sdk: v0.9.0

0.9.0 (2026-01-28)

⚠ BREAKING CHANGES

• remove NanoTDF support (#791)

Features

• remove NanoTDF support (#791) (6a87956)
• sdk: Pull kas keys from definitions and namespaces. (#808) (28eb417)

Bug Fixes

• all vulnerabilities and update tooling (#812) (be7e4ae)
• sdk: bump lodash from 4.17.21 to 4.17.23 in /lib (#810) (abc3acd)

dev (af55d1d9e52b854d0b513a3f30b838e8cd9f4aa1)

Development build from main branch.

Commit: af55d1d9e52b854d0b513a3f30b838e8cd9f4aa1

sdk: v0.8.0

0.8.0 (2026-01-14)

Features

• ci: add npm provenance support for package publishing (#797) (4d342ce)
• DSPX-2234-key-management-and-obligation-client-stub (#793) (e7d56b3)

Bug Fixes

• cli: bump glob from 10.4.5 to 10.5.0 in /cli (#787) (e00a909)
• sdk: bump qs and body-parser in /lib (#789) (8e342f9)

sdk: v0.7.0

0.7.0 (2026-01-09)

Features

• Assertion verification JWK and X.509 (#790) (f5a8f5e)

Bug Fixes

• sdk: bump glob in /lib (#785) (aadafd4)

sdk: v0.6.0

0.6.0 (2025-10-30)

Features

• ci: Add a workflow to update the generated code for new protocol/go versions (#767) (c9d5f21)
• sdk: Add requiredObligations to the PermissionDeniedError (#781) (9cd7b44)
• sdk: Move to rewrap v2 request/response format (#774) (e7718d5)

Bug Fixes

• sdk: Additional comments and cleanup of Rewrap V2 code (#780) (bb29962)

sdk: v0.5.0

0.5.0 (2025-10-17)

Features

• add system metadata assertion (#630) (922965c)
• Certificates & Obligations (#755) (688c304)
• Get Namespace (#756) (5b8ef25)
• sdk: initial obligations support in rewrap flow (#748) (0361361)

Bug Fixes

• signingKey should not be part of the computed hash (#696) (b763278)
• sdk: Fix new API not setting nano attributes (#679) (f0d9719)
• SEC-4653 prevent ReDoS vulnerability in HTML payload unwrapping regex (#686) (09d0360)

sdk: v0.4.1

0.4.1 (2025-07-18)

Bug Fixes

• sdk: Fix new API not setting nano attributes (#679) (#680) (2d2459b)

sdk/v0.4.0

Changelog

0.4.0 (2025-06-26)

Features

• Add initial Dependency Review configuration (#587) (8f9d343)
• Assertion signing key handling and verification in the CLI (#409) (242150b)
• cli: Adds --allowList parameter to cli (#328) (297cec6)
• cli: Adds --policyBinding ecdsa option (#352) (4e54c0d)
• cli: Enables experimental ec in KAOs (#457) (203563c)
• cli: Pass the platform url on decrypt, add the platform kas to the allowlist when fetching (#565) (5afd0d0)
• core: Adds kao.schemaVersion (#416) (7925669)
• core: KID in NanoTDF (#325) (6d01eff)
• export connect rpc generated platform from package.json (#610) (cbd8a10)
• get kas public key from base key (#623) (5bde0a1)
• lets nanoTDF client take options instead (#278) (048bd30)
• lib: Bump for EC feature (#452) (6178877)
• lib: generate ts code from platform protos (#280) (d88c612)
• lib: Load abac config from policy service (#351) (48b2442)
• lib: offline abac KAO configuration (#349) (6eb70c1)
• lib: Updated error types (#362) (7fb29c5)
• sdk: Adds OpenTDF.open method (#485) (6ba9044)
• sdk: Adds opts for collection cache (#411) (47a5287)
• sdk: Allow custom KAO array templates (#307) (fd1b386)
• sdk: Allows skipping verification (#371) (8529461)
• sdk: Assertion support (#350) (10ff5c7)
• sdk: connect rpc client export (#545) (92de145)
• sdk: ec-wrapped key support (#422) (9d4eab4)
• sdk: Export AttributeObject and others (#487) (3d45ecf)
• sdk: get KASes list from platform when allowedKases list is not passed (#557) (598c39f)
• sdk: remove hex encoding for segment hash (#397) (ec4a55a)
• sdk: sdk to use connect rpc calls (#596) (f8e54e5)
• sdk: Updates to jose 6.x (#449) (9667747)

Bug Fixes

• add ignoreAllowList flag (#331) (29a9b82)
• Assertion verification key input (#412) (5be9bb1)
• audit: npm audit fix (#304) (ca2dddd)
• audit: npm audit fix (#318) (bc574f7)
• Changes to make regex patterns more efficient, accurate and simpler (#376) (2fe2c43)
• ci: Get platform_roundtrip working again (#413) (6ca50e6)
• ci: ignore auto-formatting of proto-generated files (#296) (30fb685)
• ci: use keycloack docker (#555) (dc4e48e)
• cli: Better errors and properly set exit code in more cases (#418) (11ad526)
• cli: Enables concurrent rewrap in cli (#391) (ab40664)
• client: Normalize allowlist to origins (#321) (ac1f634)
• core: npm audit fix (#380) (496f07c)
• docs: Update README.md - remove outdated / incorrect quickstart links / ins… (#301) (2dbca15)
• dpop: respect dpop disabled flag in oidc access token class methods (#299) (24319f7)
• keySplitInfo Promise.any Promise.all (#379) (c6cdbef)
• lib: Adds a 10 MiB cap to manifest size (#353) (e775ba5)
• logs: Improves on decrypt unsafe fail (#303) (4efa118)
• nano: Allow padding of kids (#338) (e1ae891)
• nano: ecdsa policy binding support for encrypt (#346) (031bbb7)
• nano: resource locator kid parse issue (#330) (4eef553)
• nano: Store kid (#334) (63721f6)
• Remove environment logging in vite.config.ts (#373) ([d1e0a45](d1e0a4538e2f5ba58d4...

sdk/v0.3.1

What's Changed

• fix(sdk): Fixes generating ztdf 4.2.2 output by @dmihalcik-virtru in #530
• chore(ci): Fix prefix submatch operator for tags by @dmihalcik-virtru in #532
• fix(sdk): Don't set schemaV in older target specs by @dmihalcik-virtru in #531
• fix(sdk): Fix assertion output for legacy mode by @dmihalcik-virtru in #533

Full Changelog: sdk/v0.3.0...sdk/v0.3.1

sdk/v0.3.0

• Supports creating files compatible with older versions, with the targetSpecVersion flag
  • support hex encoding signature hash for legacy sdk #520
• Adds OpenTDF.open method, to allow inspecting a TDFs contents without decrypting it
• EXPERIMENTAL: Adds support for ec-wrapped key access objects