LutraIDDocumentation

Releases

What changed in each LutraID release, newest first. One version number covers the whole product: the release named here is what LutraID Cloud runs and what a self-hosted customer installs.

Cloud is updated for you and needs nothing from you. Self-hosted installations pull the version by tag, which is immutable — it always resolves to the same digests — and Upgrades and air-gap covers moving between them. Security releases are published separately from feature releases, with advisories.

v0.34.201

22 October 2026

Fixes

  • frontend: send a JSON body when turning on SCIM

v0.34.200

22 October 2026

Features

  • sso: prefill the provider edit form with the stored non-secret config
  • frontend: show SSO domain verification as a DNS record table

Fixes

  • sso: return OIDC sign-in to the origin that holds the state cookie
  • ci: size wallet PAR budgets for nightly OIDF conformance
  • ci: accept the installer's current skip-verify message in the release smoke

v0.34.194

21 October 2026

Features

  • selfhosted: self-hosted GA stack — licensing UI, SSO gate, registry defaults, retention parity, own Caddy image, zero-egress smoke, legal

Fixes

  • deps: patch HIGH CVEs blocking the Trivy image gate
  • remediate Security Cloud P2/P3 code paths
  • remediate P1 security findings (mDoc, demo admin, key pool)

v0.34.190

20 October 2026

Fixes

  • point help links at the renamed docs guides
  • frontend: make three CI-flaky component tests deterministic

v0.34.187

19 October 2026

Breaking

  • Self-hosted: the database migrations start from a new baseline. An installation on an earlier release cannot be upgraded in place: install this release on an empty database.
  • api: bulk offer endpoints require a batchId, a UUID you generate once per bulk send, and answer 200 with { batchId, results } instead of 201 with an array. Each row reports created, invalid or failed, and a request holds at most 50 rows. Sending a row again with the same batchId and entry id returns its first offer, marked replayed and without transactionCode, instead of creating a second one.
  • api: offer emails no longer contain the PIN. transactionCode is returned once, in the create response, and never on an idempotent replay. Give it to the holder another way, or set userPinRequired to false for email offers.
  • api: a plan limit now answers 429 with QUOTA_EXCEEDED and the params meterKey, billingClass, limit and resetsAt. Waiting does not help; the limit resets at resetsAt or after a plan change. Every 429 sets Retry-After.
  • email: account emails, invitations included, are sent from AUTH_EMAIL_FROM, which defaults to EMAIL_FROM. Invitations used EMAIL_FROM before; set AUTH_EMAIL_FROM only if account mail needs a different sender.
  • Self-hosted: recording or withdrawing an organization's legal decision needs the registrar permission as well as superadmin. Grant it on the staff user page.
  • dashboard: pages were reorganized and renamed (Setup, Records, Team, Developers), and old page addresses are not redirected. Update bookmarks; the guides use the new names.

Features

  • ui-ux-redesign

Fixes

  • validate PID birthplace and display alternative-query inbox results

v0.34.183

15 October 2026

Fixes

  • api: keep public docs limited to integration and wallet APIs

v0.34.182

14 October 2026

Maintenance only: no customer-facing changes.

v0.34.181

14 October 2026

Features

  • ebwoid: promote the business ID document type to platform scope
  • expose credential offer status to issuer API keys in SaaS

Fixes

  • restore API reference entries behind proxy prefixes
  • patch WAL-G HTTP/2 module for the Trivy gate
  • repair icons, profile uploads, and resource deletion
  • stabilize settings navigation and organization forms
  • image CI downloads and patch backup-tool Go runtimes

v0.34.173

9 October 2026

Features

  • frontend: unify UI patterns and clarify verifier registration
  • record append-only security events for API keys and membership changes

Fixes

  • publish unsigned issuer metadata when signing is disabled
  • deps: patch Next.js image optimization SSRF
  • drain rollout traffic and probe worker and relay liveness
  • include public backend in edition type checks
  • require tenant scope for key-service signing and ECDH
  • raise light-theme text contrast to WCAG AA
  • pin external document catalog sources
  • remove browser credential schema compilation under CSP
  • enable append-only persistence for Compose Valkey
  • return 404 for missing scoped issuer certificates
  • accept TS3 wallet certification information as a string
  • force UTC on every database session
  • align sandbox registration certificates with ETSI TS 119 475
  • validate organization identifiers and correct legacy LEI bindings
  • align WRPRC uploads with TS 119 475 validity and issuer coverage
  • align WRPAC import validation with ETSI TS 119 411-8
  • unify wallet protocol error responses across editions
  • protect public testing routes and present safe backend errors
  • frontend: preserve wizard state and retry failed lookups
  • preserve reusable offer state after session failures
  • frontend: show backend failures as errors with route error boundaries
  • deliver intermediary wallet declines and suppress claims on failure
  • enforce the reviewed Better Auth HTTP endpoint inventory
  • make attribute-reference offers single-use
  • require all ISO mDL mandatory elements
  • enable self-hosted account deletion
  • bound KMS and Vault requests with timeouts
  • bound database advisory lock acquisition and bypass valid signing identities
  • validate holder data and issuing country at offer creation
  • report terminal email failures and deduplicate delivery retries

Performance

  • index PAR credential offer issuer_state lookup

v0.34.127

7 October 2026

Features

  • qes: add scrolling document reader with zoom
  • qes: require PDF uploads with preview and 24-hour requests
  • seed: lutraid lab wallet provider acceptance profile
  • frontend: polish the Request QES flow for customers

