# Card Reveal SDK Changelog

What changed in each version of Column's [card reveal SDKs](/card-issuing/card-reveal), newest first. The web
(`@column-na/card-reveal`) and React Native (`@column-na/card-reveal-react-native`) SDKs release together at the same
version. Each entry lists breaking changes and required actions first. See
[SDK Versions](/card-issuing/card-reveal-versions) for which versions Column supports.

## 0.13.0

**Action required:** none.

- **React bindings:** `<CardRevealProvider>` with `<CardRevealSlot>` children, or the `useCardReveal()` hook, runs the
  whole reveal: `prepareReveal()`, your server's token, the reveal and `unmount` on cleanup. `useCardRevealState()`
  reports `{ status, error, retry }`. On the web they're at `@column-na/card-reveal/react` (React 18 or later); in React
  Native they're exported from the package. See [React](/card-issuing/card-reveal#react).
- **Hide, show and auto-hide:** a reveal has `hide()` and `show()`, `hidden: true` starts it masked, and `autoHideMs`
  (with `onAutoHide`) unmounts it a set time after `ready`. See
  [Hide, Show and Copy](/card-issuing/card-reveal#hide-show-and-copy).
- **Copy (web):** `copyable` makes a field a copy button inside Column's frame. The value is copied from inside the
  frame; your page gets only `onCopy({ field, copied })`. In React Native, `copyable` and `onCopy` throw
  `invalid_options`; use `selectable` on `CardRevealText`.
- **`discard()`:** a prepared reveal can drop its key without revealing, and on the web removes its hidden frame.

## 0.12.0

**Action required:** none, unless your styles use `!important`, `font-synthesis` or `text-decoration-skip-ink`.

- **Web styles:** `!important` is removed from your style declarations (the value is kept), and `font-synthesis` and
  `text-decoration-skip-ink` are refused.

## 0.11.0

**Action required:** if you embed a font, check that it still loads.

- **Web styles:** each glyph of an embedded font may have at most 600 points and 30 contours, with a bounded outline
  length. Ordinary text fonts are well within these limits. A font that doesn't pass is dropped, and the text uses the
  next font in your `font-family` list.

## 0.10.0

**Action required:** if you embed a font, re-export it as plain TrueType.

- **Web styles:** an embedded `@font-face` font must be plain, unhinted TrueType (`.ttf`) with simple glyphs and no
  layout, colour or variation tables, at most 64 KB. WOFF, WOFF2 and OpenType CFF fonts are dropped. The
  [web SDK's README](https://www.npmjs.com/package/@column-na/card-reveal) shows how to prepare one with fontTools.
- **Web styles:** vendor-prefixed properties (`-webkit-transform`, `-webkit-filter` and similar) are handled like the
  properties they alias.

## 0.9.0

**Action required:** if you style fields, check the limits below.

- **Web styles:** `font-size` is capped at 96px; `text-shadow` and `box-shadow` keep at most two shadows with a blur
  of at most 8px; `filter`, `backdrop-filter`, `transform`, `zoom`, the `font` shorthand, `-webkit-text-stroke`,
  `text-emphasis`, `mask`, `paint-order` and `will-change` are refused.
- **Web hosted script:** the `integrity` attribute is read the way browsers read it. A hash followed by an invisible
  character (such as a non-breaking space pasted from a document) is now refused with `integrity_required`.
- **React Native:** a stronger check of the random source before each reveal key.

## 0.8.0

**Action required:** if your styles load fonts from a URL, embed them instead.

- **Web styles:** an `@font-face` `src` must embed the font as a base64 `data:` URL or name an installed font with
  `local(...)`; a font URL is dropped. A style may be up to 256 KB. `::first-letter` and `::first-line` are refused.
- **Web hosted script:** the `integrity` attribute must hold a `sha256-`, `sha384-` or `sha512-` hash. Module scripts
  (`type="module"`) aren't supported.
- **React Native:** the SDK refuses a broken random source (all zeros, repeating bytes) with `reveal_failed`.

## 0.7.0

**Breaking. Action required:**

- **Call `prepareReveal()` before every reveal,** and mint each reveal token with its `keyThumbprint` as
  `reveal_key_thumbprint`. Column now requires every reveal token to be bound to a key, so versions before 0.7.0 no
  longer reveal cards.
- **Rename `cvv` to `cvv2`** in `fields` and `fieldStyles`. `cvv` throws `invalid_options`.

Also new:

- **PIN reveal:** add `pin` to `fields` to show a debit card's PIN. See
  [Reveal a PIN](/card-issuing/card-reveal#reveal-a-pin).
- **Only the fields you show** are returned by Column, and each reveal is recorded with the fields it returned.
- `CardRevealError` has `apiCode`, Column's API error code, when there is one.

## 0.6.0

**Action required:** allow `https://reveal.column.com` in `frame-src` for sandbox as well as live.

- **Web:** sandbox reveals render in Column's reveal frame, like live. Your page no longer needs a `connect-src` entry
  for the SDK. `sandboxBaseUrl` must be `https://api.column.com` or plain `http://localhost` / `http://127.0.0.1`.

## 0.5.0

**Action required:** update your Content Security Policy, and on React Native install
`react-native-get-random-values`.

- **Web:** live reveals render in Column's reveal frame at `https://reveal.column.com`, fetching card details from
  Column encrypted end to end. Allow `https://reveal.column.com` in `frame-src`, and remove the previous vendor's
  origins.
- **React Native:** reveals call Column directly, encrypted end to end to a one-time key the SDK makes. Import
  `react-native-get-random-values` once at the top of your app's entry file.