chore(main): release 0.4.0

[opentdf-automation]

🤖 I have created a release beep boop

0.4.0 (2025-06-26)

Features

• Add initial Dependency Review configuration (#587) (8f9d343)
• Assertion signing key handling and verification in the CLI (#409) (242150b)
• cli: Adds --allowList parameter to cli (#328) (297cec6)
• cli: Adds --policyBinding ecdsa option (#352) (4e54c0d)
• cli: Enables experimental ec in KAOs (#457) (203563c)
• cli: Pass the platform url on decrypt, add the platform kas to the allowlist when fetching (#565) (5afd0d0)
• core: Adds kao.schemaVersion (#416) (7925669)
• core: KID in NanoTDF (#325) (6d01eff)
• export connect rpc generated platform from package.json (#610) (cbd8a10)
• get kas public key from base key (#623) (5bde0a1)
• lets nanoTDF client take options instead (#278) (048bd30)
• lib: Bump for EC feature (#452) (6178877)
• lib: generate ts code from platform protos (#280) (d88c612)
• lib: Load abac config from policy service (#351) (48b2442)
• lib: offline abac KAO configuration (#349) (6eb70c1)
• lib: Updated error types (#362) (7fb29c5)
• sdk: Adds OpenTDF.open method (#485) (6ba9044)
• sdk: Adds opts for collection cache (#411) (47a5287)
• sdk: Allow custom KAO array templates (#307) (fd1b386)
• sdk: Allows skipping verification (#371) (8529461)
• sdk: Assertion support (#350) (10ff5c7)
• sdk: connect rpc client export (#545) (92de145)
• sdk: ec-wrapped key support (#422) (9d4eab4)
• sdk: Export AttributeObject and others (#487) (3d45ecf)
• sdk: get KASes list from platform when allowedKases list is not passed (#557) (598c39f)
• sdk: remove hex encoding for segment hash (#397) (ec4a55a)
• sdk: sdk to use connect rpc calls (#596) (f8e54e5)
• sdk: Updates to jose 6.x (#449) (9667747)

Bug Fixes

• add ignoreAllowList flag (#331) (29a9b82)
• Assertion verification key input (#412) (5be9bb1)
• audit: npm audit fix (#304) (ca2dddd)
• audit: npm audit fix (#318) (bc574f7)
• Changes to make regex patterns more efficient, accurate and simpler (#376) (2fe2c43)
• ci: Get platform_roundtrip working again (#413) (6ca50e6)
• ci: ignore auto-formatting of proto-generated files (#296) (30fb685)
• ci: use keycloack docker (#555) (dc4e48e)
• cli: Better errors and properly set exit code in more cases (#418) (11ad526)
• cli: Enables concurrent rewrap in cli (#391) (ab40664)
• client: Normalize allowlist to origins (#321) (ac1f634)
• core: npm audit fix (#380) (496f07c)
• docs: Update README.md - remove outdated / incorrect quickstart links / ins… (#301) (2dbca15)
• dpop: respect dpop disabled flag in oidc access token class methods (#299) (24319f7)
• keySplitInfo Promise.any Promise.all (#379) (c6cdbef)
• lib: Adds a 10 MiB cap to manifest size (#353) (e775ba5)
• logs: Improves on decrypt unsafe fail (#303) (4efa118)
• nano: Allow padding of kids (#338) (e1ae891)
• nano: ecdsa policy binding support for encrypt (#346) (031bbb7)
• nano: resource locator kid parse issue (#330) (4eef553)
• nano: Store kid (#334) (63721f6)
• Remove environment logging in vite.config.ts (#373) (d1e0a45)
• Rewrap response handling typo (#372) (5add5aa)
• sdk: bump koa from 2.15.4 to 2.16.1 in /lib (#534) (57c6d69)
• sdk: bump uuid from 11.0.5 to 11.1.0 in /lib (#432) (3898e45)
• sdk: Bump version no. to 0.3.2 (#536) (5924bc9)
• sdk: calculate the length of ecdsa binding (#327) (69e0a81)
• sdk: Disable concurrency on rewrap (#388) (beb3c06)
• sdk: Don't set schemaV in older target specs (#531) (eed7545)
• sdk: Enable support for more KAS key types (#624) (35c9777)
• sdk: Fix assertion output for legacy mode (#533) (d54d777)
• sdk: Fix for queries to older platforms (#570) (f6ccc10)
• sdk: Fixes generating ztdf 4.2.2 output (#530) (ab42e5a)
• sdk: Let pools take callables. (#390) (75ca10c)
• sdk: Lets new API set nano binding type (#455) (26879ef)
• sdk: npm audit fix (#410) (840fd29)
• sdk: Remove AttributeSet (#489) (fa5a98d)
• sdk: Remove stray call to node:Buffer (#365) (f851c02)
• sdk: Removes ntdf version header (#488) (f657181)
• sdk: Sets schemaVersion, not tdf_spec_version (#414) (74d326b)
• sdk: support hex encoding signature hash for legacy sdk (#520) (b08158a)
• sdk: Update ec-wrapped salt value (#464) (86142ba)
• sdk: Updates preferred node to 22 (#408) (a173579)
• sdk: Updates to eslint, and fixes from that (#423) (fa9271d)
• sequential requests instead of promise.all (#339) (2e81fcb)
• session.ts Prototype-polluting assignment (#377) (94993bc)
• use new policy binding format (#312) (5e234ee)

---

This PR was generated with Release Please. See documentation.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud