v0.20.5

fix(workflows): update helm and deployment workflow references for co…

v0.22.0

Changelog

[0.22.0] - 2026-07-08 (UTC)

Compare: v0.21.0...v0.22.0

Highlights

• Shipped the first broad mobile wallet SDK and demo-app release train with Android/iOS wallet SDK modules, hardware-backed persistence, native and Compose demo apps, client attestation, mobile EUDI/enterprise test utilities, and CI coverage (WAL-1033, WAL-748, WAL-447).
• Added mobile cryptography foundations by replacing platform crypto with the shared Signum/Supreme path and enabling Ed25519 and secp256k1 support across iOS and Android (WAL-447).
• Expanded OpenID4VCI and issuer2 behavior with refresh-token support, authorization details in token requests, PAR flow work, well-known JWT VC issuer coverage, custom session fixes, and safer base64 utilities (WAL-853, WAL-985, WAL-1091).
• Improved verifier and policy handling with policy exceptions, stronger DID document key resolution tests, TSE error messaging, request/conformance updates, and status-list verification fixes (WAL-975).
• Hardened credential status and token status lists with support for additional TSL states and spec-aligned protected-header placement for x5c/x5chain CWT status-list material (WAL-1119).
• Modernized deployment, docs, and CI with consolidated Helm/api-service charts, portal2 wiring, mobile SDK KDoc, OpenAPI schema generation fixes, EBSI TLS test migration, and readme rendering fixes (WAL-1071, WAL-1101, WAL-1108, WAL-1110).

Detailed updates

Mobile wallet SDK, demo apps, and crypto

• Added the KMP mobile wallet SDK, mobile/server persistence split, shared wallet server adapter, Android and iOS native demo apps, and platform test utilities for issuance and presentation flows (WAL-1033) (#1748, #1766).
• Added a Compose Multiplatform wallet demo with shared UI/state, Android and iOS targets, EUDI/local enterprise fixtures, and expanded CI diagnostics (WAL-748) (#1800).
• Reworked mobile crypto onto shared Signum/Supreme plumbing, added mobile software keys, fixed iOS JWK/public-key handling, and enabled Ed25519 and secp256k1 support for mobile wallets (WAL-447) (#1761, #1768).
• Closed iOS implementation gaps for DID JSON canonicalization, async policy verification, and COSE_Sign1 CWT proof verification (WAL-1033) (#1823).
• Added wallet SDK KDoc and mobile docs CI checks so generated documentation remains part of the release workflow (WAL-1071, WAL-1065) (#1836).

OpenID4VCI, issuer2, and wallet runtime

• Added refresh-token support and tests for issuer2 flows, including persistent refresh-token handling in the coordinated enterprise release (#1806).
• Added authorization_details support to the token request builder for richer OAuth/OIDC token requests (#1803).
• Advanced pushed authorization request work for issuer2 (WAL-853) (#1774).
• Added issuer2 JWT VC metadata well-known path coverage for the 0.22 release line (WAL-985) (#1868).
• Refactored OpenID4VCI base64 handling to use shared crypto utilities (WAL-1091) (#1867).
• Fixed wallet-api/wallet-api2 routing and local SQLite directory creation issues that affected runtime deployments (#1809, #1814, #1851).

Verifier, policies, and credential status

• Added policy exceptions for verifier policy handling (WAL-975) (#1863).
• Updated conformance and wallet flows, coordinated with the enterprise conformance work (#1746).
• Improved DID document key resolution when multiple keys are present and added regression coverage (#1857).
• Updated TSE support and error messaging for clearer verifier/runtime failures (#1855).
• Accepted additional token status list states and fixed x5c/x5chain protected-header handling for CWT status lists (WAL-1119) (#1848, #1854).
• Fixed broken trust-list examples and issuer2 test profile assumptions to keep examples and regression fixtures aligned (#1801, #1847).

