[dependabot]

Bumps the patch-updates group with 73 updates in the / directory:

Package	From	To
@changesets/cli	3.0.2	3.0.3
uuid	14.0.2	14.0.3
@biomejs/biome	2.5.12	2.5.15
@credo-ts/anoncreds	0.7.0	0.7.2
@credo-ts/askar	0.7.0	0.7.2
@credo-ts/core	0.7.0	0.7.2
@credo-ts/didcomm	0.7.0	0.7.2
@credo-ts/indy-vdr	0.7.0	0.7.2
@credo-ts/openid4vc	0.7.0	0.7.2
@credo-ts/question-answer	0.7.0	0.7.2
@credo-ts/react-native	0.7.0	0.7.2
@hyperledger/anoncreds-react-native	0.4.0	0.4.1
@openwallet-foundation/askar-react-native	0.6.0	0.6.1
@babel/helper-create-regexp-features-plugin	7.29.7	7.29.10
@babel/plugin-transform-typescript	7.29.7	7.29.9
@biomejs/cli-darwin-arm64	2.5.12	2.5.15
@biomejs/cli-darwin-x64	2.5.12	2.5.15
@biomejs/cli-linux-arm64-musl	2.5.12	2.5.15
@biomejs/cli-linux-arm64	2.5.12	2.5.15
@biomejs/cli-linux-x64-musl	2.5.12	2.5.15
@biomejs/cli-linux-x64	2.5.12	2.5.15
@biomejs/cli-win32-arm64	2.5.12	2.5.15
@biomejs/cli-win32-x64	2.5.12	2.5.15
@changesets/apply-release-plan	8.1.0	8.1.1
@changesets/config	4.0.0	4.0.1
@clack/core	1.5.0	1.5.1
@clack/prompts	1.8.0	1.8.1
@expo/devcert	1.2.1	1.2.2
@expo/osascript	2.7.1	2.8.1
@expo/package-manager	1.13.1	1.14.2
@expo/xcpretty	4.4.5	4.4.7
@hyperledger/anoncreds-shared	0.4.0	0.4.1
@noble/curves	2.0.1	2.4.0
@nodable/entities	3.0.0	3.1.0
@openid4vc/oauth2	0.4.6	0.6.0
@openid4vc/openid4vci	0.4.6	0.6.0
@openid4vc/openid4vp	0.4.6	0.6.0
@openid4vc/utils	0.4.6	0.6.0
@openwallet-foundation/askar-shared	0.6.0	0.6.1
@peculiar/asn1-cms	2.6.0	2.11.0
@peculiar/asn1-csr	2.6.0	2.11.0
@peculiar/asn1-ecc	2.6.0	2.11.0
@peculiar/asn1-pfx	2.6.0	2.11.0
@peculiar/asn1-pkcs8	2.6.0	2.11.0
@peculiar/asn1-pkcs9	2.6.0	2.11.0
@peculiar/asn1-rsa	2.6.0	2.11.0
@peculiar/asn1-schema	2.7.0	2.11.0
@peculiar/asn1-x509-attr	2.6.0	2.11.0
@peculiar/asn1-x509	2.7.0	2.11.0
@peculiar/x509	1.14.3	2.2.0
@sd-jwt/core	0.19.0	0.21.1
@sd-jwt/sd-jwt-vc	0.19.0	0.21.1
asn1js	3.0.6	3.0.10
compression	1.8.1	1.8.2
dcql	3.0.0	3.0.1
ec-compression	0.0.1-alpha.12	2.0.0
human-id	4.2.1	4.2.2
is-core-module	2.16.2	2.17.0
joi	17.13.7	17.13.8
launch-editor	2.14.1	2.14.2
nanoid	3.3.18	3.3.20
package-manager-detector	1.8.0	1.9.0
pako	2.1.0	3.0.2
pvutils	1.1.3	1.2.0
regenerate-unicode-properties	10.2.2	10.3.0
regenerate	1.4.2	1.5.0
regexpu-core	6.4.0	6.5.3
regjsparser	0.13.2	0.13.4
resolve.exports	2.0.3	2.0.4
source-map-js	1.2.1	1.2.2
strnum	2.4.2	2.5.1
type-is	2.0.1	2.1.0
undici	6.28.1	6.29.1

Updates @changesets/cli from 3.0.2 to 3.0.3

Release notes

Sourced from @​changesets/cli's releases.

