# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

As of December 2025 and until the 1.0.0 version is released, the CAI team will only make minor version changes (incrementing the `x` in `0.x.0`) if breaking changes are made. Features will now result in a patch version change (incrementing the `y` in `0.x.y`). This brings us into closer compliance with typical SemVer practice (and follows the default behavior of [`release-plz`](https://release-plz.dev/docs/config#the-features_always_increment_minor-field).

## [Unreleased]

## [0.89.3](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.89.2...c2pa-v0.89.3)
_13 July 2026_

### Documented

* Fix docs build, take 2 ([#2297](https://github.com/contentauth/c2pa-rs/pull/2297))
* Fix docs build ([#2296](https://github.com/contentauth/c2pa-rs/pull/2296))

### Fixed

* Harden against integer underflow attacks in PNG iTxt chunks XMP parsing ([#2274](https://github.com/contentauth/c2pa-rs/pull/2274))
* Harden against integer overflow attacks in BMFF parser ([#2280](https://github.com/contentauth/c2pa-rs/pull/2280))
* Resource_to_stream returns error for unknown resource URIs instead of manifest JUMBF ([#2289](https://github.com/contentauth/c2pa-rs/pull/2289)) ([#2290](https://github.com/contentauth/c2pa-rs/pull/2290))

## [0.89.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.89.1...c2pa-v0.89.2)
_09 July 2026_

### Fixed

* Bind OCSP response certId to the signing certificate (CAI-11829) ([#2273](https://github.com/contentauth/c2pa-rs/pull/2273))
* Fix new Clippy warnings for Rust 1.97.0 ([#2279](https://github.com/contentauth/c2pa-rs/pull/2279))
* Ensure created has a dst and don't add parent when actions already exist ([#2264](https://github.com/contentauth/c2pa-rs/pull/2264))
* Integer overflow panic in bmff_to_jumbf_exclusions via DataMap offset addition ([#2263](https://github.com/contentauth/c2pa-rs/pull/2263))

## [0.89.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.89.0...c2pa-v0.89.1)
_07 July 2026_

### Documented

* Update README.md doc links ([#2261](https://github.com/contentauth/c2pa-rs/pull/2261))

### Fixed

* Resolve crate audit advisories (lopdf, quick-xml, crossbeam-epoch, ttf-parser) ([#2268](https://github.com/contentauth/c2pa-rs/pull/2268))
* Don't serialize empty values ([#2254](https://github.com/contentauth/c2pa-rs/pull/2254))
* CAI-10364 (Server-Side Request Forgery (SSRF) via CAWG did:web Resolution during Post-Validation ) ([#2168](https://github.com/contentauth/c2pa-rs/pull/2168))

### Other

* Lazy load all ingredient resources & remove old to_archive zip format. ([#2173](https://github.com/contentauth/c2pa-rs/pull/2173))

## [0.89.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.88.0...c2pa-v0.89.0)
_19 June 2026_

### Added

* Add source to `HttpResolverError::Other` error message ([#2237](https://github.com/contentauth/c2pa-rs/pull/2237))
* Auto format detect for Reader ([#2181](https://github.com/contentauth/c2pa-rs/pull/2181))

### Fixed

* Harden JUMBF and JPEG XL parsers against Brotli decompression bombs ([#2210](https://github.com/contentauth/c2pa-rs/pull/2210))

## [0.88.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.87.0...c2pa-v0.88.0)
_11 June 2026_

### Added

* Remove some long deprecated APIs ([#2206](https://github.com/contentauth/c2pa-rs/pull/2206))

## [0.87.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.86.1...c2pa-v0.87.0)
_11 June 2026_

### Added

* [**breaking**] Split c2pa-raw-crypto into its own crate ([#2202](https://github.com/contentauth/c2pa-rs/pull/2202))

### Fixed

* Improve ingredientMismatch error messages ([#2225](https://github.com/contentauth/c2pa-rs/pull/2225))
* Noop test new release workflow ([#2221](https://github.com/contentauth/c2pa-rs/pull/2221))

### Other

* Revert "feat!: Split c2pa-raw-crypto into its own crate ([#2202](https://github.com/contentauth/c2pa-rs/pull/2202))"
* Use latest `release-plz` and add a dry run job on release PRs ([#2217](https://github.com/contentauth/c2pa-rs/pull/2217))

## [0.86.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.86.0...c2pa-v0.86.1)
_08 June 2026_

### Fixed

* NOOP PR for release-plz trigger ([#2215](https://github.com/contentauth/c2pa-rs/pull/2215))

## [0.86.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.85.2...c2pa-v0.86.0)
_04 June 2026_

### Fixed

* [**breaking**] Remove unused `Error` variant types ([#2195](https://github.com/contentauth/c2pa-rs/pull/2195))
* Harden additional JUMBF parser sites against integer underflow ([#2201](https://github.com/contentauth/c2pa-rs/pull/2201))

## [0.85.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.85.1...c2pa-v0.85.2)
_03 June 2026_

### Fixed

* Exact ingredient redaction URI matching ([#2203](https://github.com/contentauth/c2pa-rs/pull/2203))
* Harden against integer underflow in JUMBF box parsers ([#2200](https://github.com/contentauth/c2pa-rs/pull/2200))
* Dup redaction ([#2199](https://github.com/contentauth/c2pa-rs/pull/2199))
* Harden against unchecked array index in JUMBF brotli box accessor ([#2192](https://github.com/contentauth/c2pa-rs/pull/2192))
* Make GIF box map C2PA placeholder len 0 rather than 1 ([#2156](https://github.com/contentauth/c2pa-rs/pull/2156))
* Error with validation results on invalid manifest after verify after sign ([#2147](https://github.com/contentauth/c2pa-rs/pull/2147))

## [0.85.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.85.0...c2pa-v0.85.1)
_01 June 2026_

### Fixed

* Preserve validation status log kind after deserialization ([#2162](https://github.com/contentauth/c2pa-rs/pull/2162))
* Declare c2pa XML namespace on SVG root, not manifest tag ([#2113](https://github.com/contentauth/c2pa-rs/pull/2113))

### Other

* Avoid buffering intermediate streams if stream len is greater than threshold ([#2178](https://github.com/contentauth/c2pa-rs/pull/2178))
* Avoid buffering PNG when writing XMP and removing manifest ([#2177](https://github.com/contentauth/c2pa-rs/pull/2177))

## [0.85.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.84.1...c2pa-v0.85.0)
_27 May 2026_

### Added

* Support CAWG callback signing via c_ffi ([#2118](https://github.com/contentauth/c2pa-rs/pull/2118))

### Fixed

* Sync resolver for CAWG web DID ([#2172](https://github.com/contentauth/c2pa-rs/pull/2172))
* Load ingredient manifest store esp. to load resources on search/load miss ([#2164](https://github.com/contentauth/c2pa-rs/pull/2164))
* Share reqwest HTTP clients ([#2152](https://github.com/contentauth/c2pa-rs/pull/2152))
* Improve archive APIs to be able to link archives to actions ([#2095](https://github.com/contentauth/c2pa-rs/pull/2095))
* Use XMP instance_id from source asset in sign and save_to_stream ([#2158](https://github.com/contentauth/c2pa-rs/pull/2158))
* Harden against Builder::base_path injection attack on archive deserialisation ([#2139](https://github.com/contentauth/c2pa-rs/pull/2139))
* Harden against integer overflow attacks in hash_stream_by_alg_with_progress range validation ([#2140](https://github.com/contentauth/c2pa-rs/pull/2140))

### Other

* Skip intermediate stream copy for common signing path ([#2161](https://github.com/contentauth/c2pa-rs/pull/2161))
* Avoid buffering PNG into memory when writing ([#2159](https://github.com/contentauth/c2pa-rs/pull/2159))
* Avoid buffering stream when computing placeholder PNG C2PA chunk ([#2154](https://github.com/contentauth/c2pa-rs/pull/2154))
* Avoid buffering stream when computing placeholder JPEG C2PA chunk ([#2155](https://github.com/contentauth/c2pa-rs/pull/2155))
* Fix lints in newer Rust versions. ([#2153](https://github.com/contentauth/c2pa-rs/pull/2153))
* Optimize signing passes/copies for large PNGs ([#1967](https://github.com/contentauth/c2pa-rs/pull/1967))
* Optimize signing passes/copies for large RIFFs ([#1970](https://github.com/contentauth/c2pa-rs/pull/1970))
* Optimize signing passes/copies for large JPEGs ([#1971](https://github.com/contentauth/c2pa-rs/pull/1971))
* Lazy-load ingredient manifest stores from shared Arc<Store>  ([#2103](https://github.com/contentauth/c2pa-rs/pull/2103))
* Consolidate embeddable async functions ([#2149](https://github.com/contentauth/c2pa-rs/pull/2149))
* Consolidate async verify functions ([#2146](https://github.com/contentauth/c2pa-rs/pull/2146))

## [0.84.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.84.0...c2pa-v0.84.1)
_12 May 2026_

### Fixed

* Case-insensitive enums in settings to preserve backwards compatibility with `config` crate ([#2138](https://github.com/contentauth/c2pa-rs/pull/2138))

## [0.84.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.83.0...c2pa-v0.84.0)
_11 May 2026_

### Fixed

* Archive preserves duplicate label assertions ([#2135](https://github.com/contentauth/c2pa-rs/pull/2135))

### Other

* [**breaking**] Remove `config` crate and use `serde_json` directly ([#2132](https://github.com/contentauth/c2pa-rs/pull/2132))

## [0.83.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.82.1...c2pa-v0.83.0)
_11 May 2026_

### Added

* Large and complex benchmark suite ([#2116](https://github.com/contentauth/c2pa-rs/pull/2116))

### Fixed

* Reduce allocations in redactions ([#2127](https://github.com/contentauth/c2pa-rs/pull/2127))
* Allow boxes with incomplete content to succeed. ([#2125](https://github.com/contentauth/c2pa-rs/pull/2125))

### Other

* Update `cargo-udeps` setup ([#2047](https://github.com/contentauth/c2pa-rs/pull/2047))

## [0.82.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.82.0...c2pa-v0.82.1)
_04 May 2026_

### Fixed

* Harden against integer underflow attack in GIF XMP validation ([#2099](https://github.com/contentauth/c2pa-rs/pull/2099))
* Harden error code mapping for hash mismatch in validator ([#2101](https://github.com/contentauth/c2pa-rs/pull/2101))
* Update logic for stale thumbnails detection in redaction ([#2107](https://github.com/contentauth/c2pa-rs/pull/2107))

## [0.82.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.81.0...c2pa-v0.82.0)
_01 May 2026_

### Fixed

* Harden against unbounded HTTP response body read in DID web server ([#2070](https://github.com/contentauth/c2pa-rs/pull/2070))

## [0.81.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.80.3...c2pa-v0.81.0)
_01 May 2026_

### Added

* Make `c2pa_reason` an enum ([#2100](https://github.com/contentauth/c2pa-rs/pull/2100))

### Fixed

* Harden against integer underflow attacks in parsing purpose field in BMFF UUID box ([#2097](https://github.com/contentauth/c2pa-rs/pull/2097))
* Harden against integer overflow attack in png chunk hashing for 32 bit WASM architecture ([#2102](https://github.com/contentauth/c2pa-rs/pull/2102))
* [**breaking**] Use absolute URIs for ingredient thumbnails ([#2098](https://github.com/contentauth/c2pa-rs/pull/2098))

## [0.80.3](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.80.2...c2pa-v0.80.3)
_29 April 2026_

### Added

* Support DNG big data ([#2092](https://github.com/contentauth/c2pa-rs/pull/2092))
* Add `init trust`, trust sidecars, and atomic sidecar writes, plus fixes ([#2093](https://github.com/contentauth/c2pa-rs/pull/2093))

### Updated dependencies

* Bump openssl from 0.10.77 to 0.10.78 ([#2082](https://github.com/contentauth/c2pa-rs/pull/2082))

## [0.80.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.80.1...c2pa-v0.80.2)
_28 April 2026_

### Documented

* Adds redaction docs and example ([#2071](https://github.com/contentauth/c2pa-rs/pull/2071))

### Fixed

* `c2pa-c-ffi` UB detected by miri ([#2089](https://github.com/contentauth/c2pa-rs/pull/2089))
* Harden RSA validators against invalid BER sequences ([#2065](https://github.com/contentauth/c2pa-rs/pull/2065))
* Harden against deep linear ingredient chains with max limits ([#2064](https://github.com/contentauth/c2pa-rs/pull/2064))
* Harden BMFF hash merkel tree creation with max merkel leaves limits ([#2063](https://github.com/contentauth/c2pa-rs/pull/2063))
* Harden against image decompression bomb attacks in building thumbnail ([#2062](https://github.com/contentauth/c2pa-rs/pull/2062))
* Harden tiff parser against forged IFD entry count fields ([#2059](https://github.com/contentauth/c2pa-rs/pull/2059))
* Harden builder and resource store addition against path traversal zip slip attacks ([#2066](https://github.com/contentauth/c2pa-rs/pull/2066))

## [0.80.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.80.0...c2pa-v0.80.1)
_27 April 2026_

### Fixed

* Harden against empty certificates during OCSP certificate validation ([#2067](https://github.com/contentauth/c2pa-rs/pull/2067))
* Prevent duplicate timestamp assertion ([#2085](https://github.com/contentauth/c2pa-rs/pull/2085))
* Harden riff chunk parser against forged size field memory attacks ([#2053](https://github.com/contentauth/c2pa-rs/pull/2053))
* Harden bmff parsing against integer overflow attack ([#2054](https://github.com/contentauth/c2pa-rs/pull/2054))
* Harden against cyclic IFD chain in tiff parser ([#2068](https://github.com/contentauth/c2pa-rs/pull/2068))

