RC 59

Features

• Support new encryption model using 2L-KMS #2191 , #2192 , #2210
• Update identity verification flow #2193 , #2194 , #2200 , #2201 , #2205 , #2206
• Add support for LexisNexis as an identity verification vendor #2198
• Enable PIV/CAC on per agency basis #2148 , #2197
• Add CloudHSM and automate key generation #2159 , #2202

Bugs and Enhancements

• Add 849 and 829 area codes for Dominican Republic #2196
• Fix visual bug on phone input #2190
• Update edit phone screen to use new phone input #2195
• Upgrade file encryptor to work with gpg2 #2199
• Add proofer information to result and analytics #2207
• Switch queuing from sidekiq to inline by default. #2208
• Fix CircleCI build caching issue #2211

New Service Providers and updates to existing ones

• move.mil #2209
• SAM.gov #2212, #2213

RC 58

Features

• Allow PIV/CAC as 2FA during login #2142, #2188
• Manage PIV/CAC association in account #2128
• Add reCAPTCHA to account creation and password reset screens #2136, #2160

Bugs and Enhancements

• Add more testing for PIV/CAC feature #2157
• Default recaptcha to off and whitelist it for unsafe-inline #2160
• Prefix email confirmation event with use registration label #2181
• Exclude events with invalid tokens #2153
• Disallow indexing of certain pages #2151
• Update gems with bummr #2173
• Automate release management #2080
• Sanitize Ahoy headers and cookies #2165
• Make tests compatible with zeus #2158
• Add script to create test accounts #1860

New Service Providers and updates to existing ones

• Add move.mil and DOT SPs to production #2183

RC 57

Bugs and Enhancements

• Use XHR transport mechanism for analytics #2143
• Update links from IDP to support documentation #2140
• Add new Spanish and French translations for some text #2138
• Fix issue where poisoned urls could cause redirects to a different host #2139
• Clarify invalid OIDC token error message #2133
• Fix issue with 500 error that occasionally occurred during SAML SLO #2125
• Regenerate visit ID after user logs out in analytics #2120
• Clean up dead code from agency UUID migration #2124
• Clean up code resulting from one time email alert about password policy changes #2123
• Allow analytics to capture bot events in lower environments #2129
• New Service Providers and updates to existing ones
• Add secret service PIX SP #2145

RC 56

Features

Allow authenticator app setup during signup #2061
Add ability to remember a phone for 2FA #2063

Bugs and Enhancements

Break trailing comma cop into hash and array cop #2054
Turn on agency based UUIDs #2076
Add the uuid for a x509 subject to the users table #2086
Remove vendor session id from idv session and proofing flow #2089
Log user out when deleting account #2091
Add temporary mailer #2093
Library updates #2100, #2111, #2115
Replace Poltergeist/PhantomJS with Headless Chrome #2108
Create user Event when password is changed #2114
Added and updated specs #2090, #2092, #2094, #2095, #2097, #2101, #2102, #2103, #2104, #2106, #2107, #2112

New Service Providers and updates to existing ones

Update NGA and DOT SPs #2096
Update DOT Portal cert #2117

RC 55

Bugs and Enhancements

• LG-142 Password reset should count as email confirmation #2079
• LG-166 Use proper rotation path suffix in SAML metadata #2083
• Code optimization and library updates #2081, #2078, #2077, #2075, #2074, #2073, #2071, #2069, #2068, #2067, #2060

New Service Providers and updates to existing ones

• Change name of CBP OARS to ROAM #2066
• Add NGA SPs #2082
• Update NGA SP URLs #2084
• Add USDA SP logo #2070

RC 54

Bugs and Enhancements

• Fixed bug related to Puerto Rican phone numbers #2058
• Improvements to account deletion #2062, #2064
• Code optimization and library updates #2052, #2056, #2057

New Service Providers

• Add OIDC Dashboard config #2049
• Sample client for Go #2031

RC 53

Bugs and Enhancements

• Show OTP expiration to user in application #2048
• Add additiional security layer for voice OTP delivery #2047
• Validate that phone numbers appear valid before allowing OTP submission #2034
• Improved email configuration to help avoid spam filtering #2038
• Improved email address configuration and handling #2043
• Add task to create readonly database user and config #2040 & #1996

RC 52.5

Features

• Added account delete feature #2001
• Added better analytics to help evaluate system performance #2030

Bugs and Enhancements

• Resolved an issue where a user would receive a timeout too early / late if their system clock was wrong #2035
• Resolved an issue where an invalid voice OTP code could generate a 500 error #2036
• Increased OTP expiration to 10 minutes #2029
• Improved input form for entering international phone numbers #2033
• Upgraded libraries for security enhancements #2032

RC 52

Features

• Require users to verify attributes when signing into an SP if they are signing in for the first time or new attributes are requested #2002
• Allow SAML certificates to be rotated #1977

Bugs and Enhancements

• Make AWS email region configurable #2021
• Changes to app to allow for more seamless horizontal scaling #2020 #2019
• Changes to encryption logic to remove unnecessary scrypt computation #2017
• Added instrumentation for analyzing long running method calls when sending email #2015
• Quit sending confirmation emails to users who are attempting to change their email to their current email address #2013
• Adjust styling on error pages #2010
• Update list of states supported in state id proofing flow #2008 #2007
• Update dependencies with security patches #2006
• Clean additional user data from error alerts #1994
• Prevent a backend error from occurring when failing to match a state id number during state id proofing step #1993
• Add a database task to enable agency based UUIDs #1991
• Code cleanup #1990 #1984
• Add deploy scripts to decouple build process from infrastructure provisioning #1989
• Fix issue where the app would not start within a Docker container #1976
• Fast frontend asset compilation #1835

RC 50 Patch 2

Bugs and Enhancements

• Reduce errors caused by improperly encoded form inputs #1954
• Verify that users are authenticated before assigning them a personal key #1968