@​changesets/cli@​3.0.3

Patch Changes

• #2297 3f163da Thanks @​Andarist! - Fixed semver ranges (such as >=1.0.0 <2.0.0) getting cut off (>=2.0.0) when updating internal dependencies.

• #2276 ca9d110 Thanks @​Andarist! - Fixed pnpm 10 compatibility with npm 12 when reading registry information, packing, and publishing packages.

• Updated dependencies [3f163da, bfe9050, e522996]:

  • @​changesets/apply-release-plan@​8.1.1
  • @​changesets/config@​4.0.1

Changelog

Sourced from @​changesets/cli's changelog.

3.0.3

Patch Changes

• #2297 3f163da Thanks @​Andarist! - Fixed semver ranges (such as >=1.0.0 <2.0.0) getting cut off (>=2.0.0) when updating internal dependencies.

• #2276 ca9d110 Thanks @​Andarist! - Fixed pnpm 10 compatibility with npm 12 when reading registry information, packing, and publishing packages.

• Updated dependencies [3f163da, bfe9050, e522996]:

  • @​changesets/apply-release-plan@​8.1.1
  • @​changesets/config@​4.0.1

Commits

• c9269c0 Version Packages (#2291)
• ca9d110 Fix pnpm 10 publishing with npm 12 (#2276)
• 7be7fde Build(deps): Bump the production-dependencies group across 1 directory with 6...
• b430ce0 Move e2e tests to an on-demand workspace (#2275)
• 93314a8 test: add happy path tests for add (#2289)
• d13a39e test: use inline snapshots for publish plan tests (#2284)
• See full diff in compare view

Updates uuid from 14.0.2 to 14.0.3

Release notes

Sourced from uuid's releases.

v14.0.3

14.0.3 (2026-10-09)

Bug Fixes

• fix CITGM #1154 (#981) (b44f159)

Changelog

Sourced from uuid's changelog.

14.0.3 (2026-10-09)

Bug Fixes

• fix CITGM #1154 (#981) (b44f159)

Commits

• 993ff7b chore(main): release 14.0.3 (#982)
• f7d19b9 chore: update workflow actions (#983)
• b44f159 fix: fix CITGM #1154 (#981)
• dd8c173 chore: update deps (#975)
• See full diff in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates @biomejs/biome from 2.5.12 to 2.5.15

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.15

2.5.15

Patch Changes

• #10634 b436ba0 Thanks @​subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

  For example, the following snippet triggers the rule.

  function Component({ items = [] }) {
    return items;
  }

• #11956 faa8b37 Thanks @​dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.

  <script>
    export let name;
  </script>

• #10816 1b9479e Thanks @​Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034

  {
    "linter": {
      "rules": {
        "nursery": {
          "useLogicalProperties": {
            "level": "warn",
            "options": {
              "direction": "rtl"
            }
          }
        }
      }
    }
  }

• #11960 1fdb5c2 Thanks @​dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.

  import { page } from "$app/stores";

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.15

Patch Changes

• #10634 b436ba0 Thanks @​subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

  For example, the following snippet triggers the rule.

  function Component({ items = [] }) {
    return items;
  }

• #11956 faa8b37 Thanks @​dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.

  <script>
    export let name;
  </script>

• #10816 1b9479e Thanks @​Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034

  {
    "linter": {
      "rules": {
        "nursery": {
          "useLogicalProperties": {
            "level": "warn",
            "options": {
              "direction": "rtl"
            }
          }
        }
      }
    }
  }

• #11960 1fdb5c2 Thanks @​dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.

  import { page } from "$app/stores";

• #11723 3b429d1 Thanks @​m1handr! - Fixed #11656: noAstroSetHtmlDirective now correctly reports set:html directives inside Astro template expressions.