## [0.80.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.79.5...c2pa-v0.80.0)
_16 April 2026_

### Added

* Add ingredient archive FFI functions and relax Builder mutability ([#2061](https://github.com/contentauth/c2pa-rs/pull/2061))
* Compressed manifest ([#2027](https://github.com/contentauth/c2pa-rs/pull/2027))

### Documented

* Separate out C docs ([#2052](https://github.com/contentauth/c2pa-rs/pull/2052))

### Fixed

* Multi rendition support ([#2058](https://github.com/contentauth/c2pa-rs/pull/2058))

## [0.79.5](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.79.4...c2pa-v0.79.5)
_15 April 2026_

### Fixed

* Handle more thumbnail redaction edge cases ([#2049](https://github.com/contentauth/c2pa-rs/pull/2049))

## [0.79.4](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.79.3...c2pa-v0.79.4)
_14 April 2026_

### Fixed

* Run cargo fmt ([#2046](https://github.com/contentauth/c2pa-rs/pull/2046))
* Wrap Error::NotImplemented in Err() for wasip1 tempfile_builder ([#2037](https://github.com/contentauth/c2pa-rs/pull/2037))
* Limit the maximum number of assertions allowed for C2PA Manifest ([#1951](https://github.com/contentauth/c2pa-rs/pull/1951))

## [0.79.3](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.79.2...c2pa-v0.79.3)
_09 April 2026_

### Added

* *(sdk)* Ingredient JUMBF archives, archive metadata typing ([#2007](https://github.com/contentauth/c2pa-rs/pull/2007))

### Fixed

* Redaction follow-up fix ([#2030](https://github.com/contentauth/c2pa-rs/pull/2030))

## [0.79.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.79.1...c2pa-v0.79.2)
_08 April 2026_

### Fixed

* Harden against integer overflow panic in big tiff processing ([#2012](https://github.com/contentauth/c2pa-rs/pull/2012))
* Harden against integer underflow panic in assertion label parsing ([#2013](https://github.com/contentauth/c2pa-rs/pull/2013))
* Harden assertion label URI parsing logic to fix index out of bounds access ([#2018](https://github.com/contentauth/c2pa-rs/pull/2018))
* Harden BMFF hash merkle validation via count/range mismatch ([#2019](https://github.com/contentauth/c2pa-rs/pull/2019))
* Harden BmffHash timed media chunk verification against out of bounds access issue ([#2020](https://github.com/contentauth/c2pa-rs/pull/2020))
* Harden BMFF Merkle maps processing logic to avoid panic ([#2021](https://github.com/contentauth/c2pa-rs/pull/2021))
* Harden against invalid MP4 files during BmffHash timed-media chunk mapping ([#2022](https://github.com/contentauth/c2pa-rs/pull/2022))
* Redact thumbnails when ingredient with thumbnails added through add_ingredient is being thumbnail-redacted too ([#2016](https://github.com/contentauth/c2pa-rs/pull/2016))
* Allow any file type to be signed with a sidecar ([#2014](https://github.com/contentauth/c2pa-rs/pull/2014))

## [0.79.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.79.0...c2pa-v0.79.1)
_07 April 2026_

### Fixed

* Redact thumbnails in databoxes (v1 claims) ([#2015](https://github.com/contentauth/c2pa-rs/pull/2015))

## [0.79.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.78.8...c2pa-v0.79.0)
_03 April 2026_

### Fixed

* Redacting things in multiple ingredients ([#2009](https://github.com/contentauth/c2pa-rs/pull/2009))
* Adds more granular progress for validation ([#2006](https://github.com/contentauth/c2pa-rs/pull/2006))
* [**breaking**] Disable HTTP redirects in restricted networking implementation ([#1907](https://github.com/contentauth/c2pa-rs/pull/1907))

## [0.78.8](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.78.7...c2pa-v0.78.8)
_31 March 2026_

### Added

* Expose a C FFI API to help determine the hashtype a Builder uses with embeddable APIs ([#1992](https://github.com/contentauth/c2pa-rs/pull/1992))
* Add support for JPEG XL file format ([#1870](https://github.com/contentauth/c2pa-rs/pull/1870))

### Fixed

* Switch to Firefox for CI web tests ([#1999](https://github.com/contentauth/c2pa-rs/pull/1999))

### Other

* Fix clippy lints ([#1996](https://github.com/contentauth/c2pa-rs/pull/1996))

## [0.78.7](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.78.6...c2pa-v0.78.7)
_27 March 2026_

### Added

* Adds a progress/cancel feature to Context for the c2pa-rs sdk ([#1927](https://github.com/contentauth/c2pa-rs/pull/1927))

### Fixed

* Harden JUMB embed media description box parser against integer underflow attack ([#1950](https://github.com/contentauth/c2pa-rs/pull/1950))
* Harden JUMB description box parser against integer underflow attack ([#1949](https://github.com/contentauth/c2pa-rs/pull/1949))
* Harden JUMBF nested box parsing against stack overflow attack ([#1966](https://github.com/contentauth/c2pa-rs/pull/1966))
* Harden BMFF Merkle tree hash processing code against integer underflow attack ([#1963](https://github.com/contentauth/c2pa-rs/pull/1963))
* Updated crJSON Schema ([#1975](https://github.com/contentauth/c2pa-rs/pull/1975))
* TIFF backcompatibility for RAW formats ([#1976](https://github.com/contentauth/c2pa-rs/pull/1976))
* Check for malicious recursion ([#1979](https://github.com/contentauth/c2pa-rs/pull/1979))

## [0.78.6](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.78.5...c2pa-v0.78.6)
_23 March 2026_

### Added

* Add FLAC format support ([#1912](https://github.com/contentauth/c2pa-rs/pull/1912))

## [0.78.5](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.78.4...c2pa-v0.78.5)
_23 March 2026_

### Added

* Add `cr_json()` and `cr_json_value()` to `Reader`; remove separate `CrJsonReader` ([#1919](https://github.com/contentauth/c2pa-rs/pull/1919))

### Fixed

* Add compatibility for source assets that report mdat box sizes that e… ([#1956](https://github.com/contentauth/c2pa-rs/pull/1956))
* Change `Builder::add_action` to add original actions or v2 actions ([#1946](https://github.com/contentauth/c2pa-rs/pull/1946))

## [0.78.4](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.78.3...c2pa-v0.78.4)
_16 March 2026_

### Fixed

* Pin `atree` to 0.5.2 ([#1940](https://github.com/contentauth/c2pa-rs/pull/1940))
* Remove exponential memory growth from nested claim reconstruction ([#1885](https://github.com/contentauth/c2pa-rs/pull/1885)) ([#1887](https://github.com/contentauth/c2pa-rs/pull/1887))

## [0.78.3](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.78.2...c2pa-v0.78.3)
_13 March 2026_

### Added

* Impl `Send + Sync` on `EphemeralSigner` ([#1934](https://github.com/contentauth/c2pa-rs/pull/1934))

### Fixed

* Apply same restrictions on ingredient deltas as active manifest for validation state ([#1624](https://github.com/contentauth/c2pa-rs/pull/1624))

## [0.78.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.78.1...c2pa-v0.78.2)
_12 March 2026_

### Fixed

* Windows Build flags ([#1930](https://github.com/contentauth/c2pa-rs/pull/1930))

## [0.78.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.78.0...c2pa-v0.78.1)
_12 March 2026_

### Fixed

* Fragmented video verification ([#1925](https://github.com/contentauth/c2pa-rs/pull/1925))

## [0.78.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.77.1...c2pa-v0.78.0)
_11 March 2026_

### Added

* Emscripten ([#1886](https://github.com/contentauth/c2pa-rs/pull/1886))

### Fixed

* Correct validation of OCSP signature ([#1863](https://github.com/contentauth/c2pa-rs/pull/1863))
* Merkle api integration ([#1902](https://github.com/contentauth/c2pa-rs/pull/1902))

## [0.77.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.77.0...c2pa-v0.77.1)
_10 March 2026_

### Documented

* Combine docs on Context and Settings to reduce duplication ([#1899](https://github.com/contentauth/c2pa-rs/pull/1899))

## [0.77.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.76.2...c2pa-v0.77.0)
_04 March 2026_

### Added

* Embeddable manifest API with Context/Settings, CAWG and BMFF.v3 support. ([#1847](https://github.com/contentauth/c2pa-rs/pull/1847))

## [0.76.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.76.1...c2pa-v0.76.2)
_03 March 2026_

### Fixed

* Panic when validating boxes hash with no names ([#1897](https://github.com/contentauth/c2pa-rs/pull/1897))

## [0.76.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.76.0...c2pa-v0.76.1)
_02 March 2026_

### Fixed

* Handle meta box without FullBox header from Apple devices ([#1889](https://github.com/contentauth/c2pa-rs/pull/1889))

### Updated dependencies

* Bump png_pong from 0.9.3 to 0.10.0 ([#1850](https://github.com/contentauth/c2pa-rs/pull/1850))
* Bump toml from 0.9.12+spec-1.1.0 to 1.0.2+spec-1.1.0 ([#1883](https://github.com/contentauth/c2pa-rs/pull/1883))

## [0.76.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.21...c2pa-v0.76.0)
_23 February 2026_

### Added

* Enable self-signed ephemeral certs on Wasm build ([#1858](https://github.com/contentauth/c2pa-rs/pull/1858))

### Documented

* Fix doc for verify_after_sign due to bug ([#1876](https://github.com/contentauth/c2pa-rs/pull/1876))
* Doc cleanup and some reorg ([#1822](https://github.com/contentauth/c2pa-rs/pull/1822))
* SignerSettings doc comments ([#1856](https://github.com/contentauth/c2pa-rs/pull/1856))

### Fixed

* Use cose_sign1 signature field for timestamp assertion verification ([#1867](https://github.com/contentauth/c2pa-rs/pull/1867))
* [**breaking**] Allow `Builder::sign_async` future to be spawnable on Tokio runtime ([#1846](https://github.com/contentauth/c2pa-rs/pull/1846))

### Updated dependencies

* Bump zip from 7.4.0 to 8.1.0 ([#1864](https://github.com/contentauth/c2pa-rs/pull/1864))
* Bump zip from 6.0.0 to 7.4.0 ([#1857](https://github.com/contentauth/c2pa-rs/pull/1857))

## [0.75.21](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.20...c2pa-v0.75.21)
_12 February 2026_

No-op re-release to address previous build failure.

## [0.75.20](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.19...c2pa-v0.75.20)
_12 February 2026_

### Added

* Use ephemeral self-signed cert to sign working store / archive ([#1839](https://github.com/contentauth/c2pa-rs/pull/1839))

## [0.75.19](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.18...c2pa-v0.75.19)
_09 February 2026_

### Fixed

* Support QT style 'meta' boxes ([#1844](https://github.com/contentauth/c2pa-rs/pull/1844))
* Settings.builder.created_assertion_lables was not being applied. ([#1828](https://github.com/contentauth/c2pa-rs/pull/1828))

## [0.75.18](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.17...c2pa-v0.75.18)
_06 February 2026_

### Fixed

* Wrong size being written out for XMP box ([#1835](https://github.com/contentauth/c2pa-rs/pull/1835))

## [0.75.17](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.16...c2pa-v0.75.17)
_06 February 2026_

### Fixed

* Capture default values in schema generation ([#1824](https://github.com/contentauth/c2pa-rs/pull/1824))

## [0.75.13](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.12...c2pa-v0.75.13)
_03 February 2026_

### Fixed

* Force Cargo to use sparse crates.io index

## [0.75.12](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.11...c2pa-v0.75.12)
_03 February 2026_

(Re-release since the 0.75.11 release failed.)

## [0.75.11](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.10...c2pa-v0.75.11)
_03 February 2026_

### Added

* Adds thread safe Settings and Context support to c_ffi_api ([#1783](https://github.com/contentauth/c2pa-rs/pull/1783))

### Other

* Only use `reqwest` for `c2pa-c-ffi` networking ([#1807](https://github.com/contentauth/c2pa-rs/pull/1807))

### Updated dependencies

* Bump jumbf from 0.5.0 to 0.7.0 ([#1806](https://github.com/contentauth/c2pa-rs/pull/1806))

## [0.75.10](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.9...c2pa-v0.75.10)
_02 February 2026_

### Fixed

* Updates to c2pa_cbor 0.77.2 ([#1804](https://github.com/contentauth/c2pa-rs/pull/1804))

### Updated dependencies

* Bump jumbf from 0.4.1 to 0.5.0 ([#1794](https://github.com/contentauth/c2pa-rs/pull/1794))

## [0.75.9](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.8...c2pa-v0.75.9)
_30 January 2026_

### Added

* Public API for timestamp assertions ([#1603](https://github.com/contentauth/c2pa-rs/pull/1603))
* Add support for arbitrary key/value pairs in assertion metadata ([#1782](https://github.com/contentauth/c2pa-rs/pull/1782))

### Updated dependencies

* Bump c2pa-cbor from 0.77.0 to 0.77.1 ([#1800](https://github.com/contentauth/c2pa-rs/pull/1800))

## [0.75.8](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.7...c2pa-v0.75.8)
_28 January 2026_

### Fixed

* MP3's GEOB MIME type ([#1790](https://github.com/contentauth/c2pa-rs/pull/1790))
* Removed dependency on unmaintained `serde_cbor` crate ([#1739](https://github.com/contentauth/c2pa-rs/pull/1739))

## [0.75.7](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.6...c2pa-v0.75.7)
_27 January 2026_

### Fixed

* Retrigger release-plz release workflow ([#1781](https://github.com/contentauth/c2pa-rs/pull/1781))

## [0.75.6](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.5...c2pa-v0.75.6)
_22 January 2026_

### Added

* Trigger a new release to allow generated binaries to be published

## [0.75.5](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.4...c2pa-v0.75.5)
_21 January 2026_

### Fixed

* Use patched version of typed-path for zip ([#1761](https://github.com/contentauth/c2pa-rs/pull/1761))
* Work around compilation issues introduced by `typed_path` crate ([#1757](https://github.com/contentauth/c2pa-rs/pull/1757))
* Update tiff support to latest standard ([#1736](https://github.com/contentauth/c2pa-rs/pull/1736))

