contentauth · github-actions · Aug 12, 2026
diff --git a/.changeset/all-phones-read.md b/.changeset/all-phones-read.md
diff --git a/.changeset/blue-stamps-bow.md b/.changeset/blue-stamps-bow.md
diff --git a/.changeset/fresh-kiwis-doubt.md b/.changeset/fresh-kiwis-doubt.md
diff --git a/.changeset/jolly-cats-cheat.md b/.changeset/jolly-cats-cheat.md
diff --git a/.changeset/proud-candles-tap.md b/.changeset/proud-candles-tap.md
diff --git a/.changeset/tame-mice-hunt.md b/.changeset/tame-mice-hunt.md
diff --git a/.changeset/tame-otters-relax.md b/.changeset/tame-otters-relax.md
diff --git a/packages/c2pa-node/CHANGELOG.md b/packages/c2pa-node/CHANGELOG.md
@@ -1,5 +1,25 @@
 # @contentauth/c2pa-node
 
+## 0.9.0
+
+### Minor Changes
+
+- b3b3196: Introduce new c2pa-utilities package, and update c2pa-web and c2pa-node to use it.
+- f2f6ada: Move the Reader asset size check into `c2pa-utilities`, shared by both `c2pa-web` and `c2pa-node`. `c2pa-node`'s Reader now validates asset size before reading, using its own server-appropriate limit.
+
+  `validateAssetSize` treats a `maxSizeInBytes` of `0` as a request to use the new `DEFAULT_MAX_SIZE_IN_BYTES`, and throws a `RangeError` for non-finite or negative size/limit values.
+
+### Patch Changes
+
+- 2de9ba5: c2pa-rs bump
+- 1102535: Bump c2pa-rs version to v0.90.10
+- 4c8ad00: c2pa-rs version bump to v0.90.12
+- 0f42fe8: Consolidate the `SigningAlg` type into `@contentauth/c2pa-utilities` (derived from `@contentauth/c2pa-types`'s schema-generated type). Re-use `ManifestAssertionKind` from `@contentauth/c2pa-types` instead of a duplicate hand-written copy. Fix `c2pa-node`'s `package.json` to list `@contentauth/c2pa-types` as a `dependency` rather than a `devDependency`, matching `c2pa-web`.
+- Updated dependencies [b3b3196]
+- Updated dependencies [f2f6ada]
+- Updated dependencies [0f42fe8]
+  - @contentauth/c2pa-utilities@0.2.0
+
 ## 0.8.3
 
 ### Patch Changes

diff --git a/packages/c2pa-node/package.json b/packages/c2pa-node/package.json
@@ -5,7 +5,7 @@
     "url": "git+https://github.com/contentauth/c2pa-js.git",
     "directory": "packages/c2pa-node"
   },
-  "version": "0.8.3",
+  "version": "0.9.0",
   "description": "Node.js bindings for C2PA",
   "main": "dist/index.js",
   "type": "module",

diff --git a/packages/c2pa-utilities/CHANGELOG.md b/packages/c2pa-utilities/CHANGELOG.md
@@ -0,0 +1,12 @@
+# @contentauth/c2pa-utilities
+
+## 0.2.0
+
+### Minor Changes
+
+- b3b3196: Introduce new c2pa-utilities package, and update c2pa-web and c2pa-node to use it.
+- f2f6ada: Move the Reader asset size check into `c2pa-utilities`, shared by both `c2pa-web` and `c2pa-node`. `c2pa-node`'s Reader now validates asset size before reading, using its own server-appropriate limit.
+
+  `validateAssetSize` treats a `maxSizeInBytes` of `0` as a request to use the new `DEFAULT_MAX_SIZE_IN_BYTES`, and throws a `RangeError` for non-finite or negative size/limit values.
+
+- 0f42fe8: Consolidate the `SigningAlg` type into `@contentauth/c2pa-utilities` (derived from `@contentauth/c2pa-types`'s schema-generated type). Re-use `ManifestAssertionKind` from `@contentauth/c2pa-types` instead of a duplicate hand-written copy. Fix `c2pa-node`'s `package.json` to list `@contentauth/c2pa-types` as a `dependency` rather than a `devDependency`, matching `c2pa-web`.
diff --git a/packages/c2pa-utilities/package.json b/packages/c2pa-utilities/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@contentauth/c2pa-utilities",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "license": "MIT",
   "repository": {
     "type": "git",

diff --git a/packages/c2pa-wasm/CHANGELOG.md b/packages/c2pa-wasm/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @contentauth/c2pa-wasm
 
+## 0.11.3
+
+### Patch Changes
+
+- 2de9ba5: c2pa-rs bump
+- 1102535: Bump c2pa-rs version to v0.90.10
+- 4c8ad00: c2pa-rs version bump to v0.90.12
+
 ## 0.11.2
 
 ### Patch Changes

diff --git a/packages/c2pa-wasm/package.json b/packages/c2pa-wasm/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@contentauth/c2pa-wasm",
-  "version": "0.11.2",
+  "version": "0.11.3",
   "license": "MIT",
   "repository": {
     "type": "git",

diff --git a/packages/c2pa-web/CHANGELOG.md b/packages/c2pa-web/CHANGELOG.md
@@ -1,5 +1,30 @@
 # @contentauth/c2pa-web
 
+## 0.14.0
+
+### Minor Changes
+
+- b3b3196: Introduce new c2pa-utilities package, and update c2pa-web and c2pa-node to use it.
+- f2f6ada: Move the Reader asset size check into `c2pa-utilities`, shared by both `c2pa-web` and `c2pa-node`. `c2pa-node`'s Reader now validates asset size before reading, using its own server-appropriate limit.
+
+  `validateAssetSize` treats a `maxSizeInBytes` of `0` as a request to use the new `DEFAULT_MAX_SIZE_IN_BYTES`, and throws a `RangeError` for non-finite or negative size/limit values.
+
+### Patch Changes
+
+- 2de9ba5: c2pa-rs bump
+- 4b22953: Remove ts-deepmerge from vite.config.ts's external array so that it gets bundled into c2pa-web.
+- 1102535: Bump c2pa-rs version to v0.90.10
+- 4c8ad00: c2pa-rs version bump to v0.90.12
+- 0f42fe8: Consolidate the `SigningAlg` type into `@contentauth/c2pa-utilities` (derived from `@contentauth/c2pa-types`'s schema-generated type). Re-use `ManifestAssertionKind` from `@contentauth/c2pa-types` instead of a duplicate hand-written copy. Fix `c2pa-node`'s `package.json` to list `@contentauth/c2pa-types` as a `dependency` rather than a `devDependency`, matching `c2pa-web`.
+- Updated dependencies [2de9ba5]
+- Updated dependencies [b3b3196]
+- Updated dependencies [1102535]
+- Updated dependencies [4c8ad00]
+- Updated dependencies [f2f6ada]
+- Updated dependencies [0f42fe8]
+  - @contentauth/c2pa-wasm@0.11.3
+  - @contentauth/c2pa-utilities@0.2.0
+
 ## 0.13.4
 
 ### Patch Changes

diff --git a/packages/c2pa-web/package.json b/packages/c2pa-web/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@contentauth/c2pa-web",
-  "version": "0.13.4",
+  "version": "0.14.0",
   "license": "MIT",
   "repository": {
     "type": "git",