability by @Zicchio in #325
• feat: publish trust metadata endpoint by @Zicchio in #328
• feat: support for direct_post (unencrypted) responses by @Zicchio in #330
• Feature/#307 d po p proof jwt should not have kid within its jwt header paramenters by @LadyCodesItBetter in #329
• fix: minor fixes by @elisanp in #338
• fix: updated class reference by @elisanp in #337
• fix: bug key name in endpoint by @Zicchio in #336
• fix: solved minor bugs by @Zicchio in #347
• Customizability of client id in jar request object by @elisanp in #332
• fix: dependencies and config alignments by @peppelinux in #344
• pydantic.ValidationError exception refinements by @peppelinux in #350
• Feature/254 pyeudiw backend keys configuration by @LadyCodesItBetter in #324

New Contributors

• @LadyCodesItBetter made their first contribution in #297

Full Changelog: 0.9.0...0.9.1