### Updated dependencies

* Bump quick-xml from 0.38.4 to 0.39.0 ([#1754](https://github.com/contentauth/c2pa-rs/pull/1754))
* Bump lopdf from 0.38.0 to 0.39.0 ([#1753](https://github.com/contentauth/c2pa-rs/pull/1753))

## [0.75.4](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.3...c2pa-v0.75.4)
_16 January 2026_

### Fixed

* Context propagation for Reader to support legacy behavior ([#1743](https://github.com/contentauth/c2pa-rs/pull/1743))

## [0.75.3](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.2...c2pa-v0.75.3)
_16 January 2026_

### Documented

* Describe what parameter is missing in c2pa.opened/placed/removed validation ([#1737](https://github.com/contentauth/c2pa-rs/pull/1737))

### Fixed

* Disable verify after sign temporarily (due to bug) ([#1746](https://github.com/contentauth/c2pa-rs/pull/1746))

## [0.75.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.1...c2pa-v0.75.2)
_15 January 2026_

### Fixed

* Fix streams handling for TIFF ([#1728](https://github.com/contentauth/c2pa-rs/pull/1728))

## [0.75.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.0...c2pa-v0.75.1)
_15 January 2026_

### Added

* Report claim version in manifest report ([#1722](https://github.com/contentauth/c2pa-rs/pull/1722))

### Fixed

* Verify after sign not executing ([#1638](https://github.com/contentauth/c2pa-rs/pull/1638))

### Updated dependencies

* Bump img-parts from 0.3.3 to 0.4.0 ([#1733](https://github.com/contentauth/c2pa-rs/pull/1733))
* Bump range-set from 0.0.11 to 0.1.0 ([#1726](https://github.com/contentauth/c2pa-rs/pull/1726))
* Bump nonempty-collections from 0.3.1 to 1.2.1 ([#1724](https://github.com/contentauth/c2pa-rs/pull/1724))
* Bump extfmt from 0.1.1 to 0.2.0 ([#1725](https://github.com/contentauth/c2pa-rs/pull/1725))
* Bump zip from 6.0.0 to 7.0.0 ([#1723](https://github.com/contentauth/c2pa-rs/pull/1723))

## [0.75.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.74.0...c2pa-v0.75.0)
_14 January 2026_

### Added

* Deeper integration of Context into the SDK ([#1710](https://github.com/contentauth/c2pa-rs/pull/1710))
* Multi RIFF AVI (AVIX) support ([#1656](https://github.com/contentauth/c2pa-rs/pull/1656))
* Add `Manifest::signature` to get Cose_Sign1 signature ([#1699](https://github.com/contentauth/c2pa-rs/pull/1699))

### Fixed

* CAI-10286 - path traversal, zip-slip in from_archive ([#1721](https://github.com/contentauth/c2pa-rs/pull/1721))
* 1716 fix deeply nested bmff box issue ([#1717](https://github.com/contentauth/c2pa-rs/pull/1717))
* Fix vulnerability with user supplied exclusions. ([#1715](https://github.com/contentauth/c2pa-rs/pull/1715))
* Make parameters optional for transcoded and repackaged actions ([#1701](https://github.com/contentauth/c2pa-rs/pull/1701))
* Allow actions assertions to be created assertions ([#1703](https://github.com/contentauth/c2pa-rs/pull/1703))

### Updated dependencies

* Bump non-empty-string from 0.2.4 to 0.2.6 ([#1720](https://github.com/contentauth/c2pa-rs/pull/1720))
* Bump id3 from 1.16.1 to 1.16.3 ([#1718](https://github.com/contentauth/c2pa-rs/pull/1718))
* Bump asn1-rs from 0.6.2 to 0.7.1 ([#1505](https://github.com/contentauth/c2pa-rs/pull/1505))
* Bump toml from 0.8.23 to 0.9.10+spec-1.1.0 ([#1713](https://github.com/contentauth/c2pa-rs/pull/1713))
* Bump env_logger from 0.10.2 to 0.11.8 ([#1711](https://github.com/contentauth/c2pa-rs/pull/1711))
* Bump rasn from 0.26.6 to 0.28.1 ([#1621](https://github.com/contentauth/c2pa-rs/pull/1621))
* Bump rand_chacha from 0.3.1 to 0.9.0 ([#1619](https://github.com/contentauth/c2pa-rs/pull/1619))
* Bump mockall from 0.13.1 to 0.14.0 ([#1708](https://github.com/contentauth/c2pa-rs/pull/1708))

## [0.74.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.73.2...c2pa-v0.74.0)
_07 January 2026_

### Added

* [**breaking**] Store `Context` as `Arc` for shared context and threading support ([#1680](https://github.com/contentauth/c2pa-rs/pull/1680))
* Add CAWG roles support to SignerSettings ([#1700](https://github.com/contentauth/c2pa-rs/pull/1700))
* Adds `Context` to contain settings, HTTPS resolvers, and signers ([#1631](https://github.com/contentauth/c2pa-rs/pull/1631))

### Fixed

* Hard binding recursive search for nested update manifests ([#1693](https://github.com/contentauth/c2pa-rs/pull/1693))

### Other

* Update `codspeed-criterion-compat` to 4.2.1 ([#1702](https://github.com/contentauth/c2pa-rs/pull/1702))

### Updated dependencies

* Bump rsa from 0.9.9 to 0.9.10 ([#1698](https://github.com/contentauth/c2pa-rs/pull/1698))

## [0.73.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.73.1...c2pa-v0.73.2)
_22 December 2025_

### Fixed

* Nested ingredient serializing-deserializing (fix for #1685) ([#1686](https://github.com/contentauth/c2pa-rs/pull/1686))
* Flush stream to finish write operations before rewind for FFI layer improvements ([#1672](https://github.com/contentauth/c2pa-rs/pull/1672))

## [0.73.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.73.0...c2pa-v0.73.1)
_19 December 2025_

### Fixed

* Fix case where UUID boxes and BMFF layout confused the insertion ([#1676](https://github.com/contentauth/c2pa-rs/pull/1676))
* Remove extra hash binding verification for update manifests ([#1659](https://github.com/contentauth/c2pa-rs/pull/1659))
* Add maybeSync ([#1664](https://github.com/contentauth/c2pa-rs/pull/1664))
* Address new warnings with Rust 1.92.0 ([#1661](https://github.com/contentauth/c2pa-rs/pull/1661))

### Other

* Replace once_cell Lazy with std LazyLock ([#1666](https://github.com/contentauth/c2pa-rs/pull/1666))

## [0.73.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.72.1...c2pa-v0.73.0)
_04 December 2025_

### Added

* Restricted HTTP resolvers ([#1630](https://github.com/contentauth/c2pa-rs/pull/1630))

## [0.72.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.72.0...c2pa-v0.72.1)
_04 December 2025_

### Added

* Check if stream matches input format via file signature/structure ([#1528](https://github.com/contentauth/c2pa-rs/pull/1528))
* Use MaybeSend to simplify code ([#1639](https://github.com/contentauth/c2pa-rs/pull/1639))

### Documented

* Add doc for CLI settings, misc copy edits ([#1636](https://github.com/contentauth/c2pa-rs/pull/1636))

### Fixed

* Set wasm-bindgen-cli version in CI ([#1644](https://github.com/contentauth/c2pa-rs/pull/1644))
* Fix the timestamp cert chain validation to be independent of the order ([#1600](https://github.com/contentauth/c2pa-rs/pull/1600))
* RFC 3161 fractional seconds ([#1640](https://github.com/contentauth/c2pa-rs/pull/1640))
* Stack overflow and hang due to cyclic ingredients ([#1576](https://github.com/contentauth/c2pa-rs/pull/1576))
* Allow untrusted failure code to be a `Valid` validation state ([#1623](https://github.com/contentauth/c2pa-rs/pull/1623))
* Remove unmaintained `json5` dependency and other unused `config` crate sub-dependencies ([#1611](https://github.com/contentauth/c2pa-rs/pull/1611))

### Other

* Remove direct dependency on `windows-core` ([#1616](https://github.com/contentauth/c2pa-rs/pull/1616))

### Updated dependencies

* Bump lopdf from 0.31.0 to 0.38.0 ([#1359](https://github.com/contentauth/c2pa-rs/pull/1359))
* Bump quick-xml from 0.37.5 to 0.38.3 ([#1575](https://github.com/contentauth/c2pa-rs/pull/1575))

## [0.72.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.71.3...c2pa-v0.72.0)
_17 November 2025_

### Added

* Remove x509_certificate ([#1547](https://github.com/contentauth/c2pa-rs/pull/1547))

### Fixed

* Remove ring altogether ([#1606](https://github.com/contentauth/c2pa-rs/pull/1606))

## [0.71.3](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.71.2...c2pa-v0.71.3)
_17 November 2025_

### Documented

* Fix and update Builder examples ([#1484](https://github.com/contentauth/c2pa-rs/pull/1484))

## [0.71.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.71.1...c2pa-v0.71.2)
_13 November 2025_

### Fixed

* Remove a dbg statement ([#1594](https://github.com/contentauth/c2pa-rs/pull/1594))

## [0.71.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.71.0...c2pa-v0.71.1)
_12 November 2025_

### Fixed

* Use Digitalsourcetype with Builder intents ([#1586](https://github.com/contentauth/c2pa-rs/pull/1586))
* Restore recursive ingredient checks ([#1582](https://github.com/contentauth/c2pa-rs/pull/1582))

## [0.71.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.70.0...c2pa-v0.71.0)
_07 November 2025_

### Fixed

* Disallow ureq and reqwest_blocking for WASM and WASI ([#1579](https://github.com/contentauth/c2pa-rs/pull/1579))

## [0.70.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.69.0...c2pa-v0.70.0)
_06 November 2025_

### Added

* Sync/async HTTP resolvers API ([#1355](https://github.com/contentauth/c2pa-rs/pull/1355))

### Fixed

* Better support for remote-only manifests of non-BMFF assets ([#1569](https://github.com/contentauth/c2pa-rs/pull/1569))

### Updated dependencies

* Bump thiserror from 1.0.69 to 2.0.17 ([#1562](https://github.com/contentauth/c2pa-rs/pull/1562))

## [0.69.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.68.0...c2pa-v0.69.0)
_04 November 2025_

### Added

* Refine validation state logic ([#1541](https://github.com/contentauth/c2pa-rs/pull/1541))
* Adds support and documentation for JSON formatted Settings ([#1533](https://github.com/contentauth/c2pa-rs/pull/1533))
* Allow reading a manifest store as a Builder to continue editing ([#1476](https://github.com/contentauth/c2pa-rs/pull/1476))

### Fixed

* Allow C2PA archives to be unsigned ([#1560](https://github.com/contentauth/c2pa-rs/pull/1560))
* Add JsonSchema to Action ([#1550](https://github.com/contentauth/c2pa-rs/pull/1550))
* Update to avoid deprecation warning for Command::cargo_bin ([#1548](https://github.com/contentauth/c2pa-rs/pull/1548))

### Updated dependencies

* Bump zip from 3.0.0 to 6.0.0 ([#1540](https://github.com/contentauth/c2pa-rs/pull/1540))
* Bump coset from 0.3.8 to 0.4.0 ([#1539](https://github.com/contentauth/c2pa-rs/pull/1539))
* Bump hex-literal from 0.4.1 to 1.0.0 ([#1527](https://github.com/contentauth/c2pa-rs/pull/1527))

## [0.68.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.67.1...c2pa-v0.68.0)
_24 October 2025_

### Added

* Add settings structs to the public API ([#1447](https://github.com/contentauth/c2pa-rs/pull/1447))
* Enables generating created assertions and getting the created state ([#1432](https://github.com/contentauth/c2pa-rs/pull/1432))
* Make settings not thread-local ([#1444](https://github.com/contentauth/c2pa-rs/pull/1444))
* Add CAWG validation to `Reader` ([#1370](https://github.com/contentauth/c2pa-rs/pull/1370))

### Documented

* Document features in Rust docs and clarify features ([#1491](https://github.com/contentauth/c2pa-rs/pull/1491))
* Say to use v2 claims. Update support statement ([#1496](https://github.com/contentauth/c2pa-rs/pull/1496))
* Update README.md to add CAI membership & Discord links ([#1482](https://github.com/contentauth/c2pa-rs/pull/1482))
* Fix docs.rs build by removing removed features ([#1480](https://github.com/contentauth/c2pa-rs/pull/1480))

### Fixed

* Change MSRV to 1.88.0 ([#1520](https://github.com/contentauth/c2pa-rs/pull/1520))
* Timestamp grace for legacy manifests ([#1502](https://github.com/contentauth/c2pa-rs/pull/1502))
* Skip test_reader_to_folder in github workflow for WASI ([#1498](https://github.com/contentauth/c2pa-rs/pull/1498))
* Remove `serialize_thumbnails` feature ([#1492](https://github.com/contentauth/c2pa-rs/pull/1492))
* Don't log OCSP status if the result cannot be validated. ([#1489](https://github.com/contentauth/c2pa-rs/pull/1489))
* Expose underlying timestamp assertion support ([#1371](https://github.com/contentauth/c2pa-rs/pull/1371))
* Turn on trust by default ([#1483](https://github.com/contentauth/c2pa-rs/pull/1483))
* Empty actions array should be allowed for v1 claim compatibility [CAI-9573] ([#1477](https://github.com/contentauth/c2pa-rs/pull/1477))
* Add support for new data hash exclusions when update manifests are pr… ([#1478](https://github.com/contentauth/c2pa-rs/pull/1478))

### Other

* Update httpmock to 0.8.0 ([#1472](https://github.com/contentauth/c2pa-rs/pull/1472))

