Table of Contents

Release Notes

Version 2.6 (October-2026)

  • New: Application configuration. Keep the settings of your application - server URL, database connections, passwords - in a JSON file beside the executable and read them from anywhere with TConfiguration.​Current, with no setup code. The same executable runs unchanged in development, test and production: each deployment overrides only what differs, using environment variables, as Docker and cloud platforms expect.

  • New: JWT tokens can now be signed and validated using OpenSSL 3. Add the new Bcl.OpenSsl.Jose unit to your project and RSA (RS256/RS384/RS512, PS256/PS384/PS512) and ECDSA (ES256/ES256K/ES384/ES512) signing works against the OpenSSL version that current Windows, Linux and macOS systems actually ship, with no dependency on Indy. Until now this needed the OpenSSL 1.0 libraries, which reached end of life in 2019 and are absent from modern systems; applications that still deploy them keep working unchanged, as the previous implementation is used whenever OpenSSL 3 cannot be loaded.

  • New: JSON Web Key (JWK) support, through TJSONWebKey and TJSONWebKeySet. A JWK is the standard JSON representation of a cryptographic key, and a JWK Set is how an identity server publishes the public keys it signs tokens with. You can now read such a document, let the library pick the key a given token was signed with, convert keys between JWK and PEM, and compute the standard key fingerprint (RFC 7638 thumbprint). Keys of a type the library does not support, such as the Ed25519 keys some identity servers now publish, are skipped, so the rest of the set remains usable.

  • New: RSASSA-PSS signing (PS256, PS384, PS512). PSS is the modern RSA signature scheme, recommended over the older RS* algorithms for new applications and required by some identity providers.

  • New: TJOSE.VerifyOrRaise raises an exception when a token does not verify, so a token it returns is always one that checked out. TJOSE.Verify still returns a token whose Verified property has to be tested.

  • Improved: The JOSE/JWT library was updated to the latest files of the Delphi JOSE JWT library (https://github.com/paolo-rossi/delphi-jose-jwt), which we use as a base for our implementation. Its license changed from Apache 2.0 to MIT.

  • Fixed: Unsigned tokens (alg=none) were accepted by a consumer that had not explicitly listed the algorithms it expects. They are no longer accepted by default. See Breaking Changes.

  • Fixed: A consumer kept alive for a long time went on accepting expired tokens, because it evaluated every token against the time of its first validation instead of the current time.

  • Fixed: A PEM public key was accepted as an HMAC shared secret. Anyone holding the public key of an RS256 issuer could therefore forge an HS256 token that such a verifier would accept.

  • Fixed: The signing key was not validated in TJOSE.Verify, TJOSE.DeserializeCompact and the producer API, so a key too short for the chosen algorithm was used without complaint.

  • Fixed: Signatures were compared byte by byte with an early exit, which leaks information about the expected value through the time taken. The comparison is now constant time.

  • Fixed: Token parts were accepted with padding, whitespace, line breaks and other spellings that are not valid base64url, so the same token had many accepted wire forms.

  • Fixed: Whole numbers in a token above 2^53 lost precision when read, which could corrupt identifier-like claims.

  • Fixed: Exception messages raised during validation could contain the token's claims and signature, which routinely end up in log files.

  • Fixed: An access violation could occur after a token failed to parse.

  • Fixed: Registering the cryptography providers was not thread-safe.

  • Fixed: Conversions between time units were inaccurate, which could shift the expiration of a token.

Version 2.5 (September-2026)

Version 2.4 (September-2026)

  • Fixed: TDelphiCodeGenerator generated invalid code when the "true" branch of an if statement was a single statement that could swallow the else clause (a dangling else). Such branches are now wrapped in begin..end.

Version 2.3 (August-2026)

Version 2.2 (July-2026)

  • New: JOSE/JWT library updated to match the latest files of Delphi JOSE JWT library (https://github.com/paolo-rossi/delphi-jose-jwt), which we use as a base for our implementation. This includes various internal improvements and bug fixes that have been made upstream since our last sync, listed below for reference.

  • New: Support for X.509 certificate-based JWS signature verification. TJWS now provides a SetKeyFromCert method that extracts the public key from a PEM-encoded X.509 certificate, allowing VerifySignature to validate JWT signatures issued with certificate-bound keys.

  • New: TJWTClaims.ClaimExists is now a public method, enabling callers to check whether a named claim is present in the token without going through internal accessors.

  • New: TJSONUtils.SetJSONRttiValue now handles dynamic array values, so JWT claims that carry array-typed RTTI values are correctly serialized to JSON.

  • New: Added TJOSEBytes.IsValidString and TJSONUtils.IsValidJSON utility methods for safer token-part validation before deserialization.

  • New: Added TJSONUtils.IsJSONBool and TJSONUtils.GetJSONBool helper methods for reading JSON boolean values, and updated GetJSONValue to handle booleans correctly.

  • Improved: TJWS.CheckCompactToken now performs stricter validation: each decoded token part is verified to be a valid UTF-8 string and well-formed JSON before the token is accepted.

  • Improved: Error messages produced during JWT validation now include more descriptive details to simplify diagnosis of token failures.

  • Fixed: Corrected a Pointer/Integer cast that caused incorrect behavior on 64-bit platforms.

Version 2.1 (April-2026)

  • New: Support for WinArm64EC platform, introduced in Delphi 13.1.

  • Fixed: TLogManager.Release now uses an atomic exchange to nil the singleton reference before freeing it, preventing a potential race condition where a concurrent thread could obtain and use the instance while it was being destroyed.

Version 2.0 (February-2026)

  • New: Full documentation for TMS BIZ Core Library. Major aspects of the library are now documented, including the JSON framework, core types, logging, internationalization, and code generation features. Also a full API reference is available detailing all public types and members.