Release Notes

Pushed Authorization Requests (PAR). [SDKS-4235]

OAuth 2.0 Device Authorization Grant. [SDKS-4785]

Standardized JSON configuration. [SDKS-5066]

Added PollingCollector for DaVinci flows. [SDKS-4682]

Added QRCodeCollector for DaVinci flows. [SDKS-4680]

Added BooleanCollector to support Checkbox and Switch input types in DaVinci forms. [SDKS-4920]

Added ReadOnlyTextCollector for DaVinci forms. [SDKS-4928]

Added rich text and embedded link support to LabelCollector through new RichContent and RichContentReplacement types. [SDKS-4245]

Added support for phone number extensions in PhoneNumberCollector. [SDKS-4668]

Added PushError.pushNumberChallengeError to surface a distinct failure for Push Number Challenge responses. [SDKS-5115]

Added preferImmediatelyAvailableCredentials option to FIDO authentication to restrict the ceremony to locally-available credentials only, if they exist. [SDKS-5212]

Added AuthMigration module for migrating existing sessions from the legacy ForgeRock SDK. [SDKS-4773]

Added Page Node description, header, and footer support. [SDKS-4762]

Fixed permanent authentication failure after iCloud device migration caused by a Secure Enclave key mismatch. [SDKS-5172]

Fixed PingFido WebAuthn registration ignoring the configured displayName during passkey creation. [SDKS-5211]

Fixed PasswordCollector not handling nested password policies. [SDKS-4695]

Fixed PIN verification during device binding registration. [SDKS-5015]

Fixed Protect collector being triggered multiple times within a flow. [SDKS-4769]

Fixed browser close and reset logic. [SDKS-4717]

Fixed device binding authenticators incorrectly reporting as supported on the simulator. [SDKS-4836]

Fixed DeviceBindingConfig device name defaulting to the user-assigned name instead of the device model. [SDKS-4850]

Fixed DefaultDeviceIdentifier to reuse the legacy device identifier when available. [SDKS-4630]

Fixed Swift build failures caused by a platform bump and missing canImport guards. [SDKS-4916]

Fixed FIDO ceremony logs not routing through the workflow logger. [SDKS-4924]

Pushed Authorization Requests (PAR).

Standardized JSON configuration.

Added PollingCollector for DaVinci flows.

Added QrCodeCollector for DaVinci flows.

Added BooleanCollector and ValidatedBooleanCollector to support Checkbox input types in DaVinci forms.

Added PhoneNumberExtensionCollector for phone number fields that include an extension.

Added ValidatedPasswordCollector for password fields with embedded policy validation.

Added ImageCollector for IMAGE form fields in DaVinci forms.

Added subscribe method to journey and OIDC client instances.

Added WebAuthn conditional mediation (passkey autofill) support.

Added user.session() method for silent OIDC session verification (prompt=none).

Updated rich-text support of the ReadOnlyCollector to handle links in Translatable Rich Text (Forms).

Fixed RTK Query cache lookups in cache.getLatestResponse() and cache.getResponseWithId().

Fixed resume() to correctly forward redirect query parameters from the authorization response.

Fixed JourneyLoginFailure not being returned when the server sends a login failure response.

Pushed Authorization Requests (PAR). [SDKS-4231]

OAuth 2.0 Device Authorization Grant. [SDKS-4784]

Standardized JSON configuration. [SDKS-5065]

Android 17 support. [SDKS-5191]

Added PollingCollector for DaVinci flows. [SDKS-4681]

Added QrCodeCollector for DaVinci flows. [SDKS-4679]

Added BooleanCollector to support Checkbox and Switch input types in DaVinci forms. [SDKS-4919]

Added ReadOnlyTextCollector for DaVinci forms to support Terms of Service and agreement displays. [SDKS-4927]

Added support for links in Translatable Rich Text (Forms). [SDKS-4246]

Added support for phone number extensions in PhoneNumberCollector. [SDKS-4669]

Fixed OATH and Push URI parsers to propagate typed InvalidUriException for structural URI parse errors. [SDKS-5074]

Fixed Ktor CIO engine dropping repeated Set-Cookie headers with mixed casing (KTOR-8614 workaround). [SDKS-4742]

Fixed Push Number Challenge not surfacing a distinct failure for wrong-number responses. [SDKS-5116]

Fixed PasswordCollector not handling nested Password policies. [SDKS-4694]

The initial release of the Orchestration SDK for React Native is now available.

Upgraded bcpkix-jdk18on from 1.81 to 1.84 to address a security vulnerability (CVE-2026-5588).

The initial release of the Orchestration SDK for Android is now available with new features and additional support.

Added new network module. [SDKS-4505]

Added new mfa-commons module. [SDKS-4106]

Added new auth-migration module. [SDKS-4716]

Added new device-binding-migration modules. [SDKS-4115]

Added new device-id module. [SDKS-4120]

Added new device-root module. [SDKS-4365]

The initial release of the Orchestration SDK for iOS is now available with new features and additional support.