### Updated dependencies

* Bump memchr from 2.7.5 to 2.7.6 ([#1516](https://github.com/contentauth/c2pa-rs/pull/1516))
* Bump schemars from 0.8.22 to 1.0.4 ([#1247](https://github.com/contentauth/c2pa-rs/pull/1247))
* Bump pem from 3.0.5 to 3.0.6 ([#1511](https://github.com/contentauth/c2pa-rs/pull/1511))
* Bump serde_with from 3.14.0 to 3.15.1 ([#1503](https://github.com/contentauth/c2pa-rs/pull/1503))
* Bump httpmock from 0.8.1 to 0.8.2 ([#1504](https://github.com/contentauth/c2pa-rs/pull/1504))

## [0.67.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.67.0...c2pa-v0.67.1)
_02 October 2025_

### Fixed

* Mark `DigitalSourceType` fields as deprecated without warning (new serde update) ([#1427](https://github.com/contentauth/c2pa-rs/pull/1427))
* Correct the payload of claim signature box when calculating the hash. ([#1466](https://github.com/contentauth/c2pa-rs/pull/1466))

## [0.67.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.66.0...c2pa-v0.67.0)
_30 September 2025_

### Fixed

* Do not generate multiple `c2pa.placed` actions with settings ([#1458](https://github.com/contentauth/c2pa-rs/pull/1458))
* AllActionsIncluded defaults to None ([#1459](https://github.com/contentauth/c2pa-rs/pull/1459))

### Other

* Fix pdf benchmarks ([#1452](https://github.com/contentauth/c2pa-rs/pull/1452))

## [0.66.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.65.1...c2pa-v0.66.0)
_24 September 2025_

### Fixed

* We lost the ability to read the deprecated instanceId actions parameters field. ([#1443](https://github.com/contentauth/c2pa-rs/pull/1443))
* Remove `no_interleaved_io` feature ([#1437](https://github.com/contentauth/c2pa-rs/pull/1437))

## [0.65.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.65.0...c2pa-v0.65.1)
_23 September 2025_

### Fixed

* Add support for iso6 boxes (tfra, tfhd and saio) ([#1442](https://github.com/contentauth/c2pa-rs/pull/1442))
* [CAI-9586] Some validation errors are thrown as exceptions ([#1441](https://github.com/contentauth/c2pa-rs/pull/1441))
* Only enable "asm" feature on aarch64 macos ([#1440](https://github.com/contentauth/c2pa-rs/pull/1440))

## [0.65.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.64.0...c2pa-v0.65.0)
_19 September 2025_

### Added

* Expose add_action from the Builder at the C level ([#1425](https://github.com/contentauth/c2pa-rs/pull/1425))
* Add Redaction and Update manifest support to Builder ([#1180](https://github.com/contentauth/c2pa-rs/pull/1180))
* Add `ParametersMap` to `Actions` ([#1274](https://github.com/contentauth/c2pa-rs/pull/1274))
* *(sdk)* Introduce new API to retrieve detailed manifest JSON ([#1406](https://github.com/contentauth/c2pa-rs/pull/1406))

## [0.64.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.63.0...c2pa-v0.64.0)
_15 September 2025_

### Added

* Fetch OCSP wasm ([#1402](https://github.com/contentauth/c2pa-rs/pull/1402))

### Fixed

* Allow v1 claim  c2pa.manifest cbor assertions without full valid… ([#1412](https://github.com/contentauth/c2pa-rs/pull/1412))

## [0.63.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.62.0...c2pa-v0.63.0)
_10 September 2025_

### Added

* Add `cawg_trust.verify_trust_list` setting ([#1356](https://github.com/contentauth/c2pa-rs/pull/1356))
* Remove the v1_api feature and all associated code ([#1387](https://github.com/contentauth/c2pa-rs/pull/1387))

### Fixed

* Fix/trust list check ([#1398](https://github.com/contentauth/c2pa-rs/pull/1398))
* Remove unmaintained dependencies conv and custom_derive ([#1393](https://github.com/contentauth/c2pa-rs/pull/1393))

## [0.62.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.61.0...c2pa-v0.62.0)
_06 September 2025_

### Added

* Implement CAWG X.509 signing via settings ([#1388](https://github.com/contentauth/c2pa-rs/pull/1388))

### Fixed

* Assertion metadata localizations support was missing. CAI-9444 ([#1390](https://github.com/contentauth/c2pa-rs/pull/1390))
* Make `openssl` and `rust_native_crypto` features additive ([#1379](https://github.com/contentauth/c2pa-rs/pull/1379))
* Make OpenSSL code path enforce COSE specified salt length ([#1376](https://github.com/contentauth/c2pa-rs/pull/1376))

## [0.61.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.60.1...c2pa-v0.61.0)
_03 September 2025_

### Added

* Add benchmarking ([#1311](https://github.com/contentauth/c2pa-rs/pull/1311))

### Fixed

* Rewind output  stream after adding dynamic assertions ([#1358](https://github.com/contentauth/c2pa-rs/pull/1358))
* Fix label handling for custom metadata ([#1354](https://github.com/contentauth/c2pa-rs/pull/1354))
* Gif global color table size ([#1348](https://github.com/contentauth/c2pa-rs/pull/1348))
* Fix overly agressive metata collection ([#1345](https://github.com/contentauth/c2pa-rs/pull/1345))

## [0.60.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.60.0...c2pa-v0.60.1)
_27 August 2025_

### Fixed

* Removes asm feature for sha2 ([#1343](https://github.com/contentauth/c2pa-rs/pull/1343))
* Reset settings after test_stream_thumbnail ([#1339](https://github.com/contentauth/c2pa-rs/pull/1339))

## [0.60.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.59.1...c2pa-v0.60.0)
_26 August 2025_

### Added

* *(sdk)* Falls back to fs for large intermediate streams ([#1341](https://github.com/contentauth/c2pa-rs/pull/1341))
* Add ability to set/get the description for an action. ([#1276](https://github.com/contentauth/c2pa-rs/pull/1276))

### Fixed

* Ingredient thumbnail generation respect settings ([#1332](https://github.com/contentauth/c2pa-rs/pull/1332))
* Fix a regression for invalid manifest handling and reader creation ([#1312](https://github.com/contentauth/c2pa-rs/pull/1312))
* Fix test

### Other

* Fix docs and dead code lint ([#1340](https://github.com/contentauth/c2pa-rs/pull/1340))

## [0.59.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.59.0...c2pa-v0.59.1)
_15 August 2025_

### Fixed

* Add common name to manifest dump ([#1319](https://github.com/contentauth/c2pa-rs/pull/1319))
* Support box hash exclusions ([#1317](https://github.com/contentauth/c2pa-rs/pull/1317))
# Changelog

All notable changes to this project will be documented in this file.

This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html), except that – as is typical in the Rust community – the minimum supported Rust version may be increased without a major version increase.

Since version 0.36.2, the format of this changelog is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).

## [0.59.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.58.0...c2pa-v0.59.0)
_14 August 2025_

### Added

* Add option for configuring trust when validating identity assertions (CAI-7980) ([#1239](https://github.com/contentauth/c2pa-rs/pull/1239))
* Add new soft binding fields to the ingredient assertion structure ([#1306](https://github.com/contentauth/c2pa-rs/pull/1306))
* Add cawg.metadata label and test. ([#1305](https://github.com/contentauth/c2pa-rs/pull/1305))
* Certificate status assertion ([#1236](https://github.com/contentauth/c2pa-rs/pull/1236))
* Browser wasm fetch remote manifests ([#1259](https://github.com/contentauth/c2pa-rs/pull/1259))
* Define `DigitalSourceType` as enum ([#1260](https://github.com/contentauth/c2pa-rs/pull/1260))
* Impl Soft Binding assertion definition ([#1147](https://github.com/contentauth/c2pa-rs/pull/1147))
* Add metadata assertion and support for validation ([#1258](https://github.com/contentauth/c2pa-rs/pull/1258))
* Remove `Send` trait for `CAIRead` on Wasm ([#1264](https://github.com/contentauth/c2pa-rs/pull/1264))
* [**breaking**] Change `Verifier` to hold a `Cow<'a, CertificateTrustPolicy` rather than a reference ([#1238](https://github.com/contentauth/c2pa-rs/pull/1238))
* V2 Claims are now generated by default ([#1266](https://github.com/contentauth/c2pa-rs/pull/1266))
* Bump MSRV to 1.86.0 ([#1269](https://github.com/contentauth/c2pa-rs/pull/1269))
* Expand settings API ([#1192](https://github.com/contentauth/c2pa-rs/pull/1192))

### Fixed

* Fix broken ingredient recursion ([#1309](https://github.com/contentauth/c2pa-rs/pull/1309))
* Mark the CreativeWork assertion as deprecated ([#1304](https://github.com/contentauth/c2pa-rs/pull/1304))
* Make common name available to manifest_store ([#1300](https://github.com/contentauth/c2pa-rs/pull/1300))
* V2 redactions were reporting validation error if the assertion was redacted ([#1282](https://github.com/contentauth/c2pa-rs/pull/1282))
* Bmff update manifest support ([#1284](https://github.com/contentauth/c2pa-rs/pull/1284))
* Report correct identity assertion JUMBF URI when reporting validation status ([#1292](https://github.com/contentauth/c2pa-rs/pull/1292))
* Support for BMFF V3 hashing options ([#1253](https://github.com/contentauth/c2pa-rs/pull/1253))
* Remove "other" field in `Metadata` assertion ([#1251](https://github.com/contentauth/c2pa-rs/pull/1251))
* Add support for m4v ([#1254](https://github.com/contentauth/c2pa-rs/pull/1254))

### Other

* Rename Metadata to AssertionMetadata ([#1261](https://github.com/contentauth/c2pa-rs/pull/1261))
* Feature flag `test_reader_remote_url` with feature `fetch_remote_manifests` ([#1252](https://github.com/contentauth/c2pa-rs/pull/1252))

## [0.58.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.57.0...c2pa-v0.58.0)
_18 July 2025_

### Added

* Add C binding for setting the base path ([#1237](https://github.com/contentauth/c2pa-rs/pull/1237))
* Asset reference assertion ([#1203](https://github.com/contentauth/c2pa-rs/pull/1203))
* Add `Reader::remote_url` and `Reader::is_embedded` ([#1150](https://github.com/contentauth/c2pa-rs/pull/1150))
* Store icon references into c2pa.icon assertions for v2 instead of using data_boxes. ([#1235](https://github.com/contentauth/c2pa-rs/pull/1235))
* Remove file type from thumbnail names ([#1187](https://github.com/contentauth/c2pa-rs/pull/1187))
* Update MSRV to 1.85 ([#1208](https://github.com/contentauth/c2pa-rs/pull/1208))

### Documented

* Fix spec link for EmbeddedData ([#1226](https://github.com/contentauth/c2pa-rs/pull/1226))
* API doc clean up and improvement ([#1178](https://github.com/contentauth/c2pa-rs/pull/1178))
* Fix formatting of top level example. ([#1161](https://github.com/contentauth/c2pa-rs/pull/1161))

### Fixed

* Panic when adding empty actions assertion ([#1227](https://github.com/contentauth/c2pa-rs/pull/1227))
* Generated JPEG thumbnail incorrectly rotated ([#1233](https://github.com/contentauth/c2pa-rs/pull/1233))
* Unfreeze dependency on base64ct crate now that we're up to MSRV 1.85 ([#1228](https://github.com/contentauth/c2pa-rs/pull/1228))
* Clean up logs ([#1181](https://github.com/contentauth/c2pa-rs/pull/1181))
* Change timestamp validation to return new required info fields ([#1191](https://github.com/contentauth/c2pa-rs/pull/1191))
* Xmp jpeg write ([#1156](https://github.com/contentauth/c2pa-rs/pull/1156))
* Clippy warnings for Rust 1.88 ([#1204](https://github.com/contentauth/c2pa-rs/pull/1204))

### Other

* Move uri_to_path into utils ([#1186](https://github.com/contentauth/c2pa-rs/pull/1186))

## [0.57.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.56.2...c2pa-v0.57.0)
_19 June 2025_

### Fixed

* No-op change to trigger c2pa core crate publish

## [0.56.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.56.1...c2pa-v0.56.2)
_18 June 2025_

### Fixed

* No-op change to trigger rebuild

## [0.56.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.56.0...c2pa-v0.56.1)
_18 June 2025_

### Fixed

* To_archive does not store resources associated with ingredients ([#1151](https://github.com/contentauth/c2pa-rs/pull/1151))

## [0.56.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.55.0...c2pa-v0.56.0)
_17 June 2025_

### Added

* *(sdk)* Introduces get_supported_types api ([#1138](https://github.com/contentauth/c2pa-rs/pull/1138))
* Update Validation for 2.2 spec compliance ([#1144](https://github.com/contentauth/c2pa-rs/pull/1144))

### Documented

* Doc cleanup ([#1143](https://github.com/contentauth/c2pa-rs/pull/1143))

### Fixed

* Freeze base64ct crate at 1.7.3 for now ([#1163](https://github.com/contentauth/c2pa-rs/pull/1163))
* C2patool reports cawg.ica.credential_valid for valid CAWG X.509 signature (CAI-8751) ([#1155](https://github.com/contentauth/c2pa-rs/pull/1155))
* Docs.rs build using openssl and rust_native_crypto simulatenously ([#1139](https://github.com/contentauth/c2pa-rs/pull/1139))

## [0.55.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.54.0...c2pa-v0.55.0)
_27 May 2025_

### Added

* Es512 support without new dependencies ([#1130](https://github.com/contentauth/c2pa-rs/pull/1130))

## [0.54.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.53.0...c2pa-v0.54.0)
_27 May 2025_

### Added

* Make OpenSSL a default feature ([#1118](https://github.com/contentauth/c2pa-rs/pull/1118))

### Fixed

* Add CAWG support for fragmented BMFF ([#1114](https://github.com/contentauth/c2pa-rs/pull/1114))

### Other

* Integrates prebuilt library release workflow ([#1126](https://github.com/contentauth/c2pa-rs/pull/1126))

