Tags: Natuvea/libsignal

v0.97.4

- Typed APIs
  - AuthAccountsService.setRegistrationLock()
  - AuthAccountsService.clearRegistrationLock()
  - AuthAccountsService.setDiscoverableByPhoneNumber()
  - AuthAccountsService.setRegistrationRecoveryPassword()
  - UnauthBackupsService.copyBackupMedia()

- node: Add full-er service SVR2 APIs that performs necessary crypto operations inside libsignal.
- Add `SvrKey`, which provides derivations for registration lock, registration recovery, storage service, and logging keys.
- Update to nightly-2026-07-15 rust toolchain to address miscompile rust-lang/rust#159035

v0.97.3

- Add AuthUsernamesService.deleteUsernameHash()
- Add AuthUsernamesService.deleteUsernameLink()
- Swift: Reclassify transport errors for an established chat connection as retryable (`.ioError`)

v0.97.2

- Internal: Fix a problem with the NPM release job. This release is NPM only.

v0.97.1

- Add AuthDeviceService.removeDevice() typed API

v0.97.0

- Add AuthUsernameService.setUsernameLink() typed API
- Add AuthDeviceService.getDevices() typed API
- Add AuthDeviceService.setPushToken() typed API (Java and Swift only)
- Add AuthDeviceService.clearPushToken() typed API
- Java: AuthDeviceService.setDeviceName() now takes DeviceId instead of an Int
- Enforce a minimum TCB level for all SGX attestations.
- RegistrationService now also refreshes its cached session state from rate-limited (429) server responses.
- Update to JDK21, following Android. It is now the _required_ version to build libsignal for Java! However, since it
  has been out for some time this change should not be a problem in practice.
- ChatConnection: server alerts may be delivered (via the callback in ChatConnectionListener) slightly later than before; previously they were guaranteed to be delivered as part of the `start` call (Java and Swift) or `connect` operation (Node). They will still be delivered before any messages.

v0.96.4

- node: Expose the registration session state as an optional `sessionState`
  payload on some errors.

- RegistrationService now refreshes its cached session state from failed
  verification requests, so the session state stays current even after a request
fails.

- node, swift: Expose DonationPermit.expiration

- Expose and document several APIs on UnauthBackupsService originally added in
  libsignal v0.94.4. These APIs require an H2 connection (the normal behavior
when using libsignal now) and will fail without one.

- SVR2: update production to 2026Q2

- SVRB: update production to 2026Q2

- Add reserveUsernameHash() typed API

v0.96.3

- node: Generate attestation for published packages

- Add setDeviceName() typed API

- protocol: Fix encoded type byte for ML-KEM-1024 keys and ciphertexts (previously they were misidentified as Kyber-1024, which is wire-compatible but with a different interpretation). Fortunately ML-KEM-1024 is not currently used by Signal in this way, so there will be no actual keys or ciphertexts with the "wrong" value on real devices.

v0.96.2

- Expose DonationPermit to clients

v0.94.5

- zkgroup: Add AvatarUploadCredential, an anonymous credential used to rate-limit avatar uploads.

- Several new requests have been added to UnauthBackupsService; however, they are only usable when an H2 connection is guaranteed, and should not be adopted otherwise.

- node: Implement a full-service SVR2 client API

- Rust: `SignalProtocolError::InvalidMessage` now has a `String` description instead of just `&'static str`.

v0.96.1

- Node: Custom registration errors