... (truncated)

Commits

• 0b4c11f ci: release (#11815)
• ad5b362 feat: adds noAstroConflictingSetDirectives rule for .astro (#11494)
• 034366d chore: update codspeed logo in readme (#12019)
• 717db8c feat(lint): add noMisplacedListElements (#11917)
• 089bde0 feat(lint/js): add useStrictBooleanExpressions (#11750)
• 1fdb5c2 feat(lint/js/svelte): add useSvelteKitRuneImports lint rule (#11960)
• faa8b37 feat(lint/js/svelte): add noSvelteExportLet (#11956)
• b2b4400 chore: update sponsors (#11973)
• ff4c4dd feat(lint/js): add noMeaninglessVoidOperator (#11732)
• 1b9479e feat(lint): add useLogicalProperties rule (#10816)
• Additional commits viewable in compare view

Updates @credo-ts/anoncreds from 0.7.0 to 0.7.2

Changelog

Sourced from @​credo-ts/anoncreds's changelog.

Changelog

0.7.1

Patch Changes

• 9f4278b: Add DidDocument.findVerificationMethodsByPurpose and DidDocument.findVerificationMethodsByTypeAndPurpose.

  The relationship-aware methods resolve inline and referenced methods and return them in requested relationship order while preserving entry order within each relationship. The type-filtered method accepts one or more verification-method representations and delegates relationship traversal to the purpose-only method. DIDComm JSON-LD, JWT credentials, presentation selection, DIDComm messaging, AnonCreds data integrity, Cheqd signing, peer DID conversion, and did:webvh signing now use the appropriate shared lookup. AnonCreds credential signing prefers verification methods authorized for assertionMethod, with declared verificationMethod entries as a fallback.

• b75467c: Move the W3C Data Integrity credential attachment format (Aries RFC 0809) out of @credo-ts/anoncreds and into @credo-ts/didcomm, where the rest of the format already lived. The format is not anoncreds specific: binding a credential to an anoncreds link secret is one of its binding methods, next to the didcomm signed attachment method and to not binding the credential at all. Issuing a plain W3C credential over this format no longer requires depending on @credo-ts/anoncreds.

  • Added DidCommDataIntegrityCredentialFormatService to @credo-ts/didcomm. DataIntegrityDidCommCredentialFormatService in @credo-ts/anoncreds is now a deprecated alias for it and will be removed in the next major version.
  • Added the DidCommDataIntegrityLinkSecretBindingProvider interface and its injection token, implementing the anoncreds_link_secret binding method. @credo-ts/anoncreds provides AnonCredsLinkSecretBindingProvider and the AnonCredsModule registers it, so agents using anoncreds keep the binding method with no changes. Using the binding method without the AnonCredsModule registered now fails with an explanatory error rather than an unresolved dependency.
  • Fixed deleteCredentialById deleting every credential of this format through the anoncreds holder service. Credentials that were not bound to a link secret are now removed as the plain W3cCredentialRecord or W3cV2CredentialRecord they are stored as.

• fd5016d: feat: the Cache interface get, set and remove methods now accept a CacheOptions parameter with a scope that is either 'context' (default) or 'global', allowing globally reusable data to be shared across agent contexts. The X.509 CRL summary cache, the Indy VDR pool lookup cache and the AnonCreds registry cache use the global scope, as they only hold publicly anchored data. The DID resolver caches documents of public did methods in the global scope, and documents of other did methods per agent context; the list of public did methods can be configured with the new publicDidMethods option of the dids module (default ['web', 'indy', 'sov', 'cheqd', 'hedera', 'webvh']).

  Behavior changes to be aware of:

  • InMemoryLruCache now namespaces keys by contextCorrelationId by default. This fixes potential cross-context sharing of context-scoped entries (e.g. records cached by CachedStorageService) in multi-tenant setups. Single-context agents are not affected.
  • RedisCache stores global-scope entries under a global: key prefix. Existing context-scoped Redis entries for the caches that moved to the global scope become cache misses after upgrading and expire through their TTL, causing a one-time refetch.

• 907cc54: refactor(vc): rename anoncreds Data Integrity bridge APIs to W3C credential namespace. Replaces Data Integrity-specific symbols and types (IAnonCredsDataIntegrityService, AnonCredsDataIntegrityServiceSymbol, ANONCREDS_DATA_INTEGRITY_CRYPTOSUITE, DataIntegrityProof, dataIntegrityCryptosuites) with W3C credential equivalents. Generic JSON-LD verification now rejects anoncreds-2023 proofs and requires anoncreds W3C credential path. Introduces shouldSignWithAnonCredsW3cService() and shouldVerifyWithAnonCredsW3cService() to clarify service responsibilities.