## [0.53.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.52.0...c2pa-v0.53.0)
_20 May 2025_

### Added

* [**breaking**] Merge `c2pa-status-tracker` crate into `c2pa` ([#1115](https://github.com/contentauth/c2pa-rs/pull/1115))

### Fixed

* Avoid yanked version of `windows-core` crate ([#1116](https://github.com/contentauth/c2pa-rs/pull/1116))

## [0.52.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.51.1...c2pa-v0.52.0)
_16 May 2025_

### Added

* [**breaking**] Merge c2pa-crypto crate into core c2pa crate ([#1099](https://github.com/contentauth/c2pa-rs/pull/1099))

## [0.51.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.51.0...c2pa-v0.51.1)
_16 May 2025_

### Fixed

* Switch zip dependency to a non-yanked version ([#1101](https://github.com/contentauth/c2pa-rs/pull/1101))
* Fix Clippy warnings for Rust 1.87 ([#1103](https://github.com/contentauth/c2pa-rs/pull/1103))

## [0.51.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.50.0...c2pa-v0.51.0)
_14 May 2025_

### Added

* [**breaking**] Merge CAWG identity SDK into main C2PA crate ([#1089](https://github.com/contentauth/c2pa-rs/pull/1089))

### Fixed

* Trigger re-publish of c2pa crate

## [0.50.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.49.5...c2pa-v0.50.0)
_14 May 2025_

### Added

* Adds c_api for dynamic library releases ([#1047](https://github.com/contentauth/c2pa-rs/pull/1047))
* SVG thumbnails with a fix to the ingredient thumbnail format detection ([#722](https://github.com/contentauth/c2pa-rs/pull/722))
* *(sdk)* Support setting the Ingredient manifest_data field for remote manifests using Builder ([#1091](https://github.com/contentauth/c2pa-rs/pull/1091))

### Fixed

* Ingredient from_stream/memory not loading remote manifests ([#1061](https://github.com/contentauth/c2pa-rs/pull/1061))

## [0.49.5](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.49.4...c2pa-v0.49.5)
_25 April 2025_

### Fixed

* Return an error if a manifest cannot be read ([#1051](https://github.com/contentauth/c2pa-rs/pull/1051))

## [0.49.4](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.49.3...c2pa-v0.49.4)
_24 April 2025_

### Fixed

* Fix missing Action fields ([#1050](https://github.com/contentauth/c2pa-rs/pull/1050))

## [0.49.3](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.49.2...c2pa-v0.49.3)
_16 April 2025_

### Fixed

* Dynamic assertions should be gathered assertions ([#1005](https://github.com/contentauth/c2pa-rs/pull/1005))

## [0.49.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.49.1...c2pa-v0.49.2)
_07 April 2025_

### Fixed

* Populates claim signature field in ingredient v3. ([#1027](https://github.com/contentauth/c2pa-rs/pull/1027))
* Adjust dependencies to avoid security warnings and yanked versions ([#1031](https://github.com/contentauth/c2pa-rs/pull/1031))
* Enable trust checks for all unit tests ([#1022](https://github.com/contentauth/c2pa-rs/pull/1022))

## [0.49.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.49.0...c2pa-v0.49.1)
_04 April 2025_

### Fixed

* Update openssl to address a recently-announced vulnerability ([#1024](https://github.com/contentauth/c2pa-rs/pull/1024))

## [0.49.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.48.2...c2pa-v0.49.0)
_03 April 2025_

### Added

* *(cawg_identity)* Add `BuiltInSignatureVerifier` ([#978](https://github.com/contentauth/c2pa-rs/pull/978))

### Fixed

* Thread safe version of settings.rs ([#1018](https://github.com/contentauth/c2pa-rs/pull/1018))
* Fix support for user supplied labels ([#1017](https://github.com/contentauth/c2pa-rs/pull/1017))
* Sig check fix ([#1016](https://github.com/contentauth/c2pa-rs/pull/1016))

## [0.48.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.48.1...c2pa-v0.48.2)
_26 March 2025_

### Fixed

* Make sure manifests are signed with end-entity certs ([#997](https://github.com/contentauth/c2pa-rs/pull/997))

### Other

* Revert "chore: publish c2patool and cawg_identity updates ([#992](https://github.com/contentauth/c2pa-rs/pull/992))"

## [0.48.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.48.0...c2pa-v0.48.1)
_20 March 2025_

### Fixed

* *(c2patool)* Fixes crash and improves cawg support (#989)

## [0.48.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.47.0...c2pa-v0.48.0)
_19 March 2025_

### Added

* Adds allActionsIncluded flag to Actions Assertion (#986)

### Fixed

* Generate gathered assertions for v2 claims (#985)

## [0.47.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.46.0...c2pa-v0.47.0)
_18 March 2025_

### Added

* Adds `reader.post_validate` method for CAWG validation support (#976)
* Add `StatusTracker` to `IdentityAssertion` parsing and validation APIs (#943)
* Add `Sync` to `AsyncDynamicAssertion` (#953)
* Simplify `StatusTracker` interface (#937)
* Add WASI to c2patool (#945)
* Add WASI support to cawg_identity (#942)
* Add ES256 and ES384 Rust native signing (#941)
* Adds validation_state to the json reports from the Reader (#930)
* Wasm32 wasi 0.41.0 (#888)

### Fixed

* Remove circular dependency between C2PA and CAWG crates (#982)
* ISSUE-967: Remove the `RST0..=RST7` check from the `has_length` method for the JPEG asset handler. (#968)
* Fix broken c2patool fragment feature (#960)
* Feature flag `v1_api` without `file_io` didn't compile (#944)
* Use older version of x509-certificate for wasm32-unknown (#934)
* Fix new Clippy warnings for Rust 1.85.0 (#933)

### Other

* Remove `openssl` feature flag (#940)

### Updated dependencies

* Bump zip crate to 2.4.1 (#981)
* Bump x509-certificate to 0.24.0 (#957)

## [0.46.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.45.3...c2pa-v0.46.0)
_15 February 2025_

### Added

* Add support for DynamicAssertions in JSON format (#924)

### Fixed

* Panic in decoding of GIF chunks (#873)
* Use correct byte label for GIF Plain Text Extension (#864)
* Panic in slicing of empty XMP data (#872)

### Other

* Use `AsRef<Path>` in `jumbf_io` functions (#910)

## [0.45.3](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.45.2...c2pa-v0.45.3)
_11 February 2025_

### Fixed

* Restore support for claim_generator_hints (#915)

## [0.45.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.45.1...c2pa-v0.45.2)
_06 February 2025_

### Documented

* Fix reported errors for docs (#903)

### Fixed

* Update error reporting (#906)
* Repair cargo test (#898)

## [0.45.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.45.0...c2pa-v0.45.1)
_31 January 2025_

### Fixed

* Remove dependency on SubtleCrypto (#881)

## [0.45.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.44.0...c2pa-v0.45.0)
_30 January 2025_

### Added

* *(cawg_identity)* Split `CredentialHolder` into sync and async versions (#891)

## [0.44.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.43.0...c2pa-v0.44.0)
_29 January 2025_

### Added

* Allow synchronous DynamicAssertion (#889)
* Claim v2 (#707)

## [0.43.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.42.0...c2pa-v0.43.0)
_24 January 2025_

### Added

* *(crypto)* Make `box_size` parameter on `c2pa_crypto::cose::sign` an `Option` (#879)

### Fixed

* Bump coset requirement to 0.3.8 (#883)
* Update id3 crate (#875)
* Remove `Debug` supertrait from `DynamicAssertion` and `CredentialHolder` traits (#876)

## [0.42.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.41.1...c2pa-v0.42.0)
_22 January 2025_

### Added

* Change the definition of `Signer.raw_signer()` to return an `Option` defaulting to `None` (#869)

## [0.41.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.41.0...c2pa-v0.41.1)
_22 January 2025_

### Fixed

* Make alg enum exhaustive (#866)

## [0.41.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.40.0...c2pa-v0.41.0)
_16 January 2025_

### Added

* *(crypto)* Add `rsa` crate support to `rust_native_crypto` feature (#853)
* *(cawg_identity)* Implement identity assertion validation (#843)
* Remove writing of native camera RAW formats from SDK (#814)
* Review `c2pa-crypto` crate API (#813)
* Add new function `c2pa_crypto::cose::signing_time_from_sign1` (#812)
* Move COSE signing into `c2pa_crypto` crate (#807)
* Move COSE timestamp generation into `c2pa_crypto` (#803)
* Move COSE signature verification into `c2pa_crypto` (#801)
* Introduce `c2pa_crypto::Verifier::verify_trust` (#798)
* Introduce `c2pa_crypto::cose::Verifier` (#797)
* Consolidate implementations of `cert_chain_from_sign1` in `c2pa_crypto` (#796)
* Move `signing_alg_from_sign1` into `c2pa-crypto` (#795)
* Move `get_cose_sign1` into `c2pa-crypto` crate (#794)
* Move COSE OCSP support into c2pa-crypto (#793)
* Move `verify_trust` into `c2pa_crypto` (#784)
* Introduce `c2pa_crypto::CertificateAcceptancePolicy` (#779)
* Bump MSRV to 1.81.0 (#781)

### Fixed

* Make sure `DynamicAssertion::content` gets a properly populated `PartialClaim` (#842)
* Switch to from fast_xml to quick_xml (#805)
* Update img-parts for jpeg segment underflow fix (#806)
* Bring `claim_v2` changes from #707 into `c2pa_crypto` (#811)
* Improve usage of `#[cfg]` directives (#783)
* OOB read attempt in jpeg_io asset handler in get_cai_segments function (#719)
* Prevent negative length value for SVG object locations (#766)
* JPEG `write_cai` OOB insertion (#762)
* Add support XMP in SVG (#771)
* Possible overflow for TIFF (#760)
* Resolve new Clippy issues (#776)

### Updated dependencies

* Bump jfifdump from 0.5.1 to 0.6.0 (#785)
* Bump serde-wasm-bindgen from 0.5.0 to 0.6.5 (#786)
* Bump thiserror from 2.0.6 to 2.0.8 (#787)
* Bump rasn from 0.18.0 to 0.22.0 (#727)
* Bump thiserror from 1.0.69 to 2.0.6 (#770)

## [0.40.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.39.0...c2pa-v0.40.0)
_12 December 2024_

### Added

* Add `RawSigner` trait to `c2pa-crypto` (derived from `c2pa::Signer`) (#716)
* Move time stamp code into c2pa-crypto (#696)
* Adds ValidationState support (#701)
* Introduce `DynamicAssertion` trait (#566)

### Fixed

* Compile `c2pa-crypto` with `cargo check` (#768)
* Verbose assertions for `is_none()` (#704)
* Remove `c2pa::Signer` dependency on `c2pa_crypto::TimeStampProvider` (#718)
* Add support for MP3 without ID3 header (#652)
* Treat Unicode-3.0 license as approved; unpin related dependencies (#693)
* Remote manifest fetch test was not using full path (#675)
* Fix #624 (edge cases when combining the box hashes) (#625)
* Fix #672, Callback is unsound (#674)
* Support "remote_manifest_fetch" verify setting (#667)

### Updated dependencies

* Bump chrono from 0.4.38 to 0.4.39 (#763)
* Bump asn1-rs from 0.5.2 to 0.6.2 (#724)
* Bump mockall requirement from 0.11.2 to 0.13.1 in /sdk (#685)
* Update zip requirement from 0.6.6 to 2.2.1 in /sdk (#698)

## [0.39.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.38.0...c2pa-v0.39.0)
_13 November 2024_

### Added

* Factor status tracking infrastructure into its own crate ([#665](https://github.com/contentauth/c2pa-rs/pull/665))

### Fixed

* Fixed a typo in ManifestDefinition docstring ([#639](https://github.com/contentauth/c2pa-rs/pull/639))

## [0.38.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.37.1...c2pa-v0.38.0)
_06 November 2024_

### Added

* Add fragmented mp4 Builder and Reader support ([#649](https://github.com/contentauth/c2pa-rs/pull/649))
* Associate ingredients with actions using parameters.org.cai.ingredientsIds array ([#627](https://github.com/contentauth/c2pa-rs/pull/627))

### Fixed

* Stay on url version 2.5.2 until Unicode-3.0 license can be approved ([#654](https://github.com/contentauth/c2pa-rs/pull/654))

## [0.37.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.37.0...c2pa-v0.37.1)
_24 October 2024_

### Documented

* Update API documentation ([#621](https://github.com/contentauth/c2pa-rs/pull/621))

## [0.37.0](https://github.com/contentauth/c2pa-rs/compare/v0.36.4...v0.37.0)
_17 October 2024_

### Fixed

* Adds identified RangeType to region of interest ([#631](https://github.com/contentauth/c2pa-rs/pull/631))

## [0.36.4](https://github.com/contentauth/c2pa-rs/compare/v0.36.3...v0.36.4)
_15 October 2024_

### Fixed

* Harden SDK against attempting buffers that are too large ([#628](https://github.com/contentauth/c2pa-rs/pull/628))

## [0.36.3](https://github.com/contentauth/c2pa-rs/compare/v0.36.2...v0.36.3)
_07 October 2024_

### Fixed

* Changelog contained duplicate entries for 0.16.1 ([#618](https://github.com/contentauth/c2pa-rs/pull/618))

