Update EUDIPLO to v9

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@eudiplo/sdk-core (source)	8.1.0 → 9.1.0

---

Release Notes

EUDIPLO/eudiplo (@​eudiplo/sdk-core)

v9.1.0

Compare Source

Bug Fixes

• client: accept [null] array item paths and run the Playwright suite in CI (#​1168) (8be6872)
• issuance: best-effort notifications, no silent default claims (#​1180) (4cbc5af)
• verifier: check revocation of presented SD-JWT credentials (#​1205) (d013b5b)
• cli: import the bundled demo tenant under the default outbound URL policy (#​1173) (8e5286b)
• cli: let doctor --strict pass and forward options to Compose and kubectl (#​1181) (31e2098)
• registrar: link registration certificates to their access certificate (#​1207) (bd39c75)
• registrar: link the access certificate only when the registrar has it (#​1208) (d51f6f4)
• deps: override vulnerable transitive build dependencies (#​1215) (a5d0970)
• config: plan unchanged image references as unchanged (#​1211) (92264e7)
• deployment: protect the full profile's Vault key and bind all Compose ports (#​1183) (de2da6e), closes #​1173
• cli: pull only the EUDIPLO images in eudiplo upgrade (#​1179) (6383777)
• deps: resolve Dependabot alerts for sharp, dompurify, brace-expansion, js-yaml and smol-toml (#​1209) (e49b59c), closes #​338 #​325 #​337 #​317 #​319 #​321 #​304 #​336
• client: send auth header when loading config operation history (#​1212) (22d3602)
• client: send the security headers from every nginx location (#​1165) (1d44ec5)
• client: show wallet-facing URLs under PUBLIC_URL and list webhooks for issuers (#​1185) (4520095), closes #​1135
• client: stop browsers from keeping stale Monaco and env.js copies (#​1164) (455da95)
• issuer: validate credential, issuer and trust list configs like import (#​1184) (da6b2a6)

Features

• issuance: accept a PEM public key as trust-list verifier (#​1188) (1e74305)
• session: cancel pending offers and presentation requests (#​1171) (6e4d86c)
• config: keep detached resources detached and reattach them to the file version (#​1210) (793698a)
• show and change credential status in the web client (#​1206) (3a0b6b8)

---

This release is also available on:

• v9.1.0
• npm package (@​latest dist-tag)
• v9.1.0

v9.0.0

Compare Source

• Fix OIDF FAPI2 conformance coverage (#​1079) (446e875)
• fix(authorization)!: bound refresh tokens, enforce S256 for interactive authorization, honor built-in token settings (#​1135) (42cfbdb), closes #​1104
• fix(authorization)!: verify DPoP proofs, require PKCE for every authorization code, bind codes to their grant and verify interactive authorization (#​1143) (500f50d)
• fix(issuance)!: call external and upstream authorization servers under the outbound URL policy (#​1157) (def2051)
• fix(platform)!: fail closed on broken TLS configuration and clean up repository tooling (#​1140) (b98cc00)
• fix(registrar)!: match registration certificate claims by path and add SKIP_* flags (#​1097) (474e249)
• fix(security)!: protect key material and KMS secrets, enforce key attestation requirements and federation trust (#​1146) (d5dca08)
• fix(session)!: enforce session expiry at request time and count sessions from the database (#​1127) (03b2591), closes #​1120 #​1123 #​1120 #​1123
• fix(session)!: scope session access by role and fix the session event stream (#​1145) (21c667e), closes #​1142 #​820 #​820 #​1141
• fix(status-list)!: reject values that do not fit the list, make revocation final and restrict status changes to issuance roles (#​1142) (a83e1b5)
• fix(storage)!: replace MinIO with RustFS across deployments (#​1075) (57d70a6)
• fix(trust)!: derive DCQL aki values from listed issuers and renew managed trust lists (#​1134) (ed0bbe9)
• fix(trust)!: fetch trust lists, status lists, federation entities and CRLs under the outbound URL policy (#​1155) (af23b1d)
• fix(verifier)!: enforce DCQL claim values in OpenID4VP presentations (#​1148) (4b1d728)
• fix(verifier)!: report failed presentations to webhooks, classify mDOC failures and finish SSE streams (#​1133) (f50c3a2)