• cfe86fa: X509 trusted certificates now can be provided in a new format. Previously it was a list of base64/pem/der encoded certificates, but now you can also provide a list of objects in the format [{issuance: string[], status? :string[]}]. This is used for the new status indicator on mdoc. First, it looks for the used issuance trusted certificates and then validates the status, if available, with the status trusted certificates associated with the issuance property.

• b75467c: Support issuing Verifiable Credentials Data Model 2.0 credentials over the W3C Data Integrity credential attachment format (Aries RFC 0809). The format previously advertised data_model_versions_supported: ['1.1'] and rejected a data model 2.0 credential, even though the agent was already able to secure one with a DataIntegrityProof.

  The data model version is negotiated on the wire as the RFC describes: the offer advertises the version of the credential it carries, and the holder echoes its choice as data_model_version on the request. Which cryptosuite secures the credential is not negotiated, as RFC 0809 leaves that choice to the issuer.

  • The base JSON-LD context of the offered credential now determines the advertised data_model_versions_supported, so offering a credential in the https://www.w3.org/ns/credentials/v2 context works without further configuration. Offers for data model 1.1 credentials are unaffected.
  • Added the cryptosuite data integrity credential format option, naming the Data Integrity cryptosuite used to secure a data model 2.0 credential, for example eddsa-jcs-2022. When omitted, the first registered cryptosuite supporting the key type of the issuer verification method is used. It is ignored for data model 1.1, which is secured with a linked data signature suite instead. The anoncreds-2023 cryptosuite is rejected, as it is only produced through the anoncreds link secret binding method.
  • W3cDataIntegrityApi.getSupportedCryptosuites accepts an optional public JWK type, returning only the cryptosuites that support that key type.
  • A received data model 2.0 credential is verified and stored as a W3cV2CredentialRecord. Deleting a credential of this format looks the record up in both the data model 1.1 and 2.0 stores, so the record type on the credential exchange record stays 'w3c' for both versions.
  • The anoncreds link secret binding method is rejected for data model 2.0 credentials, both when creating an offer and when issuing, as that binding method is defined for data model 1.1 and the anoncredsvc-2023 cryptosuite only.
  • Fixed the comparison of the offered and the received credential subject, which rejected any claim with a falsy value: a credential carrying a claim such as 0, false or '' was refused by the holder as not matching the offer. Claims are now compared by presence.

• cfe86fa: TokenStatusList is a new standard module on the agent. It allows you to create/update/fetch token status lists. It is up to the user to host this, this can be easily done with the statusList you receive from the agent.tokenStatusList.createTokenStatusList(...) function. Updating the statuslist allows you to change the status list credential state from valid to invalid, but also update the expiry time, rotate certificates, change signing algorithm, etc. Signatures are the default and mac should only be used if the user is aware of the security implications and has good reason to do so.

• Updated dependencies [9f4278b]

• Updated dependencies [f127ff5]

• Updated dependencies [5cfcadb]

• Updated dependencies [84dfcf4]

• Updated dependencies [b75467c]

• Updated dependencies [e80900a]

• Updated dependencies [8ded8d2]

• Updated dependencies [fd5016d]

... (truncated)

Commits

• 3d4b386 fix: several flakiness fixes (#2967)
• 1c18cf8 chore(anoncreds): use package subpaths and ensure dependency edges (#2978)
• 798c401 chore(anoncreds)!: remove deprecated anoncreds di namespace (#2958)
• 61d7d0f fix(askar): use NativeAskar.instance instead of the deprecated askar export (...
• fc21fb6 chore(release): new version (#2772)
• fae21ee Merge branch 'main' into feat/signature-suite-registration
• b75467c feat(didcomm): support VCDM 2.0 credentials over RFC0809 (#2898)
• a412444 Merge branch 'main' into feat/signature-suite-registration
• 9f4278b feat(DidDocument): keyType and Purpose-aware Verification Method helpers (#2934)
• 78094a9 don't register signature suite in w3cv2 module
• Additional commits viewable in compare view

Updates @credo-ts/askar from 0.7.0 to 0.7.2

Changelog

Sourced from @​credo-ts/askar's changelog.

