diff --git a/CHANGELOG.md b/CHANGELOG.md
index b54610f..9b6021a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,28 @@ All notable changes to didcomm-dotnet are documented here. Format follows
 
 ## [Unreleased]
 
+## [1.2.0] - 2026-07-13
+
+> Foundation-pin bump only — no public API or behavior change in DidComm itself. Closes **#47**.
+
+### Changed — Dependencies
+
+Bumps the DID + crypto foundation pins so a wallet app that pulls `DidComm.*` transitively resolves
+the `did:webvh` method driver at **≥ 2.2.0**, letting the downstream net-wallet-sdk 0.2.0 graph
+converge on the `DidUpdateResult` evidence its identity document-update / key-rotation integrity
+contract (FR-ID-10) requires. DidComm is the foundation library that references
+`NetDid.Method.WebVh`, so this is the key step for that transitive graph to converge.
+
+- **`NetDid.*` 2.0.1 → 2.3.0** — `NetDid.Core`, `NetDid.Extensions.DependencyInjection`,
+  `NetDid.Method.Key`, `NetDid.Method.Peer`, `NetDid.Method.WebVh`. Pinned to the current latest
+  (2.3.0) rather than the issue's 2.2.0 floor. DidComm consumes net-did for **DID resolution only**,
+  and 2.1→2.3 is additive there: the changes are `did:webvh` Update/Deactivate/resolution security +
+  conformance hardening (stricter SCID identity and controller-proof validation, post-sign
+  nested-member tamper fixes — net-did#82, #91, #101). Resolution-only usage is unaffected.
+- **`NetCrypto` 1.1.0 → 1.2.0** — required by `NetDid.Core 2.3.0`; the direct pin now matches the
+  transitive graph (no `NU1605` downgrade).
+- `DataProofsDotnet.Jose` stays at **1.1.0** (unchanged; already latest).
+
 ## [1.1.0] - 2026-06-22
 
 > Follows the published **1.0.0** line — a normal minor bump (new opt-in feature, no breaking public API).
@@ -1530,4 +1552,7 @@ Release` with TRX + cobertura coverage upload (NFR-08 scaffold).
   IEEE P1363 format), #63 (off-curve EC point rejection — invalid-curve
   defense), #64 (Concat KDF).
 