## [0.36.2](https://github.com/contentauth/c2pa-rs/compare/v0.36.1...v0.36.2)
_07 October 2024_

* No-op change to start using release-plz to manage releases

## 0.36.1
_04 October 2024_

* fix: Make sure algorithm is being respected in data_hash.rs ([#613](https://github.com/contentauth/c2pa-rs/pull/613))
* fix: Make sure RSTn segment names are included in the data box hashes list ([#612](https://github.com/contentauth/c2pa-rs/pull/612))
* Update mp4 requirement from 0.13.0 to 0.14.0 in /sdk ([#595](https://github.com/contentauth/c2pa-rs/pull/595))
* chore: Add m4a test ([#606](https://github.com/contentauth/c2pa-rs/pull/606))
* fix: Write absolute urls to manifest store resource references. ([#603](https://github.com/contentauth/c2pa-rs/pull/603))
* doc: Removes xmp_write feature from README.md.
* chore: Remove deprecated actions-rs/clippy-check action ([#601](https://github.com/contentauth/c2pa-rs/pull/601))
* chore: bump stefanzweifel/git-auto-commit-action from 4 to 5 ([#600](https://github.com/contentauth/c2pa-rs/pull/600))
* chore: bump actions/github-script from 3 to 7 ([#599](https://github.com/contentauth/c2pa-rs/pull/599))
* chore: bump paulhatch/semantic-version from 5.2.1 to 5.4.0 ([#598](https://github.com/contentauth/c2pa-rs/pull/598))
* chore: Use Dependabot to upgrade GitHub Actions steps ([#597](https://github.com/contentauth/c2pa-rs/pull/597))
* chore: Fix dependabot issues ([#594](https://github.com/contentauth/c2pa-rs/pull/594))
* Fixes issue where nested assertion-uri-hash errors were being reported at the active manifest level. ([#593](https://github.com/contentauth/c2pa-rs/pull/593))
* Feature/add content length to tsa request ([#587](https://github.com/contentauth/c2pa-rs/pull/587))

## 0.36.0
_23 September 2024_

* (MINOR) ensures release bumps minor version ([#592](https://github.com/contentauth/c2pa-rs/pull/592))
* fix: requires "StatusTracker" to implement "Send" ([#589](https://github.com/contentauth/c2pa-rs/pull/589))

## 0.35.1
_17 September 2024_

* Fix error when trying to sign BMFF content with Builder. ([#582](https://github.com/contentauth/c2pa-rs/pull/582))

## 0.35.0
_12 September 2024_

* upgrades to riff@2.0.0, preventing panic on invalid riff files ([#579](https://github.com/contentauth/c2pa-rs/pull/579))
* EC signature DER support ([#581](https://github.com/contentauth/c2pa-rs/pull/581))
* Update base64 requirement from 0.21.2 to 0.22.1 in /sdk ([#519](https://github.com/contentauth/c2pa-rs/pull/519))
* (MINOR) Rust API enhancements and fixes. ([#575](https://github.com/contentauth/c2pa-rs/pull/575))
* Fix GIF off by one with XMP ([#562](https://github.com/contentauth/c2pa-rs/pull/562))

## 0.34.0
_30 August 2024_

* (MINOR) Fragmented BMFF media ([#572](https://github.com/contentauth/c2pa-rs/pull/572))

## 0.33.4
_29 August 2024_

* Depend on url crate version 2.5.2 or newer ([#573](https://github.com/contentauth/c2pa-rs/pull/573))

## 0.33.3
_17 August 2024_

* Inline certs for wasm test signer ([#564](https://github.com/contentauth/c2pa-rs/pull/564))

## 0.33.2
_15 August 2024_

* Bmff write fix ([#552](https://github.com/contentauth/c2pa-rs/pull/552))
* Fix remote embedding RIFF when specifying mime type ([#551](https://github.com/contentauth/c2pa-rs/pull/551))
* Fix data hash out of bounds when using placeholder beyond stream length ([#546](https://github.com/contentauth/c2pa-rs/pull/546))
* Adds embeddable apis and remote_url/no_embed options ([#537](https://github.com/contentauth/c2pa-rs/pull/537))
* export_schema: add unstable_api feature ([#542](https://github.com/contentauth/c2pa-rs/pull/542))
* Ingredient checks ([#529](https://github.com/contentauth/c2pa-rs/pull/529))
* Add base_path field to Builder ([#539](https://github.com/contentauth/c2pa-rs/pull/539))
* Export `AssertionDefinition` and `ActionTemplate` in public API ([#522](https://github.com/contentauth/c2pa-rs/pull/522))

## 0.33.1
_30 July 2024_

* Use timestamp with OpenSSL validation to prevent check chain check er… ([#531](https://github.com/contentauth/c2pa-rs/pull/531))
* Fix GIF `remove_cai_store_from_stream` behavior ([#524](https://github.com/contentauth/c2pa-rs/pull/524))

## 0.33.0
_26 July 2024_

* Update crate to fix bad certificate dump content ([#525](https://github.com/contentauth/c2pa-rs/pull/525))
* Introduce a mutex around the FFI calls to OpenSSL ([#516](https://github.com/contentauth/c2pa-rs/pull/516))
* Bump bcder minimum version to 0.7.3 ([#526](https://github.com/contentauth/c2pa-rs/pull/526))
* (MINOR) Updates needed for v2 JavaScript SDK ([#521](https://github.com/contentauth/c2pa-rs/pull/521))
* Add region of interest assertion definition ([#506](https://github.com/contentauth/c2pa-rs/pull/506))
* Fix CI tests ([#520](https://github.com/contentauth/c2pa-rs/pull/520))
* Builder Archive update ([#507](https://github.com/contentauth/c2pa-rs/pull/507))
* Update range-set requirement from 0.0.9 to 0.0.11 in /sdk ([#442](https://github.com/contentauth/c2pa-rs/pull/442))
* Make sure reading past end of JUMBF box is an error ([#518](https://github.com/contentauth/c2pa-rs/pull/518))
* added final details ([#517](https://github.com/contentauth/c2pa-rs/pull/517))

## 0.32.7
_18 July 2024_

* Ensure Ingredient data_types make it to the store and back. ([#514](https://github.com/contentauth/c2pa-rs/pull/514))
* draft security md ([#508](https://github.com/contentauth/c2pa-rs/pull/508))
* Make data_types field optional when serializing data-box-map ([#512](https://github.com/contentauth/c2pa-rs/pull/512))
* Fix box hash placeholder len (set to 1) ([#511](https://github.com/contentauth/c2pa-rs/pull/511))
* Set data box placeholder len to at least 1 for GIF ([#510](https://github.com/contentauth/c2pa-rs/pull/510))
* Rewind mp3 streams when reading/writing ([#509](https://github.com/contentauth/c2pa-rs/pull/509))
* Update README.md ([#351](https://github.com/contentauth/c2pa-rs/pull/351))
* Add GIF support ([#489](https://github.com/contentauth/c2pa-rs/pull/489))
* Update image requirement from 0.24.7 to 0.25.1 in /make_test_images ([#445](https://github.com/contentauth/c2pa-rs/pull/445))
* Upgrade uuid to 1.7.0 & fix removed wasm-bindgen feature ([#450](https://github.com/contentauth/c2pa-rs/pull/450))
* Expose `SignatureInfo` publicly ([#501](https://github.com/contentauth/c2pa-rs/pull/501))
* Cleanup empty/unused files + lints ([#500](https://github.com/contentauth/c2pa-rs/pull/500))

## 0.32.6
_15 July 2024_

* Fetching of databoxes must always use HashedURI to enforce hash checks. ([#505](https://github.com/contentauth/c2pa-rs/pull/505))
* Temporarily allow unused `JsonAssertionData` to fix unused error in CI ([#498](https://github.com/contentauth/c2pa-rs/pull/498))
* Add remote manifest support to MP3 ([#496](https://github.com/contentauth/c2pa-rs/pull/496))

## 0.32.5
_28 June 2024_

* (PATCH) ensures temp files are removed ([#494](https://github.com/contentauth/c2pa-rs/pull/494))
* Update async_generic to 1.1 ([#493](https://github.com/contentauth/c2pa-rs/pull/493))

## 0.32.4
_25 June 2024_

* Add data_type (future) to Ingredient_V2 ([#490](https://github.com/contentauth/c2pa-rs/pull/490))
* Let's not assume that third-party assertions are using serde_cbor ([#491](https://github.com/contentauth/c2pa-rs/pull/491))

## 0.32.3
_24 June 2024_

* External placed manifest ([#472](https://github.com/contentauth/c2pa-rs/pull/472))
* Support metadata field in claims. ([#488](https://github.com/contentauth/c2pa-rs/pull/488))

## 0.32.2
_19 June 2024_

* Add iterators over manifests and resources in unstable API ([#482](https://github.com/contentauth/c2pa-rs/pull/482))
* OCSP certificate should be valid at signing time ([#481](https://github.com/contentauth/c2pa-rs/pull/481))
* url crate version 2.5.1 introduces new license "Unicode-3.0" ([#483](https://github.com/contentauth/c2pa-rs/pull/483))
* Implement `Debug` w/ detailed manifest for `Reader` ([#473](https://github.com/contentauth/c2pa-rs/pull/473))
* Bump MSRV to 1.74 ([#478](https://github.com/contentauth/c2pa-rs/pull/478))
* Allow empty Merkle proof for last leaf node. ([#470](https://github.com/contentauth/c2pa-rs/pull/470))

## 0.32.1
_10 May 2024_

* Steps toward removing RemoteSigner APIs. ([#466](https://github.com/contentauth/c2pa-rs/pull/466))

## 0.32.0
_07 May 2024_

* (Minor) Additional unit tests and fixes for injection (or previously untested) issues. ([#464](https://github.com/contentauth/c2pa-rs/pull/464))
* Expose authoring support in WASM ([#369](https://github.com/contentauth/c2pa-rs/pull/369))
* Move signer to first parameter on Builder.sign ([#457](https://github.com/contentauth/c2pa-rs/pull/457))
* Gpeacock/embed_remote_settings ([#460](https://github.com/contentauth/c2pa-rs/pull/460))
* (MINOR) Removes xmp_write feature and xmp_toolkit ([#461](https://github.com/contentauth/c2pa-rs/pull/461))
* Async Signer: add support for async OCSP call ([#458](https://github.com/contentauth/c2pa-rs/pull/458))
* Use cargo test in CI ([#459](https://github.com/contentauth/c2pa-rs/pull/459))
* (MINOR) Initial V2 API work ([#437](https://github.com/contentauth/c2pa-rs/pull/437))

## 0.31.3
_05 April 2024_

* Add `video/quicktime` to the list of BMFF MIME types ([#441](https://github.com/contentauth/c2pa-rs/pull/441))
* Streaming XMP write support for PNG ([#439](https://github.com/contentauth/c2pa-rs/pull/439))

## 0.31.2
_03 April 2024_

* Fixed temp file auto delete ([#438](https://github.com/contentauth/c2pa-rs/pull/438))
* Add `Sync` trait to `TrustHandlerConfig` ([#440](https://github.com/contentauth/c2pa-rs/pull/440))
* remove file_io dependency on fetch_remote_manifests ([#434](https://github.com/contentauth/c2pa-rs/pull/434))
* Remove verify after signing when compiling without openssl ([#404](https://github.com/contentauth/c2pa-rs/pull/404))
* Streaming write support for BMFF ([#435](https://github.com/contentauth/c2pa-rs/pull/435))
* Added support for XMP streaming writes for TIFF/DNG ([#433](https://github.com/contentauth/c2pa-rs/pull/433))
* Implements embed_reference_to_stream for jpeg ([#430](https://github.com/contentauth/c2pa-rs/pull/430))

## 0.31.1
_25 March 2024_

* Adds Action changes field as option vec of serde_json value ([#431](https://github.com/contentauth/c2pa-rs/pull/431))

## 0.31.0
_13 March 2024_

* (MINOR) Adds Send trait to TrustHandlerConfig ([#426](https://github.com/contentauth/c2pa-rs/pull/426))

## 0.30.3
_12 March 2024_

* Roll back rasn-* version requirements since 0.12.6 was yanked ([#425](https://github.com/contentauth/c2pa-rs/pull/425))

## 0.30.2
_12 March 2024_

* Adds a Manifest::composed manifest method ([#424](https://github.com/contentauth/c2pa-rs/pull/424))
* Allow cert dump to work in WASM ([#420](https://github.com/contentauth/c2pa-rs/pull/420))
* Update minimum dependency of rasn-* crates ([#423](https://github.com/contentauth/c2pa-rs/pull/423))

## 0.30.1
_08 March 2024_

* Fix include_byte references that were not available in external crate builds

## 0.30.0
_08 March 2024_

* (MINOR) Remove testing function that was inadvertently public ([#421](https://github.com/contentauth/c2pa-rs/pull/421))

## 0.29.3
_08 March 2024_

* Trust support ([#415](https://github.com/contentauth/c2pa-rs/pull/415))

## 0.29.2
_08 March 2024_

* add a thumb resource when referencing an embedded uri ([#419](https://github.com/contentauth/c2pa-rs/pull/419))

## 0.29.1
_07 March 2024_

* Adds Manifest.remote_manifest_url() (CAI-5437) ([#418](https://github.com/contentauth/c2pa-rs/pull/418))
* Fix use of deprecated method `chrono::NaiveDateTime::timestamp` ([#417](https://github.com/contentauth/c2pa-rs/pull/417))
* Fix up some random typos. ([#353](https://github.com/contentauth/c2pa-rs/pull/353))

## 0.29.0
_26 February 2024_

* SDK configuration settings support (infrastructure) ([#408](https://github.com/contentauth/c2pa-rs/pull/408))
* Support streaming writes for TIFF ([#410](https://github.com/contentauth/c2pa-rs/pull/410))
* Fixed typo in comment ([#409](https://github.com/contentauth/c2pa-rs/pull/409))
* (MINOR) Update `xmp_toolkit` to v1.7.1, remove Ring dependency, fix build errors ([#407](https://github.com/contentauth/c2pa-rs/pull/407))
* Crate udate to fix jpeg parsing error ([#402](https://github.com/contentauth/c2pa-rs/pull/402))
* allows builds to pass ([#403](https://github.com/contentauth/c2pa-rs/pull/403))
* Ocsp support ([#371](https://github.com/contentauth/c2pa-rs/pull/371))