Changelog

0.7.1

Patch Changes

• 8b8690a: Add connectionParameters to the Askar postgres database config. The parameters are added to the postgres connection url and passed to the underlying driver, allowing e.g. ssl options (sslmode, sslrootcert, etc.) to be configured without setting environment variables. See https://docs.rs/sqlx/latest/sqlx/postgres/struct.PgConnectOptions.html#parameters for supported parameters.

• bc4638e: Add support for the ISO/IEC TS 18013-7:2025 Annex C (org-iso-mdoc) Digital Credentials API.

  • KMS: HPKE (RFC 9180) key agreement algorithms HPKE-0, HPKE-3 and HPKE-7, following the naming of draft-ietf-jose-hpke-encrypt. These are integrated-encryption algorithms, so encryption/decryption must be omitted and encrypt returns an encapsulatedKey. Implemented in the askar backend (the recipient private key stays inside askar; only the Diffie-Hellman output leaves it) and in the node backend.
  • Mdoc module: createDcApiVerificationSession / verifyDcApiResponse for verifiers and resolveDcApiRequest / createDcApiResponse for wallets, backed by a new MdocVerificationSessionRecord.
  • verifyDcApiResponse matches the response against the device request of the session and throws a MdocDeviceRequestNotSatisfiedError when a doc request is not satisfied. By default every requested element must be disclosed and issuer signed; in the docRequests passed to createDcApiVerificationSession, pass { intentToRetain, optional, source } instead of the intentToRetain boolean to mark an element as optional or as device signed. The match is returned as deviceRequestMatch, with per doc request the valid and failed documents, and per document the result of the docType and claims checks.
  • resolveDcApiRequest matches the stored mdocs with the same rules and returns the same structure (through Holder.matchDeviceRequest of @owf/mdoc): per doc request the validCredentials and failedCredentials, each with its record and the docType and claims checks, so a wallet can show an mdoc of the requested doctype together with the requested claims it is missing. An age_over_NN request is answered with the age attestation the mdoc has (18013-5 7.2.5). A requested element that is not issuer signed, but that the device key is authorized for in the MSO, is matched as device signed when its value is passed in deviceNameSpaces to resolveDcApiRequest: pass the same value in the deviceNameSpaces of the credential to createDcApiResponse. A credential can also pass elements to disclose only some of the requested elements.
  • Reader authentication on an incoming request is resolved through the same trust layers as credential verification: the certificates passed to resolveDcApiRequest, then the global getTrustedIssuersForVerification callback (with the new mdocReaderAuth verification type, called per doc request), then the deprecated getTrustedCertificatesForVerification callback, then the statically configured trusted certificates. Resolving a reader authenticated request throws when none of these are configured. Return the leaf certificate from the callback to trust a reader on the certificate it presented itself.

• bc4638e: Only pick a response encryption key from client_metadata.jwks that the key management backends of the agent can actually perform the ECDH-ES key agreement with. Previously the first recognized enc key was used, which failed later on if e.g. a verifier included a P-521 key and the configured KMS backend (such as Askar) does not support that curve. The Askar and Node key management backends now also take the curve of the external public key into account in isOperationSupported.

• cfe86fa: X509 trusted certificates now can be provided in a new format. Previously it was a list of base64/pem/der encoded certificates, but now you can also provide a list of objects in the format [{issuance: string[], status? :string[]}]. This is used for the new status indicator on mdoc. First, it looks for the used issuance trusted certificates and then validates the status, if available, with the status trusted certificates associated with the issuance property.

• cfe86fa: TokenStatusList is a new standard module on the agent. It allows you to create/update/fetch token status lists. It is up to the user to host this, this can be easily done with the statusList you receive from the agent.tokenStatusList.createTokenStatusList(...) function. Updating the statuslist allows you to change the status list credential state from valid to invalid, but also update the expiry time, rotate certificates, change signing algorithm, etc. Signatures are the default and mac should only be used if the user is aware of the security implications and has good reason to do so.