-[Unreleased]: https://github.com/moisesja/didcomm-dotnet/commits/main
+[Unreleased]: https://github.com/moisesja/didcomm-dotnet/compare/v1.2.0...HEAD
+[1.2.0]: https://github.com/moisesja/didcomm-dotnet/compare/v1.1.0...v1.2.0
+[1.1.0]: https://github.com/moisesja/didcomm-dotnet/compare/v1.0.0...v1.1.0
+[0.1.0-preview.1]: https://github.com/moisesja/didcomm-dotnet/releases/tag/v0.1.0-preview.1
diff --git a/Directory.Build.props b/Directory.Build.props
index 5f5d9f5..13586a8 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -5,7 +5,7 @@
     <Nullable>enable</Nullable>
     <LangVersion>latest</LangVersion>
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
-    <DidCommVersion>1.1.0</DidCommVersion>
+    <DidCommVersion>1.2.0</DidCommVersion>
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
     <NoWarn>$(NoWarn);1591</NoWarn>
     <Deterministic>true</Deterministic>
diff --git a/Directory.Packages.props b/Directory.Packages.props
index f4f06f3..db48a4c 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -6,17 +6,23 @@
     <!-- DID resolution only. 2.0.0 relocated all crypto primitives to NetCrypto; didcomm-dotnet
          consumes NetDid solely for resolution (IDidResolver, DID Document model) — see PRD §3.1.
          The JOSE composition + crypto substrate now come from DataProofsDotnet.Jose (which itself
-         builds on NetCrypto 1.1.0), referenced as a project below. -->
-    <PackageVersion Include="NetDid.Core" Version="2.0.1" />
-    <PackageVersion Include="NetDid.Method.Key" Version="2.0.1" />
-    <PackageVersion Include="NetDid.Method.Peer" Version="2.0.1" />
-    <PackageVersion Include="NetDid.Method.WebVh" Version="2.0.1" />
-    <PackageVersion Include="NetDid.Extensions.DependencyInjection" Version="2.0.1" />
+         builds on NetCrypto 1.2.0), referenced as a project below.
+         2.3.0 is additive over 2.0.1 for DidComm's resolution-only usage: it is did:webvh
+         Update/Deactivate/resolution security + conformance hardening (net-did#101) and forces
+         NetCrypto 1.2.0. Bumped so a wallet pulling DidComm transitively resolves the did:webvh
+         driver at ≥ 2.2.0, letting the net-wallet-sdk 0.2.0 graph converge (didcomm-dotnet#47). -->
+    <PackageVersion Include="NetDid.Core" Version="2.3.0" />
+    <PackageVersion Include="NetDid.Method.Key" Version="2.3.0" />
+    <PackageVersion Include="NetDid.Method.Peer" Version="2.3.0" />
+    <PackageVersion Include="NetDid.Method.WebVh" Version="2.3.0" />
+    <PackageVersion Include="NetDid.Extensions.DependencyInjection" Version="2.3.0" />
     <!-- NetCrypto: the crypto substrate (arrives transitively via DataProofsDotnet.Jose). DidComm
          references it directly in exactly one place — JwsSignerFactory adapts a private signer JWK
          into a NetCrypto ISigner, because DataProofs' JWS layer signs through ISigner, not raw key
-         bytes. Everything else (JWE/JWS build+parse, ECDH, AEAD, key wrap, JWK) is DataProofs. -->
-    <PackageVersion Include="NetCrypto" Version="1.1.0" />
+         bytes. Everything else (JWE/JWS build+parse, ECDH, AEAD, key wrap, JWK) is DataProofs.
+         1.2.0 is also the version net-did 2.3.0 depends on, so the direct pin and the transitive
+         graph agree (no NU1605 downgrade). -->
+    <PackageVersion Include="NetCrypto" Version="1.2.0" />
     <!-- JOSE composition + crypto substrate (JWE/JWS build+parse, ECDH, AEAD, key wrap, JWK).
          Brings NetCrypto transitively; didcomm carries no envelope crypto of its own. 1.1.0 adds
          the async IEcdhKey ECDH seam + JweParser.PeekRecipients/ParseAsync (dataproofs-dotnet#13)
diff --git a/docs/didcomm-dotnet_PRD.md b/docs/didcomm-dotnet_PRD.md
index 8a6c18a..51c88a8 100644
--- a/docs/didcomm-dotnet_PRD.md
+++ b/docs/didcomm-dotnet_PRD.md
@@ -129,7 +129,7 @@ The library is "done" for v1.0 when every `MUST` requirement in this document is
 
