Card Issuing

Card Reveal SDK Changelog

What changed in each version of Column's card reveal SDKs, newest first. The web (@column-na/card-reveal) and React Native (@column-na/card-reveal-react-native) SDKs release together at the same version. Each entry lists breaking changes and required actions first. See SDK Versions for which versions Column supports.

0.13.0

Action required: none.

  • React bindings: <CardRevealProvider> with <CardRevealSlot> children, or the useCardReveal() hook, runs the whole reveal: prepareReveal(), your server's token, the reveal and unmount on cleanup. useCardRevealState() reports { status, error, retry }. On the web they're at @column-na/card-reveal/react (React 18 or later); in React Native they're exported from the package. See React.
  • Hide, show and auto-hide: a reveal has hide() and show(), hidden: true starts it masked, and autoHideMs (with onAutoHide) unmounts it a set time after ready. See Hide, Show and Copy.
  • Copy (web): copyable makes a field a copy button inside Column's frame. The value is copied from inside the frame; your page gets only onCopy({ field, copied }). In React Native, copyable and onCopy throw invalid_options; use selectable on CardRevealText.
  • discard(): a prepared reveal can drop its key without revealing, and on the web removes its hidden frame.

0.12.0

Action required: none, unless your styles use !important, font-synthesis or text-decoration-skip-ink.

  • Web styles: !important is removed from your style declarations (the value is kept), and font-synthesis and text-decoration-skip-ink are refused.

0.11.0

Action required: if you embed a font, check that it still loads.

  • Web styles: each glyph of an embedded font may have at most 600 points and 30 contours, with a bounded outline length. Ordinary text fonts are well within these limits. A font that doesn't pass is dropped, and the text uses the next font in your font-family list.

0.10.0

Action required: if you embed a font, re-export it as plain TrueType.

  • Web styles: an embedded @font-face font must be plain, unhinted TrueType (.ttf) with simple glyphs and no layout, colour or variation tables, at most 64 KB. WOFF, WOFF2 and OpenType CFF fonts are dropped. The web SDK's README↗ shows how to prepare one with fontTools.
  • Web styles: vendor-prefixed properties (-webkit-transform, -webkit-filter and similar) are handled like the properties they alias.

0.9.0

Action required: if you style fields, check the limits below.

  • Web styles: font-size is capped at 96px; text-shadow and box-shadow keep at most two shadows with a blur of at most 8px; filter, backdrop-filter, transform, zoom, the font shorthand, -webkit-text-stroke, text-emphasis, mask, paint-order and will-change are refused.
  • Web hosted script: the integrity attribute is read the way browsers read it. A hash followed by an invisible character (such as a non-breaking space pasted from a document) is now refused with integrity_required.
  • React Native: a stronger check of the random source before each reveal key.

0.8.0

Action required: if your styles load fonts from a URL, embed them instead.

  • Web styles: an @font-face src must embed the font as a base64 data: URL or name an installed font with local(...); a font URL is dropped. A style may be up to 256 KB. ::first-letter and ::first-line are refused.
  • Web hosted script: the integrity attribute must hold a sha256-, sha384- or sha512- hash. Module scripts (type="module") aren't supported.
  • React Native: the SDK refuses a broken random source (all zeros, repeating bytes) with reveal_failed.

0.7.0

Breaking. Action required:

  • Call prepareReveal() before every reveal, and mint each reveal token with its keyThumbprint as reveal_key_thumbprint. Column now requires every reveal token to be bound to a key, so versions before 0.7.0 no longer reveal cards.
  • Rename cvv to cvv2 in fields and fieldStyles. cvv throws invalid_options.

Also new:

  • PIN reveal: add pin to fields to show a debit card's PIN. See Reveal a PIN.
  • Only the fields you show are returned by Column, and each reveal is recorded with the fields it returned.
  • CardRevealError has apiCode, Column's API error code, when there is one.

0.6.0

Action required: allow https://reveal.column.com in frame-src for sandbox as well as live.

  • Web: sandbox reveals render in Column's reveal frame, like live. Your page no longer needs a connect-src entry for the SDK. sandboxBaseUrl must be https://api.column.com or plain http://localhost / http://127.0.0.1.

0.5.0

Action required: update your Content Security Policy, and on React Native install react-native-get-random-values.

  • Web: live reveals render in Column's reveal frame at https://reveal.column.com, fetching card details from Column encrypted end to end. Allow https://reveal.column.com in frame-src, and remove the previous vendor's origins.
  • React Native: reveals call Column directly, encrypted end to end to a one-time key the SDK makes. Import react-native-get-random-values once at the top of your app's entry file.
Previous
Card Reveal SDK Versions
Next
Card Disputes