## 0.28.5
_06 February 2024_

* Finish async signing implementation for cose_sign ([#370](https://github.com/contentauth/c2pa-rs/pull/370))
* adds read_cai test for PDF with content credentials ([#366](https://github.com/contentauth/c2pa-rs/pull/366))
* [IGNORE] README edits ([#356](https://github.com/contentauth/c2pa-rs/pull/356))
* Update ci.yml
* Remove deprecated twoway crate ([#361](https://github.com/contentauth/c2pa-rs/pull/361))
* Fix response strings for BMFF and Box hash statuses ([#360](https://github.com/contentauth/c2pa-rs/pull/360))
* Restore correct 1.3 CoseSign1 headers ([#359](https://github.com/contentauth/c2pa-rs/pull/359))
* Openssl update to version 3.x ([#357](https://github.com/contentauth/c2pa-rs/pull/357))
* Add support for ARW and NEF ([#355](https://github.com/contentauth/c2pa-rs/pull/355))

## 0.28.4
_04 December 2023_

* CAI-5041 Clear Windows temp attribute ([#352](https://github.com/contentauth/c2pa-rs/pull/352))

## 0.28.3
_22 November 2023_

* Remove Blake3 dependency from c2pa-rs ([#348](https://github.com/contentauth/c2pa-rs/pull/348))

## 0.28.2
_21 November 2023_

* Fix PDF reading of manifest from wrong key ([#346](https://github.com/contentauth/c2pa-rs/pull/346))

## 0.28.1
_17 November 2023_

* readme update ([#345](https://github.com/contentauth/c2pa-rs/pull/345))
* Add support for embeddable manifests with RemoteSigner ([#344](https://github.com/contentauth/c2pa-rs/pull/344))
* Blake build fix ([#343](https://github.com/contentauth/c2pa-rs/pull/343))
* Update image crate dependency and limit features ([#341](https://github.com/contentauth/c2pa-rs/pull/341))
* Bump xmp_toolkit requirement to 1.6 ([#339](https://github.com/contentauth/c2pa-rs/pull/339))
* Disable Windows builds with latest Rust version ([#342](https://github.com/contentauth/c2pa-rs/pull/342))

## 0.28.0
_01 November 2023_

* (PATCH) switches af relationship for a reference to the c2pa data to an array of references, one of which is the c2pa spec ([#333](https://github.com/contentauth/c2pa-rs/pull/333))
* Restore async versions of embed functions ([#327](https://github.com/contentauth/c2pa-rs/pull/327))
* (MINOR) Support databox thumbnails CAI-4142 ([#325](https://github.com/contentauth/c2pa-rs/pull/325))
* (MINOR) Reuse claim thumbnail as ingredient thumbnail if the store is valid ([#322](https://github.com/contentauth/c2pa-rs/pull/322))
* (MINOR) Use JUMBF URIs for ManifestStore identifiers ([#323](https://github.com/contentauth/c2pa-rs/pull/323))
* Add ManifestStore::from_stream ([#319](https://github.com/contentauth/c2pa-rs/pull/319))
* Adds embed_to_stream ([#313](https://github.com/contentauth/c2pa-rs/pull/313))

## 0.27.1
_04 October 2023_

* Support for validating JPEGs that contain MPF (multi-picture format). ([#317](https://github.com/contentauth/c2pa-rs/pull/317))
* Add ability to customize HTTP headers on timestamp request to Signer and AsyncSigner traits ([#315](https://github.com/contentauth/c2pa-rs/pull/315))
* Add all of the MIME types that are associated with WAV files ([#316](https://github.com/contentauth/c2pa-rs/pull/316))
* Allow MS_C2PA_SIGNING OID to pass ([#314](https://github.com/contentauth/c2pa-rs/pull/314))

## 0.27.0
_29 September 2023_

* supports removal of manifests from pdf ([#312](https://github.com/contentauth/c2pa-rs/pull/312))
* Support for MP3 ([#295](https://github.com/contentauth/c2pa-rs/pull/295))
* (MINOR) Signer can call timestamp authority directly ([#311](https://github.com/contentauth/c2pa-rs/pull/311))
* implements pdf read support ([#309](https://github.com/contentauth/c2pa-rs/pull/309))

## 0.26.0
_13 September 2023_

* Add support for default SVG MIME type ([#305](https://github.com/contentauth/c2pa-rs/pull/305))
* Support for writing and reading manifest data from simple PDFs (without incremental updates or signatures) ([#249](https://github.com/contentauth/c2pa-rs/pull/249))
* Increase actix requirement to 0.13.1 ([#304](https://github.com/contentauth/c2pa-rs/pull/304))
* (MINOR) Expose HashRange ([#300](https://github.com/contentauth/c2pa-rs/pull/300))
* Lock openssl-sys version to 0.9.92 ([#302](https://github.com/contentauth/c2pa-rs/pull/302))
* Update links to C2PA spec to 1.3 ([#292](https://github.com/contentauth/c2pa-rs/pull/292))
* Error saving stream writes ([#290](https://github.com/contentauth/c2pa-rs/pull/290))
* Fix for overly harsh checks when checking Merkle trees. ([#289](https://github.com/contentauth/c2pa-rs/pull/289))

## 0.25.2
_02 August 2023_

* Adds a way to force no claim thumbnail generation ([#288](https://github.com/contentauth/c2pa-rs/pull/288))
* adds ManifestStoreReport::cert_chain_from_bytes ([#286](https://github.com/contentauth/c2pa-rs/pull/286))

## 0.25.1
_14 July 2023_

* Expose DataHash and BoxHash to public SDK ([#284](https://github.com/contentauth/c2pa-rs/pull/284))
* Remove debug statement ([#283](https://github.com/contentauth/c2pa-rs/pull/283))

## 0.25.0
_14 July 2023_

* (MINOR) User, UserCbor and Uuid assertions removed from SDK ([#141](https://github.com/contentauth/c2pa-rs/pull/141))
* Fix for #195 make_test_images missing ingredient references ([#254](https://github.com/contentauth/c2pa-rs/pull/254))
* Return ResourceNotFound  instead of NotFound for resource get ([#279](https://github.com/contentauth/c2pa-rs/pull/279))
* (MINOR) Minor improvements for Wasm and Node.js interoperability ([#276](https://github.com/contentauth/c2pa-rs/pull/276))
* Fix iloc extent_offsets when offset_size is 0 ([#277](https://github.com/contentauth/c2pa-rs/pull/277))
* (MINOR) Converts DataHash and BoxHash methods to use RemoteSigner instead of AsyncSigner ([#280](https://github.com/contentauth/c2pa-rs/pull/280))
* (MINOR) Embeddable manifest support ([#266](https://github.com/contentauth/c2pa-rs/pull/266))
* Repair CI tests ([#278](https://github.com/contentauth/c2pa-rs/pull/278))

## 0.24.0
_21 June 2023_

* (MINOR) force minor version change ([#273](https://github.com/contentauth/c2pa-rs/pull/273))

## 0.23.3
_21 June 2023_

* Bump minor version and update README.md ([#272](https://github.com/contentauth/c2pa-rs/pull/272))
* Updates ([#270](https://github.com/contentauth/c2pa-rs/pull/270))
* Add `Send` to `CAIRead` trait so that it can be used across threads ([#271](https://github.com/contentauth/c2pa-rs/pull/271))
* Generate old COSE headers for temporary backwards support ([#269](https://github.com/contentauth/c2pa-rs/pull/269))

## 0.23.2
_19 June 2023_

* Fix for returning input stream data when using `embed_from_memory` ([#268](https://github.com/contentauth/c2pa-rs/pull/268))

## 0.23.1
_13 June 2023_

* Remove no-default ci test ([#259](https://github.com/contentauth/c2pa-rs/pull/259))
* includes the cert serial number in the ValidationInfo output ([#263](https://github.com/contentauth/c2pa-rs/pull/263))
* adds ManifestStoreReport::cert_chain ([#265](https://github.com/contentauth/c2pa-rs/pull/265))
* Update Timestamp message imprint to include entire protected header ([#264](https://github.com/contentauth/c2pa-rs/pull/264))

## 0.23.0
_09 June 2023_

* Box hash support ([#261](https://github.com/contentauth/c2pa-rs/pull/261))
* Fix timestamp Accuracy decoding ([#262](https://github.com/contentauth/c2pa-rs/pull/262))
* Make remote manifest handling consistent across input types ([#260](https://github.com/contentauth/c2pa-rs/pull/260))
* (MINOR) Support for Ingredients V2 and Actions V2 ([#258](https://github.com/contentauth/c2pa-rs/pull/258))
* Generate and validate 1.3 Cose signatures ([#256](https://github.com/contentauth/c2pa-rs/pull/256))
* Add type exports via JSON Schema ([#255](https://github.com/contentauth/c2pa-rs/pull/255))
* Bmff v2 ([#251](https://github.com/contentauth/c2pa-rs/pull/251))

## 0.22.0
_18 May 2023_

* (MINOR) Improved Remote Manifest handling ([#250](https://github.com/contentauth/c2pa-rs/pull/250))
* Riff streaming support ([#248](https://github.com/contentauth/c2pa-rs/pull/248))

## 0.21.0
_04 May 2023_

* (MINOR) Added ResourceNotFound error ([#244](https://github.com/contentauth/c2pa-rs/pull/244))

## 0.20.3
_03 May 2023_

* backed out calls to set_memory_thumbnail ([#243](https://github.com/contentauth/c2pa-rs/pull/243))
* Revert "backed out calls to set_memory_thumbnail"
* backed out calls to set_memory_thumbnail This was causing thumbnail files to not be generated.

## 0.20.2
_24 April 2023_

* Fixes bug in Ingredient_from_stream_info ([#241](https://github.com/contentauth/c2pa-rs/pull/241))

## 0.20.1
_20 April 2023_

* Ingredient async and thumbnail support ([#240](https://github.com/contentauth/c2pa-rs/pull/240))
* Update actix requirement from 0.11.0 to 0.13.0 in /sdk ([#209](https://github.com/contentauth/c2pa-rs/pull/209))
* Update uuid requirement from 0.8.1 to 1.3.1 in /sdk ([#237](https://github.com/contentauth/c2pa-rs/pull/237))
* Upgrade x509-parser to 0.15.0 ([#229](https://github.com/contentauth/c2pa-rs/pull/229))
* Add support for ARM on Linux ([#233](https://github.com/contentauth/c2pa-rs/pull/233))

## 0.20.0
_05 April 2023_

* (MINOR) SVG support ([#226](https://github.com/contentauth/c2pa-rs/pull/226))
* (MINOR) Update several X509-related crate dependencies ([#225](https://github.com/contentauth/c2pa-rs/pull/225))
* Update thiserror to 1.0.40 in /sdk ([#223](https://github.com/contentauth/c2pa-rs/pull/223))
* Avoid chrono's transitive dependency on time crate ([#222](https://github.com/contentauth/c2pa-rs/pull/222))
* Require openssl >0.10.48 to address multiple RUSTSEC warnings ([#221](https://github.com/contentauth/c2pa-rs/pull/221))
* Apply code format to doc comments ([#220](https://github.com/contentauth/c2pa-rs/pull/220))

## 0.19.1
_28 March 2023_

* Update README ([#215](https://github.com/contentauth/c2pa-rs/pull/215))

## 0.19.0
_23 March 2023_

* Makefile update ([#213](https://github.com/contentauth/c2pa-rs/pull/213))
* Streaming enhancement  ([#212](https://github.com/contentauth/c2pa-rs/pull/212))
* Adds base_path_take to ResourceStore ([#205](https://github.com/contentauth/c2pa-rs/pull/205))
* Add write support for HEIC, HEIF, AVIF ([#210](https://github.com/contentauth/c2pa-rs/pull/210))
* (MINOR) Riff support with refactored AssetIO ([#203](https://github.com/contentauth/c2pa-rs/pull/203))
* (MINOR) Resource format and is_parent / relationship changes ([#202](https://github.com/contentauth/c2pa-rs/pull/202))
* Fix hash algo warning in Wasm and hashing for RSA-PSS SHA-384/512 ([#206](https://github.com/contentauth/c2pa-rs/pull/206))
* Derive impl of Default for Relationship enum ([#204](https://github.com/contentauth/c2pa-rs/pull/204))

## 0.18.1
_07 March 2023_

* Update Validation Status codes ([#200](https://github.com/contentauth/c2pa-rs/pull/200))
* Fix async path to support ingredient box hashing ([#201](https://github.com/contentauth/c2pa-rs/pull/201))

## 0.18.0
_02 March 2023_

* Fix issue where value was inadvertently included in Exclusion structure ([#197](https://github.com/contentauth/c2pa-rs/pull/197))
* (MINOR) Bump MSRV to 1.63.0 ([#198](https://github.com/contentauth/c2pa-rs/pull/198))
* Fixed unit test failure (invalid unique name generation). ([#190](https://github.com/contentauth/c2pa-rs/pull/190))

## 0.17.0
_22 February 2023_

* Disable mdat exclusion ([#187](https://github.com/contentauth/c2pa-rs/pull/187))
* Bmff v2 ([#186](https://github.com/contentauth/c2pa-rs/pull/186))
* Fix for using non-c2pa segment when add required segments ([#185](https://github.com/contentauth/c2pa-rs/pull/185))
* Update Ingredient and VC hashes to 1.2 spec ([#184](https://github.com/contentauth/c2pa-rs/pull/184))
* (MINOR) Create a ResourceStore for binary assets  ([#180](https://github.com/contentauth/c2pa-rs/pull/180))
* Fix Clippy warnings from new Rust 1.67 ([#182](https://github.com/contentauth/c2pa-rs/pull/182))
* Visualizations ([#163](https://github.com/contentauth/c2pa-rs/pull/163))

## 0.16.1
_19 December 2022_

* Update xmp-toolkit from 0.6.0 to 1.0.0 ([#165](https://github.com/contentauth/c2pa-rs/pull/165))
* Address new Clippy warnings for Rust 1.66 ([#164](https://github.com/contentauth/c2pa-rs/pull/164))
* Create external manifests for unknown types ([#162](https://github.com/contentauth/c2pa-rs/pull/162))