Added new PingNetwork module. [SDKS-4496]

Added new PingDeviceId module. [SDKS-4122]

Added new PingTamperDetector module. [SDKS-4366]

Added new PingJourneyPlugin and PingDavinciPlugin modules. [SDKS-4492]

Added new PingCommons module. [SDKS-4104]

Added support for core callbacks in the PingJourney module. [SDKS-4060]

Added support for native social login to Facebook, Google, and Apple in Advanced Identity Cloud and PingAM journeys. [SDKS-3898]

Added migration mechanism for existing device binding data from the ForgeRock SDK to the Orchestration SDK for iOS. [SDKS-4495]

Updated PingStorage module to allow multiple DaVinci/Journey instances to have separate cookies, sessions, and token storage. [SDKS-4588]

The initial release of the Orchestration SDK for JavaScript is now available with new features and additional support.

Added well-known OIDC endpoint discovery support.

Fixed error handling in the storage client and davinci-client.

Added support for PingOne Protect, by using the new PingProtect module. [SDKS-4069]

Added support for Android 16 and updated compileSdk to version 36 and minSdk to 29. [SDKS-4278]

Enhanced form handling in the DaVinci SDK to automatically reset form values after submission. [SDKS-4511]

Improved SDK storage configuration to simplify overrides. [SDKS-4109]

Enhanced Storage module with cache strategy support. [SDKS-4112]

Refactored logger initialization for session and cookie configurations. [SDKS-4358]

Updated PhoneNumberCollector to support new JSON format. [SDKS-4198]

Upgraded datastore library to version 1.1.7. [SDKS-4207]

Added support for the Ping Protect collector

Added support for pre-filled phone number and country code

Updated all targets to use the Swift 6 compiler. [SDKS-4499]

Fixed an issue in the PingProtect module causing a crash on iOS 17+ due to an incorrect actor executor assumption. [SDKS-4494]

Added support for PingOne Protect, by using the new PingProtect module. [SDKS-4073]

Updated to handle the country code format in the PhoneNumber collector. [SDKS-4199]

Redesigned and improved the PingExample app. [SDKS-4104]

Added support for native social login with Google and Facebook. [SDKS-3449]

Added support for PingOne Forms one-time passcode (MFA) components DEVICE_REGISTRATION, DEVICE_AUTHENTICATION, and PHONE_NUMBER. [SDKS-3562]

Added access to the previous ContinueNode node from an ErrorNode. [SDKS-3890]

Added access to the key attribute of LabelCollector. [SDKS-3957]

Added support for StrongBox when generating keys. [SDKS-4098]

Added support for native social login with Apple, Google, and Facebook. [SDKS-3450]

Added support for PingOne Forms one-time passcode (MFA) components DEVICE_REGISTRATION, DEVICE_AUTHENTICATION, and PHONE_NUMBER. [SDKS-3563]

Added access to the previous ContinueNode node from an ErrorNode. [SDKS-3891]

Added access to the key attribute of LabelCollector. [SDKS-3956]

Resolved an issue where cookies were incorrectly cleared from in-memory storage when requests contain a Set-Cookie header [SDKS-4189]

Renamed the PingExternal-idp module to PingExternalIdP. [SDKS-3958]

Added support for PingOne Forms one-time passcode (MFA) components DEVICE_REGISTRATION, DEVICE_AUTHENTICATION, and PHONE_NUMBER.

Added support for additional PingOne Form fields. [SDKS-3649]

Added an external-idp module to support social sign on with supported external IDPs by using browser redirects. [SDKS-3662]

Added Accept-Language header to support localization. [SDKS-3622]

Added ability to validate PingOne Form fields. [SDKS-3649]

Added support for default values in PingOne Form fields. [SDKS-3649]

Added an interface to access ErrorNode and validation errors. [SDKS-3649]

Added a browser module. [SDKS-3662]

Added dynamic environment switching in the test sample app. [SDKS-3642]

Fixed an issue affecting the global logger when configuring a logger in DaVinci client configuration. [SDKS-3616]

Added support for additional PingOne Form fields. [SDKS-3671, SDKS-3672]

Added an external-idp module to support social sign on with supported external IDPs by using browser redirects. [SDKS-3720, SDKS-3920]

Added Accept-Language header to support localization. [SDKS-3623]

Added ability to validate PingOne Form fields. [SDKS-3671, SDKS-3672]

Added support for default values in PingOne Form fields. [SDKS-3674]

Added a PingBrowser module. [SDKS-3920]

Added Swift 6 support. [SDKS-3728]

Added support for additional PingOne Form fields.

Added support for social sign on with supported external IDPs.

Added the ability to call start with query parameters which the DaVinci client appends to the /authorize call.

Added request middleware to amend outgoing HTTP requests, for example to override Accept-Language headers.

Added ability to validate PingOne Form fields.

Added support for default values in PingOne Form fields.

Updated dependency on @forgerock/javascript-sdk to 4.7.0.

Updated error node to now be submittable to help the app recover from an error state.

Updated the checks to determine what node state the DaVinci Client is in based on the response from PingOne.

Initial release of the DaVinci client for Android.

Initial release of the DaVinci client for iOS.

Initial release of the DaVinci client JavaScript.