09 September 2025

Production release: 09 September 2025
Staging release: 04 September 2025

04 September 2025

• Enhanced Security (MTLS Rollout) : Successfully rolled out Mutual TLS (MTLS) certificates across all environments for our internal, isolated gateway.
• Improved Disaster Recovery Security: Updated UI bucket permissions in all Disaster Recovery (DR) regions to enforce proper access control via CloudFront policy IDs.
• Metric Logging Improvement : Added the account_id and jti (JWT ID) to our metric events, which will provide richer data for monitoring, tracing, and analysis.
• Server-Side Time Validation : Moved the time validation logic from the client-side to the server-side for increased security and reliability.
• API Identity Validation Update : Removed the strict scope format validation for API identities to allow for greater flexibility in scope naming conventions.
• SAML Certificate Update :
  • Set a new CA Signing certificate for Walmart SAML Response Signing as the default.
  • Completed setup to utilize the new response signing certificate for SAML sign-in, ensuring uninterrupted federation services.
• MyProfile Recovery Codes: Managed recovery codes in the MyProfile section with the feature flag initially off.

Bug Fixes

• Resolved a rare login issue that prevented users from logging in after porting from the US to the AU region.
• Corrected a bug related to URL decoding that was affecting the Federation process.
• Ensured that user email and subject (sub) attribute updates now persist correctly without being saved in an incorrect CamelCase format to Profiles.
• Resolved an issue where the account_id was missing for federated users when the response_type was set to token or id_token.