## 0.16.0
_03 December 2022_

* Updates some cargo dependencies ([#159](https://github.com/contentauth/c2pa-rs/pull/159))
* makes manifest#add_redaction public; adds test ([#156](https://github.com/contentauth/c2pa-rs/pull/156))
* Fixes support for instanceId on action and generate parameters.ingredient field when possible ([#158](https://github.com/contentauth/c2pa-rs/pull/158))
* Support digitalSourceType field in Action ([#154](https://github.com/contentauth/c2pa-rs/pull/154))
* (MINOR) Add sign feature for signing manifests without file I/O ([#125](https://github.com/contentauth/c2pa-rs/pull/125))
* TIFF/DNG support ([#152](https://github.com/contentauth/c2pa-rs/pull/152))

## 0.15.0
_09 November 2022_

* Fix bad error response when manifest is stripped ([#153](https://github.com/contentauth/c2pa-rs/pull/153))
* (MINOR) Bump MSRV to 1.61 ([#142](https://github.com/contentauth/c2pa-rs/pull/142))
* Fix new Clippy warnings generated by Rust 1.65 ([#151](https://github.com/contentauth/c2pa-rs/pull/151))
* Build infrastructure improvements ([#150](https://github.com/contentauth/c2pa-rs/pull/150))
* Fix manifest.set_thumbnail when add_thumbnails is enabled ([#148](https://github.com/contentauth/c2pa-rs/pull/148))
* Fix for XMP links being mistaken for remote URLs ([#147](https://github.com/contentauth/c2pa-rs/pull/147))
* Upgrade xmp_toolkit to 0.6.0 ([#146](https://github.com/contentauth/c2pa-rs/pull/146))
* create jpeg thumbnails for pngs without alpha ([#145](https://github.com/contentauth/c2pa-rs/pull/145))
* Add test_embed_with_ingredient_err ([#134](https://github.com/contentauth/c2pa-rs/pull/134))

## 0.14.1
_04 October 2022_

* Add homepage and repository links to crates.io ([#132](https://github.com/contentauth/c2pa-rs/pull/132))
* Add Exif Assertion support ([#140](https://github.com/contentauth/c2pa-rs/pull/140))

## 0.14.0
_23 September 2022_

* (MINOR) Remove previously embedded manifests for remote manifests ([#136](https://github.com/contentauth/c2pa-rs/pull/136))
* (MINOR) Add support for manifest removal ([#123](https://github.com/contentauth/c2pa-rs/pull/123))

## 0.13.2
_21 September 2022_

* manifest_data was missing for remote manifests ([#135](https://github.com/contentauth/c2pa-rs/pull/135))

## 0.13.1
_13 September 2022_

* Add ManifestStore::from_manifest_and_asset_bytes_async ([#130](https://github.com/contentauth/c2pa-rs/pull/130))

## 0.13.0
_26 August 2022_

* Add RemoteManifestUrl Error, returning url ([#120](https://github.com/contentauth/c2pa-rs/pull/120))
* Convert status_log error val to a string so that we can return full errors ([#121](https://github.com/contentauth/c2pa-rs/pull/121))
* Report failures from remote manifest fetch ([#116](https://github.com/contentauth/c2pa-rs/pull/116))
* Fast XMP extraction from PNG ([#117](https://github.com/contentauth/c2pa-rs/pull/117))
* Bump MSRV to 1.59.0 ([#118](https://github.com/contentauth/c2pa-rs/pull/118))
* Make sure there is  a single manifest store in the asset ([#114](https://github.com/contentauth/c2pa-rs/pull/114))
* (MINOR) Switch to "lib" for crate-type ([#113](https://github.com/contentauth/c2pa-rs/pull/113))

## 0.12.0
_16 August 2022_

* Update C2PA manifest store mime type ([#112](https://github.com/contentauth/c2pa-rs/pull/112))
* Updates Manifest API to support remote and external manifests ([#107](https://github.com/contentauth/c2pa-rs/pull/107))
* Support validating remote and external manifest stores ([#108](https://github.com/contentauth/c2pa-rs/pull/108))
* Fix build error when xmp_write is not defined ([#105](https://github.com/contentauth/c2pa-rs/pull/105))
* Fix box order for BMFF ([#104](https://github.com/contentauth/c2pa-rs/pull/104))
* Added support for external manifests ([#101](https://github.com/contentauth/c2pa-rs/pull/101))

## 0.11.3
_03 August 2022_

* Remove inadvertent 1.0.0 release from changelog ([#97](https://github.com/contentauth/c2pa-rs/pull/97))
* Treat 'meta' box as standard container ([#95](https://github.com/contentauth/c2pa-rs/pull/95))
* Fix for `sign_claim` masking error ([#96](https://github.com/contentauth/c2pa-rs/pull/96))

## 0.11.1
_01 August 2022_

* Bug fix: Ingredients with valid claims not reporting correct thumbnails ([#94](https://github.com/contentauth/c2pa-rs/pull/94))
* Update `make_test_images` to use timestamp authority ([#90](https://github.com/contentauth/c2pa-rs/pull/90))
* Fix bad response for case when there is no timestamp ([#89](https://github.com/contentauth/c2pa-rs/pull/89))

## 0.11.0
_21 July 2022_

* (MINOR) Add support for remotely generated CoseSign1 signatures ([#87](https://github.com/contentauth/c2pa-rs/pull/87))
* Optimize performance of large assets ([#84](https://github.com/contentauth/c2pa-rs/pull/84))

## 0.10.0
_20 July 2022_

* Add Unicode license to allow-list ([#85](https://github.com/contentauth/c2pa-rs/pull/85))
* (MINOR) `IngredientOptions` allow override of hash and thumbnail generation; image library is now a default feature ([#79](https://github.com/contentauth/c2pa-rs/pull/79))

## 0.9.1
_19 July 2022_

* Fix publish workflow ([#82](https://github.com/contentauth/c2pa-rs/pull/82))

## 0.9.0
_19 July 2022_

* (MINOR) Introduce a new `SigningAlg` enum ([#76](https://github.com/contentauth/c2pa-rs/pull/76))
* Support for asynchronous signing of claims ([#57](https://github.com/contentauth/c2pa-rs/pull/57))
* Adds an add_validation_status method to Ingredient ([#68](https://github.com/contentauth/c2pa-rs/pull/68))

## 0.8.1
_15 July 2022_

* Use rsa crate for RSA-PSS verification in Wasm ([#77](https://github.com/contentauth/c2pa-rs/pull/77))

## 0.8.0
_15 July 2022_

* Add a new API to provide access to COSE signing logic for external signers ([#75](https://github.com/contentauth/c2pa-rs/pull/75))
* (MINOR) Move crate-level functions for creating signers to new public `create_signer` mod ([#72](https://github.com/contentauth/c2pa-rs/pull/72))

## 0.7.2
_14 July 2022_

* Fix broken documentation build ([#74](https://github.com/contentauth/c2pa-rs/pull/74))

## 0.7.1
_14 July 2022_

* Configure docs.rs to include feature-gated items ([#73](https://github.com/contentauth/c2pa-rs/pull/73))
* Update XMP Toolkit to 0.5.0 ([#71](https://github.com/contentauth/c2pa-rs/pull/71))
* Refactor code to limit memory usage and remove data copies during hash generation ([#67](https://github.com/contentauth/c2pa-rs/pull/67))

## 0.7.0
_29 June 2022_

* (MINOR) Return specific errors for FileNotFound and UnsupportedType ([#62](https://github.com/contentauth/c2pa-rs/pull/62))

## 0.6.1
_28 June 2022_

* Fix up changelog noise
* Fix bug with multiple ingredients in `Manifest::from_store` ([#61](https://github.com/contentauth/c2pa-rs/pull/61))

## 0.6.0
_28 June 2022_

* (MINOR) Initial BMFF support ([#39](https://github.com/contentauth/c2pa-rs/pull/39))

## 0.5.2
_23 June 2022_

* Return assertion instance values starting at `1` instead of `2` ([#60](https://github.com/contentauth/c2pa-rs/pull/60))

## 0.5.1
_22 June 2022_

* Update thumbnail to be `Vec<u8>`, add serialization feature ([#59](https://github.com/contentauth/c2pa-rs/pull/59))
* Adds xmp_write feature to make xmp-toolkit inclusion optional ([#53](https://github.com/contentauth/c2pa-rs/pull/53))

## 0.5.0
_20 June 2022_

* (MINOR) Add asset attribute getters for manifest ([#56](https://github.com/contentauth/c2pa-rs/pull/56))
* (MINOR) Remove temp_signer from sdk; update docs and examples to use get_signer_from_files ([#52](https://github.com/contentauth/c2pa-rs/pull/52))
* (MINOR) Clean up client example; update actions and schema ([#51](https://github.com/contentauth/c2pa-rs/pull/51))

## 0.4.2
_16 June 2022_

* Fix bug in updating crate reference in README ([#50](https://github.com/contentauth/c2pa-rs/pull/50))

## 0.4.1
_16 June 2022_

* Fix bug in Cargo.toml updates ([#49](https://github.com/contentauth/c2pa-rs/pull/49))

## 0.4.0
_16 June 2022_

* Add status badges for CI validation, crates.io, and code coverage ([#46](https://github.com/contentauth/c2pa-rs/pull/46))
* Remove self-signed end-entity cert support ([#48](https://github.com/contentauth/c2pa-rs/pull/48))
* Add rustfmt toml to get edition 2018 formatting ([#36](https://github.com/contentauth/c2pa-rs/pull/36))
* (MINOR) Update from_bytes(_async) to return a Result ([#43](https://github.com/contentauth/c2pa-rs/pull/43))
* Adjust temp signer reserved sizes to account for large timestamps ([#45](https://github.com/contentauth/c2pa-rs/pull/45))
* Fix bug in verify_from_buffer ([#44](https://github.com/contentauth/c2pa-rs/pull/44))
* Remove cargo edit from publish workflow ([#42](https://github.com/contentauth/c2pa-rs/pull/42))
* Apply fix from c2patool publish workflow ([#40](https://github.com/contentauth/c2pa-rs/pull/40))
* Remove need for using OpenSSL to generate certs by using pre-generated certs ([#41](https://github.com/contentauth/c2pa-rs/pull/41))
* Update README and pull request template with formatting changes ([#38](https://github.com/contentauth/c2pa-rs/pull/38))

## 0.3.0
_08 June 2022_

* Make most jumbf_io functions crate private and move Store dependencies to Store ([#37](https://github.com/contentauth/c2pa-rs/pull/37))
* Remove c2patool source now that it's in its own repo ([#35](https://github.com/contentauth/c2pa-rs/pull/35))
* (MINOR) Update ManifestAssertion supporting instances ([#34](https://github.com/contentauth/c2pa-rs/pull/34))
* Export top level signing functions, hide other signature details ([#32](https://github.com/contentauth/c2pa-rs/pull/32))
* Add documentation for the `Actions` and `Metadata` assertions ([#30](https://github.com/contentauth/c2pa-rs/pull/30))
* Rework how c2patool is configured ([#28](https://github.com/contentauth/c2pa-rs/pull/28))
* Convert make_tests into a scriptable engine; rename to make_test_images ([#29](https://github.com/contentauth/c2pa-rs/pull/29))
* Update thiserror requirement from >= 1.0.20, < 1.0.26 to >= 1.0.20, < 1.0.32 in /sdk ([#9](https://github.com/contentauth/c2pa-rs/pull/9))
* Update base64 requirement from 0.12.2 to 0.13.0 in /sdk ([#10](https://github.com/contentauth/c2pa-rs/pull/10))
* Update range-set requirement from 0.0.7 to 0.0.9 in /sdk ([#13](https://github.com/contentauth/c2pa-rs/pull/13))
* Make Assertions opaque in the public SDK ([#22](https://github.com/contentauth/c2pa-rs/pull/22))
* Update c2pa requirement from 0.1 to 0.2 in /c2patool ([#23](https://github.com/contentauth/c2pa-rs/pull/23))

## 0.2.0
_26 May 2022_

* Fix dependency reference from c2patool crate to c2pa crate ([#21](https://github.com/contentauth/c2pa-rs/pull/21))
* (MINOR) Detailed API review for Ingredient struct ([#17](https://github.com/contentauth/c2pa-rs/pull/17))

## 0.1.3
_26 May 2022_

* Publish c2patool crate ([#20](https://github.com/contentauth/c2pa-rs/pull/20))
* Improve documentation ([#14](https://github.com/contentauth/c2pa-rs/pull/14))

## 0.1.2
_26 May 2022_

* No-op change to verify correct handling of PR numbers ([#19](https://github.com/contentauth/c2pa-rs/pull/19))
* Fix error in formatting changelog
* Fix missing links in changelog

## 0.1.1
_26 May 2022_

* Add Makefile for local testing ([#18](https://github.com/contentauth/c2pa-rs/pull/18))
* Add workflow for automatically releasing c2pa crate ([#16](https://github.com/contentauth/c2pa-rs/pull/16))
* Reduce fixtures size ([#15](https://github.com/contentauth/c2pa-rs/pull/15))
* Add codecov.io integration ([#4](https://github.com/contentauth/c2pa-rs/pull/4))
* Configure dependabot ([#8](https://github.com/contentauth/c2pa-rs/pull/8))
* Configure dependabot ([#7](https://github.com/contentauth/c2pa-rs/pull/7))
* Remove unnecessary steps from cargo-deny job ([#6](https://github.com/contentauth/c2pa-rs/pull/6))
* Update to latest GH Actions checkout action ([#5](https://github.com/contentauth/c2pa-rs/pull/5))
* Change ring license hash to decimal ([#3](https://github.com/contentauth/c2pa-rs/pull/3))

## 0.1.0
_23 May 2022_

* Initial public release