• Updated dependencies [9f4278b]

• Updated dependencies [f127ff5]

• Updated dependencies [5cfcadb]

• Updated dependencies [84dfcf4]

• Updated dependencies [e80900a]

• Updated dependencies [8ded8d2]

• Updated dependencies [fd5016d]

• Updated dependencies [d45aec0]

• Updated dependencies [5cfcadb]

• Updated dependencies [097c831]

• Updated dependencies [20d6ab1]

• Updated dependencies [bc4638e]

• Updated dependencies [bc4638e]

• Updated dependencies [bc4638e]

• Updated dependencies [907f12f]

• Updated dependencies [bc4638e]

• Updated dependencies [96dc69b]

• Updated dependencies [7dfafeb]

• Updated dependencies [3a3eb03]

• Updated dependencies [23c354e]

• Updated dependencies [907cc54]

• Updated dependencies [339f4cc]

• Updated dependencies [bc4638e]

• Updated dependencies [5cfcadb]

• Updated dependencies [f127ff5]

• Updated dependencies [cfe86fa]

• Updated dependencies [e97c18b]

• Updated dependencies [121dd14]

• Updated dependencies [b75467c]

• Updated dependencies [cfe86fa]

• Updated dependencies [0a58888]

• Updated dependencies [1e2088f]

  • @​credo-ts/core@​0.7.1

Commits

• ced3a7e chore(pnpm): bump to pnpm 12.6.0 and update select dependencies (#2982)
• 61d7d0f fix(askar): use NativeAskar.instance instead of the deprecated askar export (...
• fc21fb6 chore(release): new version (#2772)
• bc4638e feat: add support for iso 18013-7 dc api (#2922)
• 8b8690a feat: allow setting postgres connection params in askar (#2931)
• 0bc66a4 fix(askar): only auto-provision at initialization (#2667)
• f127ff5 feat: mdoc revocation for issuance and verification (#2803)
• See full diff in compare view

Updates @credo-ts/core from 0.7.0 to 0.7.2

Changelog

Sourced from @​credo-ts/core's changelog.

Changelog

0.7.1

Patch Changes

• 9f4278b: Add DidDocument.findVerificationMethodsByPurpose and DidDocument.findVerificationMethodsByTypeAndPurpose.

  The relationship-aware methods resolve inline and referenced methods and return them in requested relationship order while preserving entry order within each relationship. The type-filtered method accepts one or more verification-method representations and delegates relationship traversal to the purpose-only method. DIDComm JSON-LD, JWT credentials, presentation selection, DIDComm messaging, AnonCreds data integrity, Cheqd signing, peer DID conversion, and did:webvh signing now use the appropriate shared lookup. AnonCreds credential signing prefers verification methods authorized for assertionMethod, with declared verificationMethod entries as a fallback.

• f127ff5: Mdoc revocation for issuance and verification

• 5cfcadb: Fail COSE Sign1 and Mac0 signing, and Mac0 verification, when no algorithm is declared instead of falling back to the first supported signature algorithm of the key. The Mac0 authenticate operation now also uses the algorithm provided by the caller. COSE Sign1 verification still falls back to the signature algorithm of the key, as @​owf/mdoc does not forward the alg of the deviceAuth Sign1 structure yet.

• 84dfcf4: sd-jwt vc does not require IAT to be required anymore

• e80900a: Fix selective disclosure of SD-JWT array elements when presenting with DCQL. Array elements that are selectively disclosable on their own were not disclosed, even when requested. They are now disclosed by their position in the array.

  DCQL claim sets of SD-JWT VC and W3C V2 SD-JWT VC credentials now include disclosed_paths: the paths to the claims the presentation discloses, including the claims that are not selectively disclosable. An array element has the position it has in the claims of the credential, where decoy digests don't count. A path stands for the claim and everything below it, so a claim that is disclosed as a whole has a single path. Pass them as the new disclosedPaths in DcqlCredentialsForRequest (done automatically by selectCredentialsForRequest).

  Disclosing an SD-JWT VC or W3C V2 SD-JWT VC based on disclosedPayload is deprecated, as it selects arrays as a whole. disclosedPaths will be required for these formats in the next breaking version.

  For the same reason, applyDisclosuresForPayload on SdJwtVcService and W3cV2SdJwtCredentialService is deprecated in favor of the new applyDisclosuresForPaths.

  IDisclosureFrame now also allows array positions in _sd, and the ClaimPath type is exported.

• 8ded8d2: Fix Ed25519Signature2018 incorrectly accepting Ed25519VerificationKey2020 verification methods (previously converted at runtime from multibase to base58), and register Ed25519Signature2020 with its own required Ed25519VerificationKey2020 verification method type instead of sharing acceptance with Ed25519Signature2018. Each suite now strictly enforces its own verification method type, with error messages identifying both the offending key type and the proof type.