Bug Fixes

• verifier: accept wallet error responses with HTTP 200 and record them on the session (#​1112) (950ae62)
• storage: allow S3 credentials to be omitted for IRSA/instance-profile auth (#​1073) (89088d2)
• database: bootstrap fresh schemas through migrations (#​1072) (74d83f3)
• trust: bound the status list caches (#​1159) (2f454a0), closes #​1155
• trust: clear the federation trust cache from the cache endpoints (#​1105) (5af1761)
• security: enforce outbound URL policy on schema metadata fetches and remove ReDoS-prone regex (#​1109) (7a6b13b)
• issuance: enforce PKCE with S256 on the chained authorization servers (#​1104) (2bf496f)
• config-import: follow symlinked tenant folders during discovery (#​1107) (5cca3ed)
• improve protocol debugging logs (#​1077) (b992728)
• issuance: keep mDOC signed date within the signing certificate validity (#​1113) (5c8a904)
• move to the EUDIPLO organization and LF Decentralized Trust (#​1161) (d3706be)
• issuance: open OID4VP wallet request via tap instead of bare redirect (#​1098) (672625e)
• deployment: pin the bundled PostgreSQL to 16 in the Compose files (#​1139) (3c4fbcd), closes #​1129
• client: preserve array child wildcard paths during credential config nesting (#​1071) (66cc9c9)
• verifier: require non-empty vp_token entries and enforce DCQL multiple (#​1106) (4e47fd9)
• client: require status management for Single Active Credential and default built-in token lifetime to 300 s (#​1144) (fb37ece)
• issuance: resolve notification sessions like the credential endpoint and validate activeCredentials in the API (#​1138) (545119e)
• webhook: return mandatory mDL claims from the example claims webhook (#​1111) (6eb6376)
• issuance: send presented credentials to the attribute provider (#​1108) (0c0759d)
• database: store the session OAuth expiry columns as timestamp on PostgreSQL (#​1151) (728e41e)
• issuance: treat children of array claim fields as item properties (#​1099) (53974dc), closes #​1080
• sdk,cli: use the /api prefix where the backend serves it and await the stored request object (#​1141) (05183ed)
• client: use the logged-in instance URL after an SSO login (#​1118) (e8b8571), closes #​1076
• security: verify CRLs against the issuing CA before trusting them (#​1156) (6401287)
• client: warn when client and backend come from different builds (#​1115) (b6dd020)

Documentation

• upgrade: cover role-scoped sessions, the event stream header and the DB_SYNCHRONIZE default in the 9.0 guide (#​1152) (4ab71f0), closes #​1145

Features

• security: allow restricting CORS origins for the management API via CORS_ORIGINS (#​1114) (bc53368), closes #​1088
• cli: expand doctor with production readiness checks (#​1078) (f137547)
• session: filter and search the session list and correlate logs with sessions (#​1147) (7e6a44b), closes #​1121
• issuance: validate resolved claims against the credential configuration schema (#​1080) (4b7fd4c)

BREAKING CHANGES

• external authorization servers and upstream providers
  of chained authorization servers on HTTP or on private addresses, and
  their JWKS and introspection endpoints, are rejected unless
  OUTBOUND_URL_ALLOW_HTTP or OUTBOUND_URL_ALLOW_PRIVATE_NETWORK is set. The
  upstream token request no longer follows redirects.

Signed-off-by: Mirko Mollik mirko.mollik@eudi.sprind.org
Co-authored-by: Claude Opus 5.5 noreply@anthropic.com

• trust lists, status lists and federation entities on
  HTTP or on private addresses, and CRLs on private addresses, are rejected
  unless OUTBOUND_URL_ALLOW_HTTP or OUTBOUND_URL_ALLOW_PRIVATE_NETWORK is
  set. URLs on EUDIPLO's own PUBLIC_URL or INTERNAL_URL are not affected.

Signed-off-by: Mirko Mollik mirko.mollik@eudi.sprind.org
Co-authored-by: Claude Opus 5.5 noreply@anthropic.com

• upgrade: changes, and it never mentioned that #​1072 changed the
  DB_SYNCHRONIZE default.

Upgrade guide:

• New "Clients see only the sessions of their side": session list, read,
  logs and delete only cover the client's side; what the other side gets
  (empty list, 404, 204 without delete) and the fix (a role of each side).
• "The session event stream needs the Authorization header and ends": the
  header-only token, the scope, ?token= rejected with 401, the SDK 9.0
  fetch client, reading the stream from the backend.
• New "Schema changes only through migrations": DB_SYNCHRONIZE defaults to
  false (8.x: true); keep it out of production env files.
• Intro, audience table, "After the upgrade" checklist and the summary on
  the upgrade overview name the access-control and default changes; the
  overview no longer says "configuration format v2" (PresentationConfig is
  v3).

