[mend-for-github-com]

This PR contains the following updates:

Package	Type	Update	Change
com.vonage:server-sdk	compile	major	8.13.0 → 9.14.0

By merging this PR, the issue #38 will be automatically resolved and closed:

Severity	CVSS Score	Vulnerability
Medium	5.3	CVE-2025-48924

---

Release Notes

Vonage/vonage-java-sdk (com.vonage:server-sdk)

v9.14.0

• Auth: Added public RequestSigning.verifyRequestSignature(InputStream, String, Map, String, HashType) overload, so callers can verify signed callbacks (e.g. SMS) using a non-MD5 algorithm such as HMAC_SHA256. Previously the only publicly accessible overload was hardcoded to HashType.MD5 and the algorithm-aware overload was package-private. Existing overloads are unchanged and still default to MD5

v9.13.1

• SMS: Fixed trusted_recipient being serialized nested inside the sms settings object instead of at the top level of the message body, so SmsTextRequest.builder().trustedRecipient(...) now matches the Messages API contract (MMS and RCS were already correct). Removed the incorrectly placed trusted_recipient accessor from OutboundSettings; use SmsTextRequest.getTrustedRecipient() instead

v9.13.0

• Messages: Added WhatsApp business-scoped user ID (BSUID) support
  • Outbound WhatsApp messages can now be sent to a BSUID (or parent BSUID) in the to field, in addition to a phone number. The recipient is accepted as-is (phone numbers are normalised) and not validated against a client-side format, so values accepted by the API are never rejected by the SDK
  • Added shared WhatsappUser model (user_id, parent_user_id, wa_id)
  • InboundMessage: added whatsapp.sender via getWhatsappSender()
  • MessageStatus: added whatsapp.recipient via getWhatsappRecipient() and WhatsApp profile via getWhatsappProfile()
  • WhatsApp Profile: added getUsername()

v9.12.0

• Conversations: Removed trailing slashes from Conversations API request URIs to prevent routing errors after the API gateway stopped normalising trailing-slash paths

v9.11.0

• SMS: Increased client reference (client-ref) maximum length from 40 to 100 characters, matching the Messages API

v9.10.2

• HTTP: Fixed stale pooled connection reuse by adding connection TTL, idle/expired eviction and inactivity validation to reduce intermittent Connection reset errors when reusing long-lived VonageClient instances

v9.10.1

• No changes, had to create to trigger a rebuild due to build system problem

v9.10.0

• Exceptions: Added getRawRequest() and getRawResponse() methods to VonageApiResponseException for debugging API errors
• Messages: RCS TTL is now publicly settable on all RCS message types, with validation between 300 and 2592000 seconds

v9.9.0

• Video: Added post-call transcription options
• Video: Added connections list calls
• Verify v2: Added support for template_id parameter

v9.8.0

• Added deprecation notice for Java 8/1.8 users. Version 9.x will be the final version to support Java 8.
• Accounts: Internally switched to supporting only Basic Authorization header authentication
• Conversion: Internally switched to supporting only Basic Authorization header authentication
• Identity Insights: Added new API, covers Formatting, SimSwap, Original and Current Carrier checks
• Messages: Added trusted_recipient to SMS, MMS, and RCS
• Messages: Added support for Typing Indicators in WhatsApp
• Messages: Added pool_id support
• Number Insights: Internally switched to supporting only Basic Authorization header authentication
• Verify v1: Internally switched to supporting only Basic Authorization header authentication
• Verify: Deprecates the sandbox parameter
• Voice: Websocket Connections can now include custom authorization headers
• Voice: Answer Webhook adds support for SIP User-To-User incoming headers
• Voice: Add support for shaken signing on calls
• Voice: Added support for sip_code on incoming event webhooks
• Voice: Added support for Transfer NCCO action
• Voice: Added support for Wait NCCO action

v9.7.0

• Added native RCS message types (card, carousel) and suggestions support to eliminate need for custom message type

v9.6.0

• MMS caption length increased on 3000
• Added new RCS param for messages to set the category
• Added additional whatsapp information for deserializing incoming messages that contain pricing.

v9.5.0

• Added trusted-number to SMS

v9.4.2

• Added missing supported languages (Lithuanian and Marathi) to TextToSpeechLanguage enum

v9.4.1

• Fixed typo for verify to correct the call to next workflow

v9.4.0

• Added bidirectional flag for websockets to support the new Bi-Directional Audio Connector

v9.3.1

• Fixed CustomClient return type validation (normalise to Void if unknown)
• Deprecated Verify v1, SIM Swap and Number Verification APIs

v9.3.0

• Added support for native failover in Messages API

v9.2.0

• Added support for setting additional request headers in HttpConfig
• Allow setting HttpClient and HttpConfig on HttpWrapper
• Bumped Jackson version to 2.19.0

v9.1.0

• Added custom HTTP requests support via CustomClient (see README for details)