Fixes

  • block Better Auth SCIM management and impersonation endpoints
  • enforce organization creation policy during onboarding
  • require explicit opt-out of self-hosted release verification
  • qes: use signed filenames for wallet results
  • backend: bundle the wallet interop seed in the SaaS image
  • frontend: keep the Request QES session in the URL
  • config: check service secrets at process start, not in maintenance jobs
  • issuance: keep authorization-code offers reusable and guard status transitions
  • retention: erase verifier recipient emails in Intermediary mode
  • issuance: require complete subjects and keep snapshots until token expiry
  • assurance: require anchored wallet attestation trust in Production
  • config: refuse mock secrets in production
  • retention: erase the credential offer email with the recipient
  • logging: never log or store SQL parameters
  • verifier: reject repeated and race-losing wallet posts
  • oidc4vci: bind upstream UserInfo claims to the ID token subject
  • analytics: scrub tokens and emails from PostHog URLs
  • queue: redact email bodies on renamed permanent failures
  • issuance: issue only for the organization's own country
  • honor lander language links on app entry
  • public: classify the public PID and mDL types for certificate selection

v0.34.90

1 October 2026

Features

  • keys: keep Sandbox keys as encrypted software keys
  • pki: per-type issuer registration and issuer-side Intermediary (Plan F)
  • operating-mode: deliver signed intermediary results to the sandbox inbox
  • pki: prepare sandbox certificates and verifier registration automatically
  • pki: upload production registration certificates
  • pki: production verifier access certificate CSR (Plan B)
  • pki: production certificates without trust sources and superadmin legal verification (Plan A)
  • saas: add sandbox wallet-signing demo
  • frontend: polish the issuer certificate page and summarize review fixes
  • pki: gate production use on certificate eligibility
  • pki: add provider enrollment and certificate onboarding
  • pki: scope issuer signing and status lists to their certificates
  • operating-mode: add deployment mode and relying-party enrollment revisions
  • pki: scope sandbox CAs per organization and add the sandbox registrar
  • pki: require trust validation before certificate assignment
  • pki: store certificate versions and current assignments
  • pki: versioned certificate profiles and conformance fixtures
  • selfhosted: let the installer hand routing to a proxy the customer runs

Fixes

  • soak: report the Sandbox key backend the fixture actually uses
  • delete Sandbox issuers and verifiers with their certificates, never Production activity
  • db: let organizations with published status lists be deleted
  • seed: lutraid-demos seeds PID and mDL with their Sandbox certificates
  • keys: stop creating signing keys that never get a certificate
  • soak: prepare Sandbox certificates when provisioning the soak fixture
  • pki: sandbox CA names, operator certificate blockers and registration breadcrumb

v0.34.59

28 September 2026

Fixes

  • frontend: do not put a subscription paywall in an edition with no billing
  • ui updates

v0.34.57

25 September 2026

Features

  • add EUDI TS3 technical profile for ITB RP testing

Fixes

  • selfhosted: let a superadmin change an organization member's role
  • selfhosted: mount the rest of what this edition's frontend calls
  • frontend: send onboarding to a page that exists
  • selfhosted: let the installer's prompts be edited

v0.34.52

25 September 2026

Features

  • selfhosted: one organization by default, more as a licensed entitlement

Fixes

  • selfhosted: ask for the customer's own registry, and colour the installer output

v0.34.50

24 September 2026

Features

  • release: publish the self-hosted images for arm64 as well as amd64

Fixes

  • frontend: find sharp where pnpm actually puts it
  • frontend: ship sharp for the architecture the image runs on
  • release: push each self-hosted image as soon as its gate passes
  • selfhosted: serve the routes this edition's own frontend calls

v0.34.45

24 September 2026

Features

  • selfhosted: one command installs the bundle
  • release: derive the released commit from the version
  • release: publish public release notes for every release

Fixes

  • ci: the smoke install skips verification on purpose
  • include category B in public mDL issuance
  • licensing: accept the request key Chronos actually sends
  • issuer-trust: log why a trust evaluation was not trusted
  • interop: publish initial workspace status list
  • trust-validator: send the status token format for status signers

v0.34.33

22 September 2026

Features

  • api: add stable API key integration routes
  • selfhosted: customers receive a release only after it installs
  • public-edition: trust-list test case families and flow information panel
  • operations: pin several wallet provider roots for interop issuance
  • selfhosted: fan every release out to entitled customers
  • self-hosted edition — licensing, Helm and Compose packages, signed releases
  • platform-ca: ISO 18013-5 certificate profile for trust-list interop

Fixes

  • selfhosted: point customers at info+support@lutralabs.io
  • issuer-trust: accept the mdl provider category
  • selfhosted: clean the fan-out workspace as root, like every other workflow
  • public-edition: make the trust-list cases enforce what they claim
  • selfhosted: let docker compose up --wait judge the relays and the scheduler
  • selfhosted: make a fresh install actually come up
  • selfhosted: version the Helm chart with the release
  • selfhosted: publish the Helm chart pinned to the release's digests
  • selfhosted: attest build provenance with cosign, not GitHub
  • ci: install crane and syft pinned, verified and authenticated
  • selfhosted: clear the release Trivy gate, and fix Compose's REGISTRY
  • public-edition: seed only the cases whose profiles exist
  • docker: drop npm and corepack from the runtime images
  • ci: install crane and syft in the self-hosted release
  • frontend: serve cosign.pub instead of 404ing it
  • align EBWOID development assurance policy
  • frontend: sidebar links 404ed outside an environment
  • reset: the final sync no longer forces, and clears a stale force first
  • soak: one journey at a time, because two break each other
  • ci: start the v0.34 build series so staging can receive Freight again

Was this page helpful?