Deployment, docs, and CI

• Consolidated Helm charts around the api-service/portal setup, added verifier2 and wallet-api2 deployment artifacts, and pulled service Kubernetes configuration into the release workflows (WAL-1101, WAL-1108, WAL-1110) (#1822, #1837).
• Added TLS configuration for OPA ingress and wallet-api OpenAPI path routing (#1788, #1814).
• Refactored Gradle build steps, workflow references, and issuer2 CI wiring for the release branch (#1802, #1812).
• Fixed OpenAPI schema generation for serialized names containing / and JSON element examples (#1824).
• Moved EBSI tests to the Java HTTP client to satisfy TLS 1.3 requirements (#1805).
• Temporarily skipped, then re-enabled, EUDI mobile integration tests around the expired backend certificate window (#1856, #1865).
• Fixed protocol-library README rendering (#1872).

Merged pull requests

PR	Title	Author	Reviewer	Merged
#1766	WAL-1033: Improve mobile tests setup	szijpeter		2026-06-15
#1788	chore: add TLS configuration for opa ingress	dinkar-jain	JakeFernandes98	2026-06-17
#1801	Fixed broken Trust-list examples	philpotisk	hokorn	2026-06-17
#1802	Refactor Gradle build steps and update workflow references	dinkar-jain	JakeFernandes98	2026-06-18
#1803	Add authorization details to TokenRequestBuilder	SuperBatata	hokorn, JakeFernandes98	2026-06-19
#1774	Feature/wal 853 par	philpotisk	JakeFernandes98	2026-06-19
#1805	move ebsi tests to java client due to tls 1.3 requirements	JakeFernandes98	chsavvaidis	2026-06-19
#1746	Conformance + Wallet	waltkb	JakeFernandes98	2026-06-22
#1809	fix duplicate wallet-api in route	JakeFernandes98	dinkar-jain	2026-06-23
#1812	Ci/issuer2	dinkar-jain	JakeFernandes98	2026-06-23
#1814	add api.json path to ingress configuration for wallet-api	JakeFernandes98	dinkar-jain	2026-06-24
#1806	Feat/refresh tokens	chsavvaidis	JakeFernandes98	2026-06-25
#1824	Fix Open API schema generation	hokorn	coderabbitai[bot], JakeFernandes98	2026-06-30
#1823	[WAL-1033] Close some more iOS implementation gaps	szijpeter	JakeFernandes98	2026-06-30
#1748	[WAL-1033] Add Mobile Wallet SDK and iOS & Android native demo apps with hardware-backed persistence	szijpeter	SuperBatata, JakeFernandes98	2026-06-30
#1800	[WAL-748] feat(wallet-demo): add Compose Multiplatform wallet demo app	szijpeter	JakeFernandes98	2026-07-01
#1822	feat: Added portal2	dinkar-jain	JakeFernandes98	2026-07-01
#1847	switch friom University Degree to Openbadge for tests	JakeFernandes98	chsavvaidis, dinkar-jain	2026-07-02
#1761	[WAL-447] feat: replace platform crypto with signum/Supreme (iOS + Android)	szijpeter	waltkb, JakeFernandes98	2026-07-02
#1768	[WAL-447] feat: Ed25519 + secp256k1 support on iOS/Android	szijpeter	waltkb, JakeFernandes98	2026-07-02
#1837	Enhance service configuration and add new Helm charts	dinkar-jain	JakeFernandes98	2026-07-02
#1851	Add directory creation for SQLite database in Wallet2Database	dinkar-jain	JakeFernandes98	2026-07-02
#1836	[WAL-1071] docs(mobile): add KDoc for wallet SDK	szijpeter	coderabbitai[bot], JakeFernandes98	2026-07-03
#1844	Feature/wal 1107	philpotisk	JakeFernandes98	2026-07-03
#1848	accept other states in TSL	JakeFernandes98	philpotisk	2026-07-06
#1856	Skip EUDI integration tests due to expired backend certificate	szijpeter	JakeFernandes98	2026-07-06
#1865	Re-enable EUDI mobile integration tests	szijpeter	JakeFernandes98	2026-07-07
#1855	Updates TSE support and improves general error messaging	JakeFernandes98	SuperBatata	2026-07-07
#1857	fix logic for resolving multiple keys from did doc and add test	JakeFernandes98	philpotisk	2026-07-07
#1867	refactor: use crypto base64 utils in openid4vci	chsavvaidis	JakeFernandes98, szijpeter	2026-07-07
#1854	Fix x5c header location for CWT TSL	philpotisk	JakeFernandes98	2026-07-07
#1868	test: cover oss issuer2 jwt vc...