Env examples:

• Compose minimal/standard/full: commented OUTBOUND_URL_* block for
  services reached over HTTP inside the Compose network; CORS_ORIGINS in
  standard and full.
• Root .env.example: SESSION_TTL, STATUS_BITS (suspension needs 2 bits) and
  CORS_ORIGINS.
• KMS links in the Compose and Kubernetes examples point to /operate/kms.

Also: the Compose page pairs S3_ACCESS_KEY_ID with RUSTFS_ACCESS_KEY, and
the release checklist describes the /upgrade URLs the 9.0 CLI prints.

Signed-off-by: Mirko Mollik mirko.mollik@eudi.sprind.org
Co-authored-by: Claude Opus 5.5 noreply@anthropic.com

• OpenID4VP presentations whose disclosed claim is not one
  of the claim query's values now fail with claim_value_mismatch;
  values must match the claim type ([true], not ["true"]).
  PresentationConfig exports use file format v3.

Signed-off-by: Mirko Mollik mirko.mollik@eudi.sprind.org
Co-authored-by: Claude Opus 5.5 noreply@anthropic.com

• a client with only presentation:request (and optionally
  presentation:manage) no longer sees issuance sessions; a client with only
  issuance:offer (and optionally issuance:manage) no longer sees
  presentation sessions. Give a client that must read both kinds a role of
  each side.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com
Signed-off-by: Mirko Mollik mirko.mollik@eudi.sprind.org

• fix(session)!: authorize the session event stream like reading the session

GET /api/session/{id}/events read the tenant from payload.entity, which
a token from the token endpoint never contains (it carries tenant_id), so

• GET /api/session/{id}/events requires the access token in
  the Authorization header and issuance:offer or presentation:request,
  scoped like GET /api/session/{id}; the token query parameter is rejected
  with 401. The browser's EventSource cannot send the header: read the
  stream from your backend.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com
Signed-off-by: Mirko Mollik mirko.mollik@eudi.sprind.org

• key export and the KMS provider configuration require
  tenant:admin or tenants:manage; KMS credentials are returned redacted;
  configurations with keyAttestationsRequired reject proofs without a
  matching key attestation; federation-only DCQL queries reject issuers
  outside the federation; federation.role other than leaf and
  enforceSigningPolicy: false are rejected.

Signed-off-by: Mirko Mollik mirko.mollik@eudi.sprind.org
Co-authored-by: Claude Opus 5.5 noreply@anthropic.com

• invalid DPoP proofs are rejected; a DPoP-bound
  authorization or refresh requires a proof with the bound key; codes are
  only accepted for the grant they were issued for.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com
Signed-off-by: Mirko Mollik mirko.mollik@eudi.sprind.org

• fix(issuance)!: verify interactive authorization presentations and authenticate web completion

• The openid4vp_presentation step of interactive authorization only
  JSON-parsed the wallet's openid4vp_response and then issued an
  authorization code, so any JSON completed the step. The response now
  goes through the regular OID4VP verification (decryption, nonce,
  audience, DCQL, trust, single use) for the request created for this
  auth session; only a completed verification finishes the step.
  Verified credentials are forwarded to attribute providers like for the
  OID4VP authorization server, and issuer_state must name a redeemable
  authorization code offer. The verifier session is now created before
  the request so wallets can fetch the request object.
• complete-web-auth was unauthenticated, so the wallet that knows the
  auth session could complete the redirect_to_web step itself. It now
  requires an issuance:offer token of the same tenant and only completes
  an unexpired auth session whose current step is redirect_to_web.
• Follow-up requests must match the current step, an auth session yields
  one code, and interactive authorization codes expire after 60 s.

