v0.13.21

[AsamK]

What's Changed

• Add missing isExpirationUpdate field to JSON serialization by @13rac1 in Add missing isExpirationUpdate field to JSON serialization #1858

New Contributors

• @13rac1 made their first contribution in Add missing isExpirationUpdate field to JSON serialization #1858

Full Changelog: v0.13.20...v0.13.21

---

This discussion was created from the release v0.13.21.

[marcos-morar]

@AsamK nothing explicitly mentions SPQR support despite #1859 being closed via commit 06fd350 (libsignal-service-java update).

The commit message and changes also don’t reference SPQR. I noticed multiple instances of UsePqRatchet.NO in the code, suggesting signal-cli explicitly disables SPQR, possibly for backward compatibility. Can you confirm if SPQR with ML-KEM ratcheting is enabled in sessions?

[AsamK]

SPQR should be enabled with the new libsignal-client library. The session state and encryption is completely handled by that library.
But I haven't checked if it's really used.

[marcos-morar]

Thanks for the response, @AsamK!

As I mentioned before, I noticed UsePqRatchet.NO in several places (e.g., decryption calls), it seems SPQR might be disabled in some cases for compatibility. However, I couldn’t find UsePqRatchet.YES, UsePqRatchet.AUTO, or similar indicators that SPQR ratcheting is actively used.

Could you clarify when SPQR is actually used in sessions (e.g., with SPQR-capable peers)? Also, any tips for verifying ML-KEM ratcheting in logs (maybe via --debug flags) would be helpful to confirm it’s active.

Thanks again!

[AsamK]

The UsePqRatchet option has been removed in the new version. That means it's enabled by default now.
libsignal-client doesn't directly expose information about the session state. To check the pq ratchet state, you would need to read the session state from the database using the protobuf RecordStructure (https://github.com/signalapp/libsignal/blob/main/rust/protocol/src/proto/storage.proto#L66).

[marcos-morar]

Thanks for the clarification.

Cheers!