v0.21.3

accept other states in TSL

v0.21.2

Fixes issues regarding wallet-api authentication routes

#1810
#1808

v0.21.1

fix duplicate wallet-api in route

v0.21.0

Compare: v0.20.4...main

Highlights

• Shipped OSS Issuer2 - a complete OpenID4VCI issuer service with config-backend credential profiles, authorization code flow support, external authorization server integration, notification events (webhooks/SSE), dev mode, and Docker service deployment (WAL-1048) (#1744).
• Added OpenID4VP 1.0 holder support with draft compatibility, including request_uri POST metadata/nonce validation, unified VP format capabilities, and hardened request object handling (WAL-741) (#1694).
• Implemented transaction_data support across wallet, verifier2, and shared libraries per OpenID4VP spec, with config-driven type profiles, mdoc namespace handling, and comprehensive validation (WAL-741) (#1695).
• Added X.509 Certificate Signing Request (CSR) support in the x509 library for certificate generation workflows (#1753).
• Added x5c support for W3C Credentials, enabling X.509 certificate chain embedding in credential signatures (#1742).
• Upgraded to Ktor 3.4.3 and Gradle 9 with conformance test improvements, vulnerability fixes, and enhanced error handling (#1716).

Detailed updates

OSS Issuer2 Service

• Added complete issuer2 service with OpenID4VCI support (#1744).
• Implemented config-backend credential profiles with typed profile decoding (#1744).
• Added authorization code flow with external authorization server support (#1744).
• Added notification events with webhook and SSE support (#1744).
• Added dev mode for simplified development workflows (#1744).
• Added Docker service deployment configuration (#1744).
• Added support for partial runtime merge data (#1744).
• Added credential offer examples and OpenAPI documentation (#1744).
• Added status passthrough support in OSS issuer2 (#1777).

OpenID4VP / Wallet

• Added OpenID4VP 1.0 holder support with draft compatibility (#1694).
• Unified VP format capabilities across wallet flows (#1694).
• Added request_uri POST metadata/nonce validation (#1694).
• Hardened OID4VP request object handling and cleaned tests (#1694).
• Refactored OpenID4VP request resolution transport wiring (#1694).
• Fixed holder-bound key usage for OpenID4VP (#1694).
• Preserved legacy signed request fallback for backward compatibility (#1694).

Transaction Data Support

• Added transaction_data support across wallet, verifier2, and shared libraries (#1695).
• Implemented config-driven transaction data type profiles (#1695).
• Added per-type mdoc namespace handling for interoperability (#1695).
• Added mdoc transaction data round-trip integration tests (#1695).
• Enforced transaction_data VP policies regardless of custom vp_policies list (#1695).
• Added invalid_transaction_data error code per OID4VP spec (#1695).
• Added transaction data UI improvements in portal (#1695).

X.509 / Crypto

• Added Certificate Signing Request (CSR) support in x509 library (#1753).
• Added x5c support for W3C Credentials (#1742).

Metadata Resolution

• Simplified metadata URL construction and resolution logic in IssuerMetadataResolver (WAL-1048) (#1759).
• Added path-aware metadata URL resolution for OpenID4VCI wallet (#1759).
• Improved error body logging in IssuerMetadataResolver (#1759).

Conformance / Testing

• Upgraded conformance tests with Ktor 3.4.3 migration (#1716).
• Added KB IAT check policy for SD-JWT (#1716).
• Updated certificates and trust anchors for conformance tests (#1716).
• Improved presentation verification error messages (#1716).
• Fixed vulnerable transient dependency of Azure library (#1716).

