[osanderson]

🤖 I have created a release beep boop

0.68.0 (2026-11-01)

⚠ BREAKING CHANGES

• server: X5CAttesterChain refuses an attestation whose x5c carries, below the signing certificate, a certificate with the subject and public key of the anchor a verified chain ends at, even when it is not byte-identical to the configured anchor. Send x5c as the signing certificate and its intermediates only. See UPGRADING.md for v0.68.0.
• server: X5CAttesterChain with the default LeafPolicy refuses an attestation whose signing certificate lists the ISO/IEC 18013-5 mDL JWS or VICAL signer, ISO/IEC TS 23220-4 mdoc document signer or reader, RFC 9336 document signing, or RFC 6187 SSH extended key usage, or that chains only through a CA restricted to such roles. Issue attesters a dedicated certificate, or set LeafPolicy to AnyAttesterLeaf or your own AttesterLeafPolicyFunc. See UPGRADING.md for v0.68.0.

Bug Fixes

• client: send authorization_details without HTML escaping (9988f69)
• extension: encode RARSet output without HTML escaping (7b25c0c)
• resource: refuse typed-nil access-token key sources and stores (4e31c30)
• server: refuse a re-issued or cross-signed anchor in attester x5c (6ce2b00)
• server: refuse more signing roles in DefaultAttesterLeafPolicy (db7e273)
• server: refuse typed-nil trust fields before validating them (0403b7e)

---

This PR was generated with Release Please. See documentation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[osanderson]

🤖 Created releases:

• v0.68.0

🌻