 | Package | Responsibility | Key dependencies |
 |---|---|---|
-| `DidComm.Core` | Message model; the DIDComm **envelope-composition** layer (legal compositions FR-ENV-02, media-type pinning, addressing-consistency FR-CONSIST-01..06, recipient defaulting, curve negotiation); pack/unpack; **resolver adapter over net-did**; secrets interface; routing/forward; rotation; threading; problem reports; OOB encode/decode. DidComm carries **no crypto or JWE/JWS assembly of its own** — those are delegated. | **`DataProofsDotnet.Jose 1.0.1`** — owns the JOSE envelope layer: multi-recipient JWE General-JSON (`ECDH-ES+A256KW` / `ECDH-1PU+A256KW`; `A256CBC-HS512` / `A256GCM` / `XC20P`), JWS (Flattened/General, compact), `JwkConversion`, base64url — all on `NetCrypto`. **`NetCrypto 1.1.0`** — the crypto substrate (sign/verify with IEEE P1363, raw ECDH, AEAD, A256KW, Concat KDF, on-curve validation in `JwkConverter.ExtractPublicKey`, `Base64Url`); reached directly only by `JwsSignerFactory` (adapts a private signer JWK into a NetCrypto `ISigner`), otherwise transitively via DataProofs. **`NetDid.Core 2.0.x`** — **DID resolution only** (`IDidResolver`, DID Document model); all crypto moved out of net-did in 2.0.0. No `NSec` / `System.Security.Cryptography` envelope crypto in DidComm. |
+| `DidComm.Core` | Message model; the DIDComm **envelope-composition** layer (legal compositions FR-ENV-02, media-type pinning, addressing-consistency FR-CONSIST-01..06, recipient defaulting, curve negotiation); pack/unpack; **resolver adapter over net-did**; secrets interface; routing/forward; rotation; threading; problem reports; OOB encode/decode. DidComm carries **no crypto or JWE/JWS assembly of its own** — those are delegated. | **`DataProofsDotnet.Jose 1.1.0`** — owns the JOSE envelope layer: multi-recipient JWE General-JSON (`ECDH-ES+A256KW` / `ECDH-1PU+A256KW`; `A256CBC-HS512` / `A256GCM` / `XC20P`), JWS (Flattened/General, compact), `JwkConversion`, base64url — all on `NetCrypto`. **`NetCrypto 1.2.0`** — the crypto substrate (sign/verify with IEEE P1363, raw ECDH, AEAD, A256KW, Concat KDF, on-curve validation in `JwkConverter.ExtractPublicKey`, `Base64Url`); reached directly only by `JwsSignerFactory` (adapts a private signer JWK into a NetCrypto `ISigner`), otherwise transitively via DataProofs. **`NetDid.Core 2.3.x`** — **DID resolution only** (`IDidResolver`, DID Document model); all crypto moved out of net-did in 2.0.0. No `NSec` / `System.Security.Cryptography` envelope crypto in DidComm. |
 | `DidComm.Transports.Http` | HTTPS send + ASP.NET Core receive endpoint | `DidComm.Core`, `Microsoft.Extensions.Http` |
 | `DidComm.Transports.WebSocket` | WebSocket send/receive, connection lifecycle | `DidComm.Core` |
 | `DidComm.Protocols.TrustPing` | Trust Ping 2.0 | `DidComm.Core` |
@@ -161,7 +161,7 @@ The library is "done" for v1.0 when every `MUST` requirement in this document is
         └───────┬───────────────┴──────────┬───────────┘
                 │                           │
    ┌────────────▼────────────┐  ┌───────────▼──────────────────────┐
-   │ net-did (NetDid 2.0.x): │  │ DataProofsDotnet.Jose:            │
+   │ net-did (NetDid 2.3.x): │  │ DataProofsDotnet.Jose:            │
    │ resolution only —       │  │ JWE (anon/auth) + JWS build/parse │
    │ key · peer · webvh ·    │  │            │                      │
    │ ethr (→ net-cid)        │  │            ▼                      │
diff --git a/tasks/todo20260713-225348.md b/tasks/todo20260713-225348.md
new file mode 100644
index 0000000..9faebb7
--- /dev/null
+++ b/tasks/todo20260713-225348.md
@@ -0,0 +1,29 @@
+# Task — Bump net-did → 2.3.0 & NetCrypto → 1.2.0, release v1.2.0 (closes #47)
+
+## Goal
+Bump the foundation pins so a wallet pulling `DidComm.*` transitively resolves the `did:webvh`
+driver at ≥ 2.2.0, letting the net-wallet-sdk 0.2.0 graph converge (issue #47). Ship as DidComm
+v1.2.0. User chose the actual latest net-did **2.3.0** over the issue's 2.2.0 floor.
+
+## Checklist
+- [x] Branch `feat/deps-net-did-2.3-netcrypto-1.2-47` off main
+- [x] `Directory.Packages.props`: 5 × `NetDid.*` 2.0.1 → 2.3.0; `NetCrypto` 1.1.0 → 1.2.0; comments refreshed
+- [x] `Directory.Build.props`: `DidCommVersion` 1.1.0 → 1.2.0
+- [x] `docs/didcomm-dotnet_PRD.md`: version refs (NetDid 2.0.x→2.3.x, NetCrypto 1.1.0→1.2.0, Jose 1.0.1→1.1.0)
+- [x] `CHANGELOG.md`: `## [1.2.0] - 2026-07-13` section
+- [x] `dotnet restore` clean, no NU1605
+- [x] `dotnet build -c Release` — 0 warnings / 0 errors (warnings-as-errors on ⇒ no downgrade, no API break)
+- [x] `dotnet test` — 672 passed (537 Core + 135 Interop), 0 failed, 0 skipped
+- [x] Verified: assembly informational version `1.2.0+517542e`; resolved graph NetDid.Core/2.3.0, NetCrypto/1.2.0
+- [ ] Commit, push, open PR "Closes #47"
+
+## Review / Results
+- **No source changes required** — a pure version-only bump, exactly as planned. net-did 2.3.0 is
+  additive for DidComm's resolution-only usage.
+- **No `packages.lock.json`** exists in this repo, so the issue's lock-regeneration / `--locked-mode`
+  step was N/A.
+- `DataProofsDotnet.Jose` left at 1.1.0 (already latest; a stale `1.0.1` reference in the PRD was
+  corrected to 1.1.0 in passing).
+- Both net-did 2.2.0 and 2.3.0 declare NetCrypto 1.2.0, so the direct NetCrypto pin now matches the
+  transitive graph — no downgrade warning.
+- Release tag/publish (`v1.2.0`) intentionally left to the maintainer's normal release flow.