Skip to content

chore(release): align platform v2.3.0 with agent-controller v2.3.1 #1821

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ajile-in merged 5 commits into from
Nov 4, 2026
Merged

chore(release): align platform v2.3.0 with agent-controller v2.3.1 #1821

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
9f82708
chore(release): align platform v2.3.0 with agent-controller v2.3.1
ajile-in Nov 4, 2026
691a107
docs(release): hyphenate end-to-end in v2.3.0 notes
ajile-in Nov 4, 2026
167932b
docs(release): note holder binding methods and migration (#1820)
ajile-in Nov 4, 2026
91874db
chore(release): pin agent-controller v2.3.2
ajile-in Nov 4, 2026
11b2313
docs(release): describe ldp_vc holder binding as conditional
ajile-in Nov 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .env.demo
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,7 +190,7 @@ GEO_LOCATION_MASTER_DATA_IMPORT_SCRIPT=/prisma/scripts/geo_location_data_import.
UPDATE_CLIENT_CREDENTIAL_SCRIPT=/prisma/scripts/update_client_credential_data.sh

# CREDO-CONTROLLER image. Provide the image name with tag if you are using a custom image.
AFJ_VERSION=ghcr.io/credebl/credo-controller:v2.3.0
AFJ_VERSION=ghcr.io/credebl/credo-controller:v2.3.2

# Note: the below 2 variables are only in case of starting services using docker
AFJ_AGENT_SPIN_UP=/agent-provisioning/AFJ/scripts/docker_start_agent.sh
Expand Down
11 changes: 6 additions & 5 deletions RELEASE-v2.3.0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,17 +1,18 @@
# CREDEBL Platform v2.3.0

Released together with credo-controller 2.3.0 (`AFJ_VERSION=ghcr.io/credebl/credo-controller:v2.3.0`).
Released together with agent-controller v2.3.2 (`AFJ_VERSION=ghcr.io/credebl/credo-controller:v2.3.2`).
Previous stable release: v2.2.0. Draft: confirm against the final merged PR list before tagging.

## Agent controller compatibility
- Requires agent-controller v2.3.0 (released 2026-10-30). The image name is unchanged in this release: `ghcr.io/credebl/credo-controller:v2.3.0`. The rename to `agent-controller` is deferred upstream.
- Controller 2.3.0 adds W3C JSON-LD end to end (`ldp_vc` over OID4VC, DCQL verification), X.509 chain support, a tenant session leak fix, and moves its base image to Node 26. Rebuild agent images rather than reusing cached layers.
- Requires agent-controller v2.3.2 (released 2026-11-04), which follows 2.3.0 (2026-10-30) and 2.3.1 (2026-11-03). 2.3.1 adds optional holder-binding fields to `POST /openid4vc/holder/request-credential` and Credo 0.7.0 -> 0.7.4 (no storage migration). 2.3.2 supports binding `ldp_vc` credentials to a `did:web` holder when `holderDidUrl` is supplied with `bindingPolicy: require` (other requests are unchanged), and adds `Ed25519VerificationKey2020` support; the platform's `did:web` default for `ldp_vc` (#1820) relies on it. In 2.3.2, `credentialSubject.id` of new W3C credentials is the holder's bare DID, and DCQL `ldp_vc` queries must use expanded JSON-LD IRIs in `meta.type_values`. The image name is unchanged in this release: `ghcr.io/credebl/credo-controller:v2.3.2`. The rename to `agent-controller` is deferred upstream.
- Controller 2.3.x adds W3C JSON-LD end-to-end (`ldp_vc` over OID4VC, DCQL verification), X.509 chain support, a tenant session leak fix, and moves its base image to Node 26. Rebuild agent images rather than reusing cached layers.
- Holder list endpoints (SD-JWT, mdoc, W3C) return a plain array with no query parameters, but an envelope `{ data, pagination, filters? }` once any parameter is sent. The platform on `main` does not call these endpoints. Any holder-management work (for example #1792) must handle both shapes.

## Features
- OpenBao secret storage (provider, provisioning script, `docker-compose.openbao.yml`, docs/tests) (#1679, #1712)
- Rust FS / local storage support via `@credebl/storage` (#1670)
- OID4VC: `jwt_vc_json-ld` / `ldp_vc` (JSON-LD) credential format support (#1646)
- OID4VC: holder binding methods (`cryptographic_binding_methods_supported`) are configurable per template and per issuer, and `ldp_vc` advertises `did:web` by default. See `docs/oid4vc-holder-binding-methods.md` (#1820)
- Swagger UIs exposed per module group (#1608)
- API gateway version via `API_GATEWAY_VERSION` env (#1777)
- Row-level security migration `enable_rls_if_not_exists` (#1688)
Expand All @@ -31,7 +32,7 @@ Previous stable release: v2.2.0. Draft: confirm against the final merged PR list
- pnpm security overrides added; pnpm 9.15.9

## Upgrade notes
- Run `prisma migrate deploy` (new RLS migration). Test on a copy of production data first.
- Run `prisma migrate deploy`. New migrations: the RLS migration (test on a copy of production data first) and `add_cryptographic_binding_methods_to_oidc_issuer` (adds `oidc_issuer.cryptographicBindingMethods TEXT[] DEFAULT '{}'`, additive, no backfill) (#1820).
- New agent env vars in `agent.env`: `STATUS_LIST_SERVER_URL`, `STATUS_LIST_API_KEY`, `STATUS_LIST_DEFAULT_SIZE`; platform `STATUS_LIST_HOST` in `.env.demo`.
- OpenBao is optional; see `openspec/specs/openbao-secret-storage` and `docker-compose.openbao.yml`.
- Pin the controller image to 2.3.0 (`AFJ_VERSION`).
- Pin the controller image to v2.3.2 (`AFJ_VERSION`).
Loading