From 75a5f37eb7b8939512bb43fd2f1b3e3cc884b6a9 Mon Sep 17 00:00:00 2001 From: Moises E Jaramillo Date: Mon, 13 Jul 2026 22:54:12 -0400 Subject: [PATCH 1/2] =?UTF-8?q?build(deps):=20bump=20net-did=202.0.1=20?= =?UTF-8?q?=E2=86=92=202.3.0=20and=20NetCrypto=201.1.0=20=E2=86=92=201.2.0?= =?UTF-8?q?;=20release=20v1.2.0=20(#47)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the DID + crypto foundation pins so a wallet pulling DidComm.* transitively resolves the did:webvh method driver at ≥ 2.2.0, letting the downstream net-wallet-sdk 0.2.0 graph converge on the DidUpdateResult evidence its identity document-update / key-rotation integrity contract requires. DidComm references NetDid.Method.WebVh, so this is the key convergence step. Pinned to the current latest net-did 2.3.0 (not the issue's 2.2.0 floor): additive did:webvh Update/Deactivate/resolution security + conformance hardening (net-did#82/#91/#101); DidComm consumes net-did for resolution only, so it is unaffected. NetCrypto 1.2.0 is required by net-did 2.3.0, so the direct pin now matches the transitive graph (no NU1605). DataProofsDotnet.Jose stays at 1.1.0. Bumps DidCommVersion to 1.2.0. Verified: restore clean, Release build 0 warnings (warnings-as-errors), 672 tests pass (537 Core + 135 Interop), resolved graph NetDid.Core/2.3.0 + NetCrypto/1.2.0. Closes #47 Co-Authored-By: Claude Opus 4.8 --- CHANGELOG.md | 22 ++++++++++++++++++++++ Directory.Build.props | 2 +- Directory.Packages.props | 22 ++++++++++++++-------- docs/didcomm-dotnet_PRD.md | 4 ++-- tasks/todo20260713-225348.md | 29 +++++++++++++++++++++++++++++ 5 files changed, 68 insertions(+), 11 deletions(-) create mode 100644 tasks/todo20260713-225348.md diff --git a/CHANGELOG.md b/CHANGELOG.md index b54610f..a3100e2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,28 @@ All notable changes to didcomm-dotnet are documented here. Format follows ## [Unreleased] +## [1.2.0] - 2026-07-13 + +> Foundation-pin bump only — no public API or behavior change in DidComm itself. Closes **#47**. + +### Changed — Dependencies + +Bumps the DID + crypto foundation pins so a wallet app that pulls `DidComm.*` transitively resolves +the `did:webvh` method driver at **≥ 2.2.0**, letting the downstream net-wallet-sdk 0.2.0 graph +converge on the `DidUpdateResult` evidence its identity document-update / key-rotation integrity +contract (FR-ID-10) requires. DidComm is the foundation library that references +`NetDid.Method.WebVh`, so this is the key step for that transitive graph to converge. + +- **`NetDid.*` 2.0.1 → 2.3.0** — `NetDid.Core`, `NetDid.Extensions.DependencyInjection`, + `NetDid.Method.Key`, `NetDid.Method.Peer`, `NetDid.Method.WebVh`. Pinned to the current latest + (2.3.0) rather than the issue's 2.2.0 floor. DidComm consumes net-did for **DID resolution only**, + and 2.1→2.3 is additive there: the changes are `did:webvh` Update/Deactivate/resolution security + + conformance hardening (stricter SCID identity and controller-proof validation, post-sign + nested-member tamper fixes — net-did#82, #91, #101). Resolution-only usage is unaffected. +- **`NetCrypto` 1.1.0 → 1.2.0** — required by `NetDid.Core 2.3.0`; the direct pin now matches the + transitive graph (no `NU1605` downgrade). +- `DataProofsDotnet.Jose` stays at **1.1.0** (unchanged; already latest). + ## [1.1.0] - 2026-06-22 > Follows the published **1.0.0** line — a normal minor bump (new opt-in feature, no breaking public API). diff --git a/Directory.Build.props b/Directory.Build.props index 5f5d9f5..13586a8 100644 --- a/Directory.Build.props +++ b/Directory.Build.props @@ -5,7 +5,7 @@ enable latest true - 1.1.0 + 1.2.0 true $(NoWarn);1591 true diff --git a/Directory.Packages.props b/Directory.Packages.props index f4f06f3..db48a4c 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -6,17 +6,23 @@ - - - - - + builds on NetCrypto 1.2.0), referenced as a project below. + 2.3.0 is additive over 2.0.1 for DidComm's resolution-only usage: it is did:webvh + Update/Deactivate/resolution security + conformance hardening (net-did#101) and forces + NetCrypto 1.2.0. Bumped so a wallet pulling DidComm transitively resolves the did:webvh + driver at ≥ 2.2.0, letting the net-wallet-sdk 0.2.0 graph converge (didcomm-dotnet#47). --> + + + + + - + bytes. Everything else (JWE/JWS build+parse, ECDH, AEAD, key wrap, JWK) is DataProofs. + 1.2.0 is also the version net-did 2.3.0 depends on, so the direct pin and the transitive + graph agree (no NU1605 downgrade). --> +