Infrastructure / Deployment

• Refactored kubeconfig and updated deployment configurations (#1775).
• Updated ingress class from nginx to Traefik across services (#1782).
• Updated storageClass references for cloud deployments (#1782).
• Removed initContainers from wallet-api deployment (#1784).
• Fixed Docker Compose setup (#1769).

Fixes

• Fixed typo in codebase (#1780).
• Fixed stale import (#1785).
• Fixed WebDataFetcher JVM hang by moving to companion object.
• Fixed database transaction context for KeysService.list() calls.
• Fixed SD-JWT verification with issuer key set.
• Fixed status list debug logging (thousands of 0s).

Merged pull requests

PR	Title	Author	Reviewer	Merged
#1694	feat(wallet-api): add OpenID4VP 1.0 holder support with draft compatibility	szijpeter	JakeFernandes98, waltkb	2026-06-15
#1695	feat(openid4vp): add transaction_data support across wallet, verifier2, and shared libraries	szijpeter	waltkb	2026-06-15
#1716	conformance test upgrade	philpotisk	JakeFernandes98	2026-06-12
#1742	Add support for x5c to W3C Credentials	JakeFernandes98	SuperBatata	2026-06-11
#1744	Oss issuer2	chsavvaidis	JakeFernandes98	2026-06-15
#1753	add support for CSR in x509 lib	JakeFernandes98	philpotisk	2026-06-11
#1759	refactor(metadata): simplify metadata URL construction and resolution	SuperBatata	chsavvaidis	2026-06-12
#1769	fix docker compose setup	JakeFernandes98	dinkar-jain	2026-06-08
#1775	Refactor kubeconfig and update deployment, storageClass, and ingress	dinkar-jain	JakeFernandes98	2026-06-11
#1777	add support for status passthrough in oss issuer2	JakeFernandes98	chsavvaidis	2026-06-16
#1780	fix: typo	chsavvaidis	JakeFernandes98	2026-06-15
#1782	Update ingress class to Traefik and adjust storageClass references	dinkar-jain	JakeFernandes98	2026-06-16
#1784	chore: remove initContainers from wallet-api deployment configurations	dinkar-jain	SuperBatata	2026-06-16
#1785	fix stale import	JakeFernandes98	hokorn	2026-06-16

v0.20.4

• Added authorization_details support for OpenID4VCI flows, including credential_identifiers, custom attributes in sessions, token response options, and issuance ID attributes (WAL-992) (#1721).
• Added verifier_info wiring to the verifier service request body, exposing the library-level implementation at the service layer (#1767).
• Improved CI/CD configuration with updated Gradle workflow references, Playwright config updates, and log level adjustments.

v0.20.3

• Fixed SQLite schema creation to use supported methods, resolving wallet-api database initialization issues (#1757).
• Fixed AWS public key fetching errors in the context of the authnz library integration (#1756).
• Improved EBSI DID resolution to fail gracefully when EBSI returns 404, preventing test failures from external system unavailability (#1754).
• Updated README documentation across libraries with missing libraries, status updates, and organizational improvements (#1751).

v0.20.2

Crypto / KMS

• Added AWS multi-region key support for cross-region key management operations (#1730).

Credentials / OpenID4VCI

• Introduced initial mdoc support in credential handlers (WAL-891) (#1740).
• Isolated SD-JWT VC credential handler for better modularity (#1740).
• Isolated W3C credential handler for cleaner separation (#1740).
• Introduced credential error data class for improved error handling (#1740).
• Updated credential format and proof type handling (#1740).
• Fixed credential display issues (#1740).
• Removed legacy lib dependency (#1740).

