CHANGELOG.md

Changelog

[0.9.5] - 2026-08-03

What's Changed

• feat: test to ensure rejection of dual audiences by @paolodamico in #220
• fix: performant byte handling & minor sec improvements by @paolodamico in #217
• fix: hash full /v1 request path for attestation JTI validation by @SeanROlszewski in #227
• feat: specify aud for apple oidc & support all clients by @paolodamico in #221

New Contributors

• @SeanROlszewski made their first contribution in #227

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.9.4...0.9.5

[0.9.4] - 2026-07-16

What's Changed

• feat: validate attestation gateway even on disabled by @paolodamico in #213

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.9.3...0.9.4

[0.9.3] - 2026-07-15

What's Changed

• fix: provide claim details on attest failures by @paolodamico in #211

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.9.2...0.9.3

[0.9.2] - 2026-07-14

What's Changed

• chore(deps): bump uuid from 1.16.0 to 1.23.0 by @dependabot[bot] in #199
• chore(deps): bump mockito from 1.7.1 to 1.7.2 by @dependabot[bot] in #198
• chore(deps): bump tower-http from 0.6.7 to 0.6.8 by @dependabot[bot] in #197
• chore(deps): bump aws-sdk-s3 from 1.127.0 to 1.128.0 by @dependabot[bot] in #196
• chore: default enable attestation gateway by @aurel-fr in #204
• chore(deps): bump axum from 0.8.1 to 0.8.8 by @dependabot[bot] in #200
• chore: address rustsec advisories by @paolodamico in #206
• Release 0.9.1 by @github-actions[bot] in #207
• ci by @aurel-fr in #208
• chore: address RUSTSEC-2026-0048 by @paolodamico in #209

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.9.0...0.9.2

[0.9.1] - 2026-07-10

What's Changed

• chore(deps): bump uuid from 1.16.0 to 1.23.0 by @dependabot[bot] in #199
• chore(deps): bump mockito from 1.7.1 to 1.7.2 by @dependabot[bot] in #198
• chore(deps): bump tower-http from 0.6.7 to 0.6.8 by @dependabot[bot] in #197
• chore(deps): bump aws-sdk-s3 from 1.127.0 to 1.128.0 by @dependabot[bot] in #196
• chore: default enable attestation gateway by @aurel-fr in #204
• chore(deps): bump axum from 0.8.1 to 0.8.8 by @dependabot[bot] in #200
• chore: address rustsec advisories by @paolodamico in #206

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.9.0...0.9.1

[0.9.0] - 2026-05-26

What's Changed

• chore(deps): bump reqwest from 0.12.23 to 0.12.24 by @dependabot[bot] in #170
• fix: backup keys are on the secp256k1 curve by @paolodamico in #193
• chore: add localstack token by @paolodamico in #195
• Add support for multiple clients by @ketzusaka in #201

New Contributors

• @ketzusaka made their first contribution in #201

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.8.5...0.9.0

[0.8.5] - 2026-03-06

What's Changed

• chore(deps): bump tokio from 1.48.0 to 1.49.0 by @dependabot[bot] in #190
• chore(deps): bump chrono from 0.4.40 to 0.4.44 by @dependabot[bot] in #189
• fix: always lowercase manifest hash by @paolodamico in #169
• chore(tfh-backup): fix ECDSA DER signature length validation by @nme-mvasylenko in #185
• feat: expose /metrics endpoint via axum-prometheus by @nme-mvasylenko in #191
• chore(deps): bump serde from 1.0.219 to 1.0.228 by @dependabot[bot] in #172

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.8.4...0.8.5

[0.8.4] - 2026-02-17

What's Changed

• feat: introduce verify factor endpoint by @paolodamico in #186

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.8.3...0.8.4

[0.8.3] - 2026-02-12

What's Changed

• feat: introduce /reset endpoint by @paolodamico in #176
• chore(tfh-backup): bump rust to 1.91, configure ConnectionManager timeouts by @nme-mvasylenko in #183

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.8.2...0.8.3

[0.8.2] - 2026-02-04

What's Changed

• feat: improve multipart request handling by @paolodamico in #179
• chore(deps): bump tracing from 0.1.41 to 0.1.44 by @dependabot[bot] in #173
• chore(deps): bump serde_json from 1.0.143 to 1.0.148 by @dependabot[bot] in #171
• chore(tfh-backup): enable TLS support for Redis connections by @nme-mvasylenko in #181
• chore(deps): bump mockito from 1.7.0 to 1.7.1 by @dependabot[bot] in #158

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.8.1...0.8.2

[0.8.1] - 2026-01-29

What's Changed

• Update GH workflows to use public runner groups by @ernish in #168
• chore(deps): bump openidconnect from 4.0.0 to 4.0.1 by @dependabot[bot] in #159
• feat: improve max file size handling by @paolodamico in #177