• interactive authorization requires S256 PKCE and the
  encrypted OpenID4VP authorization response; complete-web-auth requires an
  issuance:offer management token of the tenant; interactive authorization
  codes expire after 60 s.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com
Signed-off-by: Mirko Mollik mirko.mollik@eudi.sprind.org

• startup fails when TLS is enabled but the certificate,
  key or CA file cannot be read; TLS_CA_PATH serves the intermediate chain
  and does not enable mTLS.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com
Signed-off-by: Mirko Mollik mirko.mollik@eudi.sprind.org

• test(platform): keep certificate validation on in the TLS chain test

The handshake test disabled certificate validation to inspect the served chain (CodeQL js/disabling-certificate-validation). Only the root is trusted, so with validation on the handshake fails unless the server sends the intermediate, which is what the test checks.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com
Signed-off-by: Mirko Mollik mirko.mollik@eudi.sprind.org

• suspending (status: 2) a credential on a status list
  with 1 bit per entry is rejected with 400; use lists with 2 or more bits
  (STATUS_BITS, the tenant status list config, or bits when creating a
  list). Lists that already contain such values are no longer published
  until their entries are set to a valid value.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com
Signed-off-by: Mirko Mollik mirko.mollik@eudi.sprind.org

• docs: document the status value range check and the remediation for corrupted lists

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com
Signed-off-by: Mirko Mollik mirko.mollik@eudi.sprind.org

• fix(status-list)!: make revocation final and restrict status changes to issuance roles

• A revoked credential can no longer be reinstated (1 -> 0) or suspended
  (1 -> 2): the update is rejected with 409 before any entry changes.
  Suspensions can still be lifted or turned into a revocation. The rule is
  checked for every entry up front and again inside the versioned write.
• POST /api/session/revoke requires issuance:offer or
  issuance:manage; verifier-only clients (presentation:request) can no
  longer change credential status.
• Describe the endpoint correctly in the OpenAPI document (it changes the
  status of a session's credentials; 400 and 409 responses).
• Docs: revocation page, revocable credentials cookbook (suspension is
  shown on a new credential) and the 9.0 upgrade guide.

• reinstating or suspending a revoked credential returns 409;
  POST /api/session/revoke requires an issuance role.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com
Signed-off-by: Mirko Mollik mirko.mollik@eudi.sprind.org

• chained/OID4VP servers issue 30-day refresh tokens unless
  disabled, and refresh tokens without a stored expiry expire 30 days after
  session creation; interactive authorization requires S256; the built-in
  server applies its token lifetime, signing key and DPoP settings;
  /issuers/{tenant}/chained-as-vp/* is removed.

Signed-off-by: Mirko Mollik mirko.mollik@eudi.sprind.org
Co-authored-by: Claude Opus 5.5 noreply@anthropic.com

• provided_attestations is rejected; PresentationConfig
  exports use file format v2; concurrent trust list updates return 409.

Signed-off-by: Mirko Mollik mirko.mollik@eudi.sprind.org
Co-authored-by: Claude Opus 5.5 noreply@anthropic.com

• presentation webhooks also fire for failed and declined
  presentations; consumers must check the new status field. The SSE stream
  now completes after a terminal status.

Signed-off-by: Mirko Mollik mirko.mollik@eudi.sprind.org
Co-authored-by: Claude Opus 5.5 noreply@anthropic.com

• expired or finished sessions are rejected at request time
  (HTTP 400/404 or OAuth invalid_grant); expiresAt is a full timestamp;
  presentations emit a fetched status; the sessions metric is a gauge that
  every replica reports, so aggregate it with max; IssuanceConfig exports use
  file format v2.
• OUTBOUND_URL_ALLOW_HTTP and
  OUTBOUND_URL_ALLOW_PRIVATE_NETWORK now default to false in every
  environment instead of true outside NODE_ENV=production. Set them
  explicitly for local development against HTTP/localhost services.

Signed-off-by: Mirko Mollik mirko.mollik@eudi.sprind.org
Co-authored-by: Claude Opus 5.5 noreply@anthropic.com

• PAR now requires a redirect_uri and S256 PKCE, and request_uri and authorization-code lifetimes are reduced to 60 seconds.

Signed-off-by: Mirko Mollik mirko.mollik@eudi.sprind.org

• chore: remove file

Signed-off-by: Mirko Mollik mirko.mollik@eudi.sprind.org

• Bundled deployments now use RustFS service names, credentials, and fresh storage volumes. Existing MinIO objects require an S3-based migration before switching endpoints; see the migration guide.

Signed-off-by: Mirko Mollik mirko.mollik@eudi.sprind.org

---

This release is also available on:

• v9.0.0
• npm package (@​latest dist-tag)
• v9.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 06:59 AM, only on Wednesday (* 0-6 * * 3)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

EUDIPLO container update

This PR also updates the EUDIPLO testcontainer to ghcr.io/eudiplo/eudiplo:9.0.0 (pinned by digest) and moves the Renovate package rule to the new registry name. Review the 8.x to 9.0 upgrade guide and run the EUDIPLO-backed tests before merging.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.