v9.0.0

• Removed deprecations (classes, methods, constructors, packages etc.)
  • Removed Meetings, Proactive Connect and Number Insight v2 APIs
• Removed Pricing API (was contained in com.vonage.client.account.*)
• Refactored RequestSigning and com.vonage.client.auth.hashutils.* classes (mostly internal changes)
• Standardised handling of query parameters using AbstractQueryParamsRequest class
• Removed public static fromJson(String) methods from all non-webhook classes
• Moved most enums from inner classes to their own file / class
• Standardised enum parsing (see Jsonable.fromString(String, Class<E>))
  • Removed UNKNOWN enums where it is not an actual value
  • Invalid enums now return null instead of throwing IllegalArgumentException to facilitate parsing response data
• Unified Psd2Request.Workflow and VerifyRequest.Workflow enums (moved to upper level)
• Removed WhatsApp Interactive (Codeless) workflow support in Verify v2 API
• Refactored Number Insight API to properly support Advanced insights
  • Removed async parameter from AdvancedInsightRequest
  • Added AdvancedAsyncInsightRequest and AdvancedAsyncInsightResponse classes
  • Made callback parameter mandatory in AdvancedAsyncInsightRequest.Builder
  • Added InsightClient.getAdvancedAsyncNumberInsight(AdvancedInsightAsyncRequest) method
• Refactored Application API capabilities to make adding webhooks more declarative and correct by construction
  • All capabilities now have explicit methods for specifying valid webhook types
  • addWebhook and removeWebhook methods have been removed - null parameters are now used to remove webhooks
• Added Application.builder(String) as an option for updating an application by ID from scratch
• Removed StreamCompositionLayout.Builder - replaced by three valid presets as static methods instead
• Added Verify2Client#isValidVerificationCode(UUID, String) method to simplify checking verification codes
• Renamed com.vonage.client.voice.Endpoint to CallEndpoint
• Renamed com.vonage.client.voice.ncco.Endpoint to ConnectEndpoint
• Refactored CallInfoPage to be aligned with other HAL responses (now extends HalPageResponse)
  • Now returns the embedded calls directly as a list rather than array
• Added get prefix to VideoStream and HlsSettings accessors
• NumbersClient#listNumbers now returns List<OwnedNumber> instead of ListNumbersResponse
• NumbersClient#linkNumber now assigns the number to the application by ID
• Use stronger data types in responses:
  • Application id now uses UUID
  • OwnedNumber features uses enum
  • CallInfo rate and price now use Double
  • CallInfo and Call use Instant for timestamps
  • WebSocketEndpoint contentType uses WebSocket.ContentType enum
  • Call answerMethod now uses EventMethod enum
  • CallEndpoint and ConnectEndpoint type now uses EndpointType enum
  • ListUsersRequest.SortOrder uses enum from com.vonage.client.common.SortOrder
  • com.vonage.client.messages.MessageType replaced by com.vonage.client.common.MessageType enum

v8.20.1

• Removed brand length limit in Verify v2 request

v8.20.0

• Added quantizationParameter to Video Archive
• Fixed custom event type parsing and creation in Conversation API
• Added support for the following event types in Conversation API:
  • member:invited
  • member:joined
  • member:left
  • rtc:hangup
  • sip:hangup

v8.19.0

• Added start / stop text-to-speech and audio stream endpoints to Conversation API
• Exposed StreamPayload in Voice API and added Builder
• Added builder and custom headers for MemberChannel in Conversation API
• Added support for the following event types in Conversation API:
  • audio:dtmf
  • audio:record:done
  • audio:speaking:off
  • audio:speaking:on
  • member:media
  • rtc:answer
  • rtc:answered
  • rtc:ringing
  • rtc:status
  • rtc:transfer
  • sip:amd_machine
  • sip:answered
  • sip:machine
  • sip:ringing

v8.18.0

• Added MMS Text, File and Content outbound message types
• Added getFileName and getFileCaption to com.vonage.client.messages.InboundMessage

v8.17.0

• Added user/domain name support to com.vonage.client.voice.ncco.SipEndpoint
• Improved Voice API documentation
• Deprecated primitive wrapper methods in NCCO action builders
• Deprecated singleton URL / Endpoint array/collection methods in Voice API
• Refactored com.vonage.client.voice.CallsFilter to extend HalFilterRequest
  • Deprecated java.util.Date-based methods
  • getOrder() returns a com.vonage.client.common.SortOrder instead of CallOrder
• Made constructors for response objects in Voice API package-private
• Basic auth header in Number Insight v1 requests instead of query parameters

v8.16.2

• Added disconnected_by enum to com.vonage.client.voice.EventWebhook
• Changed AnswerWebhook#getUuid() return type to String
• Updated Voice Call documentation

v8.16.1

• Removed mandatory from parameter for event creation in Conversation API
• Re-added URL domain validation in VoiceClient.downloadRecordingRaw
• Bumped JWT library version to 2.0.1
• Added commons-codec to runtime classpath to fix WS-2019-0379 warning

v8.16.0

• Added logging for requests & responses based on java.util.logging
• Improved SMS API documentation
• Deprecated Number Insight v2 / Fraud Score API
• Deprecated real_time_data in Number Insight API
• Minor internal refactoring based on code coverage improvements

v8.15.1

• Removed hardcoded domain validation from VoiceClient.downloadRecordingRaw

v8.15.0

• Added proxy support to HttpConfig.Builder
• Basic auth in header instead of query params in SMS API

v8.14.0

• Close HTTP responses to prevent resource leaks
• Added RedactResponseException and deprecated VonageBadRequestException
• Added maxBitrate to com.vonage.client.video.Archive
• Added varargs removeCapabilities method to Application.Builder

---

• If you want to rebase/retry this PR, check this box