  W3cJsonLdCredentialService#signCredential and #signPresentation now share a single suite-preparation path that resolves and validates the verification method against the suite's required key type before signing, replacing duplicated per-method logic.

  Also fixes missing @type: multibase typing for publicKeyMultibase/proofValue and missing capabilityInvocation, capabilityDelegation, and keyAgreement term definitions in the ed25519-2020 JSON-LD context, which caused JSON-LD framing/expansion failures when dynamically signing and verifying credentials and presentations with Ed25519Signature2020 DIDs.

• fd5016d: feat: the Cache interface get, set and remove methods now accept a CacheOptions parameter with a scope that is either 'context' (default) or 'global', allowing globally reusable data to be shared across agent contexts. The X.509 CRL summary cache, the Indy VDR pool lookup cache and the AnonCreds registry cache use the global scope, as they only hold publicly anchored data. The DID resolver caches documents of public did methods in the global scope, and documents of other did methods per agent context; the list of public did methods can be configured with the new publicDidMethods option of the dids module (default ['web', 'indy', 'sov', 'cheqd', 'hedera', 'webvh']).

  Behavior changes to be aware of:

  • InMemoryLruCache now namespaces keys by contextCorrelationId by default. This fixes potential cross-context sharing of context-scoped entries (e.g. records cached by CachedStorageService) in multi-tenant setups. Single-context agents are not affected.
  • RedisCache stores global-scope entries under a global: key prefix. Existing context-scoped Redis entries for the caches that moved to the global scope become cache misses after upgrading and expire through their TTL, causing a one-time refetch.

• d45aec0: fix(kms): respect the configured defaultBackend when no explicit backend is provided for a key management operation. Previously the first registered backend that supported the operation was always used and the defaultBackend option was silently ignored, which could result in keys being created in a different (e.g. software instead of hardware-backed) backend than configured. If the default backend does not support the requested operation, the first other backend that supports the operation is used and a warning is logged.

• 5cfcadb: Use the alg from the JWS header when verifying linked data proofs, and bind signing to the algorithm declared in the JWS header, instead of using the first supported signature algorithm of the key. Also fixes the JWS header validation for linked data proofs, which could previously be bypassed by adding an extra header parameter.

• 097c831: fix(vc): bind the holder to the credentialSubject when verifying JSON-LD (ldp_vp) presentations

  W3cJsonLdCredentialService.verifyPresentation verified the presentation proof and each embedded credential's issuer proof, but never checked that the presentation signer (holder) controls the credentialSubject.id of the embedded credentials. The underlying @digitalcredentials/vc / jsonld-signatures libraries do not perform this check either. As a result an ldp_vp could be used to present someone else's credential (a data object, not a secret) wrapped in a presentation signed

... (truncated)

Commits

• ced3a7e chore(pnpm): bump to pnpm 12.6.0 and update select dependencies (#2982)
• e84b55b fix: do not include kid in JsonWebKey (#2959)
• 194cf1e chore(types): improve compile-time type safety (main) (#2986)
• 1c18cf8 chore(anoncreds): use package subpaths and ensure dependency edges (#2978)
• aadabc9 fix(openid4vc): do not advertise symmetric signature algorithms (#2965)
• 4161fb9 chore(deps): bump the patch-updates group with 7 updates (#2966)
• 798c401 chore(anoncreds)!: remove deprecated anoncreds di namespace (#2958)
• 0b9531a feat(didcomm): Support RFC 881 - vc+sd-jwt over issue-credential-v2 (#2846)
• d6b6ad1 Merge branch 'main' into fix/single-jsonld-library
• 04699b1 chore(deps): bump uuid from 13.0.2 to 14.0.0
• Additional commits viewable in compare view

Updates @credo-ts/didcomm from 0.7.0 to 0.7.2

Changelog

Sourced from @​credo-ts/didcomm's changelog.

@​credo-ts/didcomm

0.7.1

Patch Changes

• 9f4278b: Add DidDocument.findVerificationMethodsByPurpose and DidDocument.findVerificationMethodsByTypeAndPurpose.