New Contributors

• @ernish made their first contribution in #168

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.8.0...0.8.1

[0.8.0] - 2025-12-09

What's Changed

• feat: debug invalid oidc tokens by @paolodamico in #165
• chore: MIT license by @paolodamico in #166

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.7.12...0.8.0

[0.7.12] - 2025-12-08

What's Changed

• fix: docker hub login CI by @paolodamico in #162
• chore(deps): bump tokio from 1.47.1 to 1.48.0 by @dependabot[bot] in #157
• chore(deps): bump async-trait from 0.1.88 to 0.1.89 by @dependabot[bot] in #160
• chore(deps): bump tower-http from 0.6.6 to 0.6.7 by @dependabot[bot] in #156
• feat: improve errors for failed signature by @paolodamico in #163

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.7.11...0.7.12

[0.7.11] - 2025-12-02

What's Changed

• feat: return backup meta on creation by @paolodamico in #154
• chore(e2e): attestation token support to E2E test script by @nme-mvasylenko in #151

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.7.10...0.7.11

[0.7.10] - 2025-11-20

What's Changed

• feat: return metadata on endpoints by @paolodamico in #152
• feat: add support for SSE on S3 bucket by @paolodamico in #150

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.7.9...0.7.10

[0.7.9] - 2025-11-10

What's Changed

• feat: expose credential_id for passkeys by @paolodamico in #146
• feat: backup status endpoint by @paolodamico in #147
• fix!: update backup ID requirements by @paolodamico in #148

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.7.8...0.7.9

[0.7.8] - 2025-10-27

What's Changed

• fix: only verify passkey challenge for existing Turnkey by @paolodamico in #143
• feat: improved error messages by @paolodamico in #144

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.7.7...0.7.8

[0.7.7] - 2025-10-23

What's Changed

• feat!: improvements to deletion process by @paolodamico in #139
• fix: tiny log improvements & use Docker Hub token for CI by @paolodamico in #140
• feat: only allow one key per type by @paolodamico in #141

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.7.6...0.7.7

[0.7.6] - 2025-10-16

What's Changed

• feat: add backup_deleted to /delete-factor by @paolodamico in #123
• feat: update encoding for turnkey nonce by @paolodamico in #126
• feat: improve logging by @paolodamico in #127
• chore(deps): bump thiserror from 2.0.12 to 2.0.17 by @dependabot[bot] in #125
• chore(deps): bump aws-sdk-kms from 1.63.0 to 1.65.0 by @dependabot[bot] in #124
• fix: don't log /health requests by @paolodamico in #128
• feat: improve logging of spans by @paolodamico in #129
• feat!: client-provided backup account id by @paolodamico in #130
• fix: prevent encryption key removal when not appropriate by @paolodamico in #131
• feat: allow providing a label for passkeys by @paolodamico in #132
• feat: only keep masked_email by @paolodamico in #133
• fix: spans aren't dropped correctly by @paolodamico in #134
• feat: return explicit error codes for when the backup cannot be found by @paolodamico in #135

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.7.5...0.7.6

[0.7.5] - 2025-09-22

What's Changed

• chore: push and attest Docker image to GH registry by @paolodamico in #112
• Release 0.7.1 by @github-actions[bot] in #113
• fix: unify crate versioning by @paolodamico in #114
• Release 0.7.2 by @github-actions[bot] in #116
• fix: fix docker build by @paolodamico in #117
• Release 0.7.3 by @github-actions[bot] in #118
• fix: remove duplicate worldcoin prefix for GH package by @paolodamico in #119
• Release 0.7.4 by @github-actions[bot] in #120
• fix: continue on attestation failure by @paolodamico in #121

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.7.0...0.7.5

[0.7.4] - 2025-09-22

What's Changed

• chore: push and attest Docker image to GH registry by @paolodamico in #112
• Release 0.7.1 by @github-actions[bot] in #113
• fix: unify crate versioning by @paolodamico in #114
• Release 0.7.2 by @github-actions[bot] in #116
• fix: fix docker build by @paolodamico in #117
• Release 0.7.3 by @github-actions[bot] in #118
• fix: remove duplicate worldcoin prefix for GH package by @paolodamico in #119

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.7.0...0.7.4

[0.7.3] - 2025-09-19

What's Changed

• chore: push and attest Docker image to GH registry by @paolodamico in #112
• Release 0.7.1 by @github-actions[bot] in #113
• fix: unify crate versioning by @paolodamico in #114
• Release 0.7.2 by @github-actions[bot] in #116
• fix: fix docker build by @paolodamico in #117

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.7.0...0.7.3

[0.7.2] - 2025-09-19

What's Changed

• chore: push and attest Docker image to GH registry by @paolodamico in #112
• Release 0.7.1 by @github-actions[bot] in #113
• fix: unify crate versioning by @paolodamico in #114

