The HttpClient through which you usually make all API calls to servers, can now accept self-signed TLS certs when you explicitly tell it to. This was a required addition to continue working on sonata, our home server, because the IdP software (comparable to a database specifically for storing user accounts and passwords, so that we don't have to worry about this and potentially screw it up ourselves) we are using to test exclusively serves traffic in an encrypted manner, even on localhost.
On the cryptography side, the PublicKey trait gained a to_hex() method to quickly access a hex-encoded DER representation of any public key BitString, and we finally landed PURR-2026-0010, enforcing JSON canonicalization end-to-end (both when sending data and when checking what comes in, exactly as the spec wants). The ID-Cert's BasicConstraints also got some much needed love, with new functions validate() , is_valid_for_actor() , and is_valid_for_home_server() covering RFC 5280 well-formedness and polyproto’s own constraint rules, easily accessible and implemented right in the reference crate.
Last but not least, I got to delete a lot of code by delegating some ASN.1/DER (basically a special, ancient, programming language agnostic data representation/layouting language, used by X.509 certificates) I previously implemented myself to crates we already depended on, and provided reference-checked implementations of exactly these things for us the whole time. This also discovered, then promptly resolved a lot of tiny but mean bugs around this kind of parsing, that we seem to have had before
1
1
1
1
1
1