  The relationship-aware methods resolve inline and referenced methods and return them in requested relationship order while preserving entry order within each relationship. The type-filtered method accepts one or more verification-method representations and delegates relationship traversal to the purpose-only method. DIDComm JSON-LD, JWT credentials, presentation selection, DIDComm messaging, AnonCreds data integrity, Cheqd signing, peer DID conversion, and did:webvh signing now use the appropriate shared lookup. AnonCreds credential signing prefers verification methods authorized for assertionMethod, with declared verificationMethod entries as a fallback.

• b75467c: Move the W3C Data Integrity credential attachment format (Aries RFC 0809) out of @credo-ts/anoncreds and into @credo-ts/didcomm, where the rest of the format already lived. The format is not anoncreds specific: binding a credential to an anoncreds link secret is one of its binding methods, next to the didcomm signed attachment method and to not binding the credential at all. Issuing a plain W3C credential over this format no longer requires depending on @credo-ts/anoncreds.

  • Added DidCommDataIntegrityCredentialFormatService to @credo-ts/didcomm. DataIntegrityDidCommCredentialFormatService in @credo-ts/anoncreds is now a deprecated alias for it and will be removed in the next major version.
  • Added the DidCommDataIntegrityLinkSecretBindingProvider interface and its injection token, implementing the anoncreds_link_secret binding method. @credo-ts/anoncreds provides AnonCredsLinkSecretBindingProvider and the AnonCredsModule registers it, so agents using anoncreds keep the binding method with no changes. Using the binding method without the AnonCredsModule registered now fails with an explanatory error rather than an unresolved dependency.
  • Fixed deleteCredentialById deleting every credential of this format through the anoncreds holder service. Credentials that were not bound to a link secret are now removed as the plain W3cCredentialRecord or W3cV2CredentialRecord they are stored as.

• cfe86fa: X509 trusted certificates now can be provided in a new format. Previously it was a list of base64/pem/der encoded certificates, but now you can also provide a list of objects in the format [{issuance: string[], status? :string[]}]. This is used for the new status indicator on mdoc. First, it looks for the used issuance trusted certificates and then validates the status, if available, with the status trusted certificates associated with the issuance property.

• b75467c: Support issuing Verifiable Credentials Data Model 2.0 credentials over the W3C Data Integrity credential attachment format (Aries RFC 0809). The format previously advertised data_model_versions_supported: ['1.1'] and rejected a data model 2.0 credential, even though the agent was already able to secure one with a DataIntegrityProof.

  The data model version is negotiated on the wire as the RFC describes: the offer advertises the version of the credential it carries, and the holder echoes its choice as data_model_version on the request. Which cryptosuite secures the credential is not negotiated, as RFC 0809 leaves that choice to the issuer.

  • The base JSON-LD context of the offered credential now determines the advertised data_model_versions_supported, so offering a credential in the https://www.w3.org/ns/credentials/v2 context works without further configuration. Offers for data model 1.1 credentials are unaffected.
  • Added the cryptosuite data integrity credential format option, naming the Data Integrity cryptosuite used to secure a data model 2.0 credential, for example eddsa-jcs-2022. When omitted, the first registered cryptosuite supporting the key type of the issuer verification method is used. It is ignored for data model 1.1, which is secured with a linked data signature suite instead. The anoncreds-2023 cryptosuite is rejected, as it is only produced through the anoncreds link secret binding method.
  • W3cDataIntegrityApi.getSupportedCryptosuites accepts an optional public JWK type, returning only the cryptosuites that support that key type.
  • A received data model 2.0 credential is verified and stored as a W3cV2CredentialRecord. Deleting a credential of this format looks the record up in both the data model 1.1 and 2.0 stores, so the record type on the credential exchange record stays 'w3c' for both versions.
  • The anoncreds link secret binding method is rejected for data model 2.0 credentials, both when creating an offer and when issuing, as that binding method is defined for data model 1.1 and the anoncredsvc-2023 cryptosuite only.
  • Fixed the comparison of the offered and the received credential subject, which rejected any claim with a falsy value: a credential carrying a claim such as 0, false or '' was refused by the holder as not matching the offer. Claims are now compared by presence.

• cfe86fa: TokenStatusList is a new standard module on the agent. It allows you to create/update/fetch token status lists. It is up to the user to host this, this can be easily d...

  Description has been truncated

[dependabot]

Labels

The following labels could not be found: pnpm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 5cf0f68

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.