Observability

• Suppressed verbose logging for bitstring status operations (WAL-1016) (#1737).

v0.20.1

Changelog

[0.20.1] - 2026-05-19 (UTC)

Compare: v0.20.0...main

Highlights

• Implemented OID4VP 1.0 Section 8.5 wallet error response handling in Verifier2, enabling proper error redirect flows when wallets reject presentation requests or encounter errors (WAL-965) (#1707).
• Added structured failure detail surfacing on Verifier2 sessions with credential policy attribution, DCQL fulfillment results, and ordered unsatisfied sets for better debugging (WAL-976, WAL-977) (#1706).
• Fixed mdoc TDate format by removing fractional seconds from the implementation to align with ISO 18013-5 requirements (WAL-993) (#1722).
• Refactored Issuer and OpenID4VCI to enforce type parameters for JWT signing, improving type safety and fixing the typ header in the JWT signing process (WAL-894) (#1723).
• Added AWS KMS Key Cleanup workflow for automated purging of untagged keys, improving cloud resource management (#1713).
• Reverted SameSite cookie attribute to Strict and aligned test naming for session token handling (WAL-1010) (#1728).

Detailed updates

Verifier2 / OID4VP

• Implemented OID4VP 1.0 Section 8.5 wallet error response handling on direct_post endpoint (#1707).
• Added support for wallet rejection responses with proper error redirect flows (#1707).
• Hardened wallet error response handling across verifier2 and wallet modules (#1707).
• Surfaced structured failure detail on verification sessions with credential policy attribution (#1706).
• Added explicit DCQL fulfillment result returns for better verification diagnostics (#1706).
• Preserved ordered unsatisfied sets in verification results (#1706).

Credentials / Issuance

• Refactored Issuer and OpenID4VCI to enforce type parameter for JWT, improving type safety (#1723).
• Fixed typ header in JWT signing process (#1723).
• Extended CredentialParser to support nested W3C contexts and types (#1723).
• Added preAuthorizedGrantAnonymousAccessSupported in the default issuer metadata (#1723).

mdoc / ISO

• Removed fractional seconds from mdoc TDate implementation to align with ISO 18013-5 specification (WAL-993) (#1722).

Auth / Sessions

• Reverted SameSite cookie attribute to Strict for improved security (WAL-1010) (#1728).
• Aligned test naming for session token handling (#1728).

Build / CI

• Added AWS KMS Key Cleanup workflow for automated purging of untagged keys (#1713).
• Fixed creation date parsing from ISO-8601 string format in KMS cleanup workflow (#1715).
• Combined dependency bumps including mina-core and package lock updates (#1717).

Merged pull requests

PR	Title	Author	Reviewer	Merged
#1706	feature/wal-976-977-verifier2-structured-failures	szijpeter		2026-05-14
#1707	feature/wal-965-oid4vp-wallet-error-response	szijpeter		2026-05-14
#1713	feat: Add AWS KMS Key Cleanup workflow	dinkar-jain		2026-05-12
#1715	fix: Update creation date parsing in KMS cleanup workflow	dinkar-jain	philpotisk	2026-05-12
#1717	chore/dependency-bumps-combined	philpotisk		2026-05-15
#1722	WAL-993: Remove fractional seconds from mdoc implementation	JakeFernandes98		2026-05-16
#1723	wal-894: Refactor Issuer and OpenID4VCI for JWT type safety	chsavvaidis		2026-05-14
#1728	fix/wal-1010: Revert SameSite to Strict	JakeFernandes98		2026-05-19

This changelog covers v0.20.0 through main (intended v0.20.1).

What's Changed

• feature/wal-976-977-verifier2-structured-failures by @szijpeter in #1706
• feature/wal-965-oid4vp-wallet-error-response by @szijpeter in #1707
• feat: Add AWS KMS Key Cleanup workflow by @dinkar-jain in #1713
• fix: Update creation date parsing in KMS cleanup workflow by @dinkar-jain in #1715
• chore/dependency-bumps-combined by @philpotisk in #1717
• WAL-993: Remove fractional seconds from mdoc implementation by @JakeFernandes98 in #1722
• wal-894: Refactor Issuer and OpenID4VCI for JWT type safety by @chsavvaidis in #1723
• fix/wal-1010: Revert SameSite to Strict by @JakeFernandes98 in #1728

Full Changelog: v0.20.0...main