# /n software 3-D Secure Changelog This document provides high-level information about new features, fixes, and functionality changes between minor versions releases of /n software 3-D Secure. For more details or if you have any questions please contact --- **Legend:** [FIX] - An issue was fixed. [NEW] - New feature or functionality added. [IMPORTANT] - A change which requires attention. --- Version: 2.4.9637 Date: May 21, 2026 - [NEW] Added `AlwaysAllowInformationalOnlyTransactionStatus` configuration setting. By default, the component will allow a TransactionStatus value of I when the `RequestorChallengeInd` config was set to 05, 06, 07, or in the DS-reserved range, and using any other value would result in an error while parsing the ARes. Setting this to True will always allow a value of I in the ARes. --- Version: 2.4.9342 Date: July 30, 2025 - [FIX] Fixed issue where component would not process card ranges with a threeDSMethodURL containing an all-caps URL scheme (e.g. HTTPS://). --- Version: 2.4.9285 Date: June 3, 2025 - [IMPORTANT] The default threeDSServerRefNumber (`ServeRefNumber` config) used has been updated to the latest one issued to /n software by EMVCo. The value is 3DS_LOA_SER_NSOF_020301_01042 and expires on May 22th, 2027. --- Version: 2.3.9134 Date: January 3, 2025 - [FIX] Resolved an issue where `SerialNumber` was not reset as expected when retrieving card ranges in conjunction with the `CardRangeTempPath` configuration setting. - [FIX] Resolved an issue where missing fields were not validated when retrieving card ranges with `UseJsonDOM` set to false. This applied to the following fields: acsStartProtocolVersion, acsEndProtocolVersion, startRange, and endRange. --- Version: 2.3.9099 Date: December 2, 2024 - [NEW] Added `ErrorComponent` configuration setting to expose the errorComponent field from received error (Erro) packets. --- Version: 2.3.9095 Date: November 25, 2024 - [NEW] Added `ValidateEmail` configuration setting to enable validation of `CardholderEmail` and `DeliveryEmailAddress` fields prior to sending the authentication request. When `True`, these values will be validated according to section 3.4 of IETF RFC 5322. --- Version: 2.3.9032 Date: September 23, 2024 - [IMPORTANT] Improved network performance and stability. - [NEW] Added `MessageVersion` property to set the protocol version used by the component. This is the same functionally as the `ProtocolVersion` configuration setting. --- Version: 2.3.8644 Date: August 31, 2023 - [FIX] (JavaScript Edition) Fixed "can not parse long64 value" error when calling RequestCardRanges. --- Version: 2.3.8637 Date: Aug 24, 2023 - [FIX] Fixed condition check for optional oobAppURL field. This is conditional in 2.3.1 and optional in 2.2.0 and 2.1.0. --- Version: 2.3.8584 Date: July 3, 2023 - [NEW] The EMV 3-D Secure 2.3.1 support in the `Server` component has been updated to version 2.3.1.1 of the specification (previously 2.3.1.0). --- Version: 2.3.8506 Date: April 16, 2023 - [NEW] Support for 2.3.1 of the EMV 3-D Secure protocol has been added. The minor version has been updated to indicate this (2.3.*). More information on new functionality available in this version of the protocol can be found in the following knowledge base article here. --- Version: 2.2.8430 Date: January 30, 2023 - [NEW] A new `CardRangeTempPath` configuration setting added. When set, this will instruct the component to write the PRes data to a temporary file prior to parsing. This can be useful in limiting memory usage of the component, especially when large amounts of ranges are returned. For the most benefit, this can be used in conjunction with the `StoreCardRangeData` configuration setting set to False. --- Version: 2.2.8075 Date: February 9, 2022 - [FIX] Modified some error messages raised from the component to be more user friendly and informative. --- Version: 2.2.8026 Date: December 22, 2021 - [FIX] A validation error will now be returned if the threeDSReqAuthMethod is set to a value listed as "Reserved for EMVCo future use." - [FIX] Erro packets generated by the component will now only include valid *TransID values. --- Version: 2.2.8018 Date: December 14, 2021 - [FIX] (Java Edition) Updated deprecated constructor "java.net.URLDecoder" for newer Java versions. --- Version: 2.2.7944 Date: October 1, 2021 - [IMPORTANT] The default threeDSServerRefNumber (`ServeRefNumber` config) used has been updated to the latest one issued to /n software by EMVCo. The value is 3DS_LOA_SER_NSOF_020200_00416 and expires on May 25th, 2023. --- Version: 2.0.7860 Date: July 9, 2021 - [FIX] Fixed a bug where the 3DS Server component would attempt to parse packets received in response to "Erro" packets sent to the Directory Server. These returned packets were not valid and should not be returned in production. In the off chance they are, however, they will be safely ignored. --- Version: 2.0.7859 Date: July 8, 2021 - [FIX] A change to the way signature algorithms are presented to the server during SSL negotiation (in the Client Hello packet). Some servers seem to require these algorithms to be listed with the most secure algorithms first. --- Version: 2.0.7849 Date: June 28, 2021 - [FIX] The `ReqAuthData` and `PriorAuthData` configuration settings have been updated to support values up to 20000 characters in length. This change is due to MasterCard desiring expanded character limits on threeDSReqAuthData and threeDSReqPriorAuthData fields (up to 20000 characters), and made after confirmation from EMVCo that it was valid. --- Version: 2.0.7800 Date: May 10, 2021 - [NEW] Added new configuration settings to manage custom request fields. By default, when `AddRequestField` is called, the field will be added to an internal collection, used when building the next outgoing request, and "forgotten" by the component. A new `PersistCustomRequestFields` configuration setting was added to instruct the component to store these fields internally for use when building subsequent requests. This is false by default, but when set to true these fields will persist. A new `ClearCustomRequestFields` configuration setting was also added to explicitly instruct the component to clear the internal collection. --- Version: 2.0.7788 Date: April 28, 2021 - [FIX] Allow Base64 encoding (instead of the expected Base64URL) when parsing threeDSMethodData passed in to the `CheckResponse` method. This was already supported for other message types (since June 2019, build 7114). Support for Base64 encoding can be turned off using the `AllowBase64Response` configuration setting; this is true by default. --- Version: 2.0.7758 Date: March 29, 2021 - [FIX] Fixed NullReferenceException in Java edition when parsing a PRes packet using `CheckResponse` method. --- Version: 2.0.7753 Date: March 24, 2021 - [NEW] Added `ContinueParsingCardRangesOnError` configuration setting. When set to true (false by default), the component will continue to parse card ranges even after a validation error is encountered in one of the ranges. This allows the valid card ranges to be accessed via the CardRange collection. The component will still send an "Erro" packet to the DS and raise an exception. --- Version: 2.0.7662 Date: December 23, 2020 - [FIX] Fixed validation of `CardholderName` field. In the EMVCo specification, this is defined to be limited to only accept a set of Alphanumeric characters listed in EMV Book 4, Appendix B. The `Server` component now performs this validation as expected. --- Version: 2.0.7646 Date: December 7, 2020 - [FIX] Fixed the SSL protocol versions explicitly enabled by default. The EMVCo specification defines that SSL connections must use TLS 1.2 (or greater) and a specific set of cipher suites. Prior to this fix, the `Server` component only explicitly limited the cipher suites. The cipher suites in question are only available for TLS 1.2, so this limit was imposed indirectly. This fix explicitly limits the SSL protocol used by the component to TLS 1.2. Note: for TLS 1.3, this can be enabled using the `SSLEnabledProtocols` configuration setting. --- Version: 2.0.7634 Date: November, 21 2020 - [NEW] Added `ExtractRReqServerTransactionId` configuration setting. This can be used to extract the `threeDSServerTransId` field from the RReq packet without needing to perform outside parsing. This transaction ID can then be used to look up details previously saved (e.g. the protocol version) to configure the `Server` component prior to passing the RReq packet to the `CheckResponse` method. --- Version: 2.0.7593 Date: October, 15 2020 - [NEW] Added `DSStartProtocolVersion` and `DSEndProtocolVersion` parameters to the `CardRange` event. These parameters expose the individual card range values for these fields. --- Version: 2.0.7590 Date: October, 12 2020 - [FIX] Allow a `transStatusReason` value of 14 to be returned in an ARes packet. Previously, this resulted in an error. Note: this field can be checked after the `SendAuthRequest` method returns via the `TransactionStatusReason` configuration setting. --- Version: 2.0.7588 Date: October, 10 2020 - [FIX] Fixed an issue causing error raised by internal components to mistakenly be raised as 3-D Secure protocol level errors. --- Version: 2.0.7577 Date: September, 29 2020 - [FIX] The `Server` component was updated to use our latest EMVCo-issued `threeDSServerRefNumber` value, 3DS_LOA_SER_NSOF_020200_00203. --- Version: 2.0.7530 Date: August, 13 2020 - [FIX] Allow masked values in the `startRange` and `endRange` fields for incoming card ranges. --- Version: 2.0.7466 Date: June, 10 2020 - [FIX] Fixed an issue where the `Server` component tried to transmit an error to the DS when parsing an RReq packet. Instead of transmitting the error directly, the error packet should be generated and sent back in the response. The error packet to return is available in the `ErrorPacket` property. --- Version: 2.0.7453 Date: May, 28 2020 - [FIX] Allow a `transStatus` (`TransactionStatus`) of "I" to be returned when the `threeDSRequestorChallengeInd` (`RequestorChallengeInd`) is in the DS-reserved range. --- Version: 2.0.7440 Date: May, 15 2020 - [FIX] Fixed an issue where the `SendAuthRequest` method would throw a StackOverflowException if the `ProtocolVersion` configuration setting had inadvertently been set to an empty string. Validation has been added to the `ProtocolVersion` configuration setting; accepted values are `2.1.0` and `2.2.0`.