Skip to content

docs: release notes for v0.20.0 #322

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
siros-release-notes-bot wants to merge 2 commits into
base: main
Choose a base branch
from
Open

docs: release notes for v0.20.0 #322

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
aa005cd
docs: add release notes for v0.20.0
siros-release-notes-bot[bot] Sep 10, 2026
4995e89
Say what dpop_key_id is for on renewal
leifj Sep 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions RELEASE_NOTES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,21 @@
`release-notes:<tag>` markers; edit the prose inside a fence freely —
regeneration only ever rewrites the fence it was asked to rewrite. -->

<!-- release-notes:v0.20.0:start -->
## [v0.20.0] - 2026-09-10

### Added
- **Client-held DPoP keys**: New `sign_client_auth` action allows clients to hold their own DPoP private keys instead of the engine generating them. For each authenticated request, the engine now requests fresh signatures (DPoP proofs and wallet attestation PoPs) from the client with request-specific parameters. This ensures `cnf == DPoP key` because clients use one key for both, and eliminates replay of stale attestations. (#318)
- **Automatic mode detection**: The engine probes clients at the first authenticated request and adapts per-flow—client-held mode if the client answers `sign_client_auth`, legacy mode (engine-generated keys) if the client doesn't respond or times out. Pre-resolved attestations or renewals with `dpop_jwk` skip the probe and use legacy mode. (#318)

### Changed
- **Renewal flow**: in client-held mode `flow_complete` returns `dpop_key_id` instead of the private `dpop_jwk`, and a renewal `flow_start` sends `dpop_key_id` back so the engine asks the client to sign with the key the refresh token is bound to. `dpop_jwk` keeps working for tokens issued by older backends. (#318)
- **Notification endpoint**: DPoP-bound notifications now work in both client-held and legacy modes after flow completion by abstracting the signing mechanism. (#318)

### Fixed
- **Documentation**: The WebSocket protocol spec now documents `sign_client_auth`, `request_attestation`, and renewal fields that were previously undocumented. (#318)
<!-- release-notes:v0.20.0:end -->

<!-- release-notes:v0.19.0:start -->
## [v0.19.0] - 2026-09-07

Expand Down
Loading