Parity changelog

How the feature-parity map changed across releases — generated by diffing the parity tables between consecutive v* tags.

Current (latest-19719b1): 57 🟢 Real · 2 🟡 Emulated · 1 🟠 BYO-engine · 6 🔴 Not implemented.

v0.1.0 → v0.2.0

• Import key (JWK): 🔴 → 🟢
• Get random bytes: 🔴 → 🟢
• Secure Key Release (/release): 🔴 → 🟡
• Key rotation policy (get/set): 🔴 → 🟡
• Key backup / restore: 🔴 → 🟡
• Certificate signing request (PKCS#10) for a named issuer: 🔴 → 🟢
• Merge a signed chain: 🔴 → 🟢
• Issuance by a real CA: 🔴 → 🟠
• Issuers / contacts: 🔴 → 🟡
• Certificate backup / restore: 🔴 → 🟡
• Three-emulator chain (vault secret → managed identity → Entra → Fabric): 🔴 → 🟢

v0.2.0 → v0.3.0

No parity changes.

v0.3.0 → v0.4.0

• Attributes nbf / exp: 🟡 → 🟢
• Backup / restore: 🟡 → 🟢
• Key rotation policy (get/set): 🟡 → 🟢
• Rotate key (POST /keys/{name}/rotate): 🔴 → 🟢
• key_ops enforcement: 🔴 → 🟢
• BYOK (KEK-wrapped import): 🔴 → 🟢
• Key backup / restore: 🟡 → 🟢
• Delete cascade to the linked key/secret: 🟡 → 🟢
• Issuers / contacts: 🟡 → 🟢
• Certificate backup / restore: 🟡 → 🟢
• Soft-delete → list-deleted → recover → purge (secrets, keys, certificates): 🟡 → 🟢
• Retention window expiry: 🟡 → 🟢
• Purge protection / non-purgeable recoveryLevel: 🔴 → 🟢
• RBAC data-plane roles (Key Vault Secrets User, …): 🔴 → 🟡
• Access policies (the classic vault access-policy document): 🔴 → 🟡
• Multiple trusted issuers: added 🟢
• nbf / exp enforced for cryptographic use: added 🟢
• oct / oct-HSM symmetric keys (and their AES algorithms): added 🟢
• Cancel / delete a certificate operation: added 🟢
• Create operation LRO shape (inProgress on create → completed on poll): added 🟢
• api-version validation: added 🟢
• azure-keyvault-secrets/-keys/-certificates + azure-identity (Python): added 🟢
• @azure/keyvault-secrets/-keys/-certificates + @azure/identity (JavaScript): added 🟢
• Azure.Security.KeyVault.{Secrets,Keys,Certificates} + Azure.Identity (.NET): added 🟢
• Multi-tenant / multiple trusted issuers: removed
• oct / oct-HSM symmetric keys: removed
• AES algorithms (A128/192/256 CBC/CBCPAD/GCM, AESKW): removed
• Cancel / delete a pending certificate operation: removed
• api-version validation / version-differentiated behaviour: removed
• azure-keyvault-secrets / azure-identity (Python): removed
• .NET / JavaScript SDKs: removed

v0.4.0 → v0.5.0

• RBAC data-plane roles (Key Vault Secrets User, …): 🟡 → 🟢
• Access policies (the classic vault access-policy document): 🟡 → 🟢
• Group membership in authorization: added 🟢
• Role/policy assignment without ARM: added 🟡

v0.5.0 → v0.6.0

• Data-plane authorization: 🟡 → 🟢
• Role/policy assignment with ARM opted out: added 🟡
• Role/policy assignment without ARM: removed

v0.6.0 → v0.7.0

• RSA-HSM / EC-HSM key types: 🟡 → 🟢

v0.7.0 → latest-19719b1

No parity changes.