Mar 2026v2.9.5

WebSocket transport

WebSocket mode with server push, capability tokens, DPoP-signed requests, and remote attestation challenge/response.

What shipped in WebSocket transport

WebSocket mode with server push, capability tokens, DPoP-signed requests, and remote attestation challenge/response.

WSS transport goes GA: the server can push revocations, alerts, and variable updates without polling.
Capability tokens replace per-call scopes; issued at handshake, refreshed on the socket.
DPoP request binding on every frame; keys rotate per session.
Remote attestation: the server issues a challenge, and the client responds with a signed hash chain over its runtime state.

Release notes go out on the first heartbeat after ship.

Mar 2026v2.9.5

WebSocket mode with server push, capability tokens, DPoP-signed requests, and remote attestation challenge/response.

WebSocket mode with server push, capability tokens, DPoP-signed requests, and remote attestation challenge/response.

WSS transport goes GA: the server can push revocations, alerts, and variable updates without polling.
Capability tokens replace per-call scopes; issued at handshake, refreshed on the socket.
DPoP request binding on every frame; keys rotate per session.
Remote attestation: the server issues a challenge, and the client responds with a signed hash chain over its runtime state.

Release notes go out on the first heartbeat after ship.