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.7.0...0.7.2

[0.7.1] - 2025-09-19

What's Changed

• chore: push and attest Docker image to GH registry by @paolodamico in #112

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.7.0...0.7.1

[0.7.0] - 2025-09-18

What's Changed

• chore(deps): bump tokio from 1.44.2 to 1.46.1 by @dependabot[bot] in #84
• chore: bump version to 0.6.0 by @paolodamico in #91
• chore(deps): bump strum from 0.27.1 to 0.27.2 by @dependabot[bot] in #85
• chore(deps): bump aws-sdk-s3 from 1.79.0 to 1.82.0 by @dependabot[bot] in #86
• feat!: backup manifest updates by @paolodamico in #93
• chore(deps): bump reqwest from 0.12.22 to 0.12.23 by @dependabot[bot] in #95
• chore(deps): bump tokio from 1.46.1 to 1.47.1 by @dependabot[bot] in #94
• fix: exponential backoff on S3 tests & bump tracing-subscriber by @paolodamico in #100
• chore(deps): bump serde_json from 1.0.140 to 1.0.143 by @dependabot[bot] in #98
• feat!: simplify retrieve metadata response by @paolodamico in #99
• feat: add Aug 4 Anvil audit summary by @paolodamico in #90
• feat!: add Redis and update lock to prevent race conditions by @paolodamico in #103
• feat: redis cache manager by @paolodamico in #104
• feat: add World App's apple client id by @lukejmann in #105
• chore(ci): dynamodb table name env var by @nme-mvasylenko in #106
• chore(e2e-tests): fix e2e test script by @nme-mvasylenko in #107
• chore: bump Rust to 1.89.0 (stable) by @paolodamico in #109
• fix: release workflow by @paolodamico in #110

New Contributors

• @lukejmann made their first contribution in #105

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.6.0...0.7.0

[0.6.0] - 2025-08-13

What's Changed

• feat: attestation token in backup retrieval by @paolodamico in #60
• feat: add build version to health check by @paolodamico in #62
• feat: add changelog and deliberate release process by @paolodamico in #63
• feat: general clean up, linting & housekeeping by @paolodamico in #64
• feat: abstract test utils by @paolodamico in #65
• chore: add git revision build arg by @nme-mvasylenko in #68
• feat: slimify docker, single statically linked binary by @paolodamico in #66
• feat: delete sync factor by @paolodamico in #67
• feat: ensure atomicity of updating backup metadata with etags by @paolodamico in #69
• feat: security best practices by @paolodamico in #71
• feat: sync factor integration failure tests & todo clean up by @paolodamico in #70
• chore(deps): bump public-suffix from 0.1.2 to 0.1.3 by @dependabot[bot] in #77
• chore(deps): bump reqwest from 0.12.20 to 0.12.22 by @dependabot[bot] in #74
• chore(deps): bump aws-config from 1.6.0 to 1.6.1 by @dependabot[bot] in #76
• feat: delete backup endpoint by @paolodamico in #78
• chore(deps): bump anyhow from 1.0.97 to 1.0.98 by @dependabot[bot] in #73
• feat: api versioning by @aurel-fr in #80
• feat: improvements to delete factor by @paolodamico in #79
• feat!: enforce explicit scope in /delete-factor by @paolodamico in #83
• feat!: release attestation enforcement by @paolodamico in #82
• feat: ready endpoint by @paolodamico in #81
• fix: factor scope serialization in docs by @paolodamico in #87
• fix: /ready endpoint should be GET by @paolodamico in #88
• feat: refactor auth handling to remove duplicated logic by @paolodamico in #89

New Contributors

• @dependabot[bot] made their first contribution in #77

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.5.0...0.6.0

[0.5.0] - 2025-06-24

What's Changed

• feat: abstract authentication by @paolodamico in #50
• refactor: authhandler as an extension service by @paolodamico in #51
• general improvements & TODOs by @paolodamico in #52
• feat: cache jwk set by @aurel-fr in #54
• feat: safe parser for webauthn credentials by @aurel-fr in #55
• feat: attestation gateway by @aurel-fr in #56
• feat: Apple OIDC provider by @aurel-fr in #57
• prevent OIDC nonce re-use by @paolodamico in #53
• feat: increase max backup size to 10MB by @paolodamico in #59

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.4.0...0.5.0

[0.4.0] - 2025-06-04

What's Changed

• feat(delete-factor): add support to delete encryption key (#49)
• feat(delete-factor): add support to delete encryption key
• fix ci test

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.3.0...0.4.0

[0.3.0] - 2025-06-01

What's Changed

• feat: verify OIDC nonce with keypair public key (#43)

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.2.0...0.3.0

[0.2.0] - 2025-05-23

What's Changed

• feat: add factor endpoint (#38)

Full Changelog: https://github.com/worldcoin/backup-service/compare/0.1.0...0.2.0

[0.1.0] - 2025-05-14

What's Changed

• Initial version. Not ready for production use.