Caliper SDK News

Python Version Update

The SDK now runs on Python 3.14. Shared dev box users can upgrade immediately using upgrade_python_version 3.14. The caliper_admin script has been updated to reflect the change.

Security

• SAML signing has been strengthened this month. saml_response.sign now defaults to SHA-256 (up from SHA-1) and accepts a signature_algorithm parameter to override the algorithm when needed.
• Q2SamlResponse signing now also correctly includes the digest, ensuring signatures are complete and verifiable. Together these changes make SAML flows more secure without requiring any action from extension developers.

SDK DbObject Enhancements

• User.get_account_related_users() now returns MiddleName, LastName, and Email in the result and UserDemographicData.get now includes PrimaryCIF. Extensions can now get these details in a single call rather than making additional queries.

• self.db.audit_record.get and self.db.transactions.get_ach_details both now accept a timeout parameter, defaulting to 30 seconds, giving extensions precise control over long-running DB calls thus preventing silent hangs if the database takes long time to respond. Calls that run longer than 30 seconds will now time out unless you pass a higher value.

Performance and Efficiency

• Q2Vault now implements a singleton pattern, ensuring only one instance is created and reused across the lifetime of your extension. This cuts down on unnecessary instantiation overhead, particularly under high-concurrency or repeated vault access patterns.

• The memory footprint of self.cache instantiation has also been improved, reducing resource consumption under high traffic loads with no changes required to existing extension code.

Clearer Errors and Fixes

• PolicyData.set now serializes validation failures through to the response, giving callers structured error detail instead of failing silently. A new SSOErrorResponse model has also been introduced to produce a well-formatted, mobile-responsive failure page rather than a generic error.

• q2 setup_db now reads the stack name from the configured environment variable and returns exit code 3 on failure, making it dependable in CI/CD pipelines. XML parsing failures caused by special characters in config JSON values have been resolved.

Mobile SDK News

iOS – Xcode Support

Our October release (26.10.0) of the Q2Mobility iOS app now supports Xcode 26.6. To ensure seamless compatibility with the Q2 build system, we kindly request that you review and update your module if it includes any SDKs or third-party dependencies built with earlier versions of Xcode.

We are also targeting support for Xcode 27.x by the end of the year. Please stay tuned for additional details and the exact timing of this update.

iOS – Swift 6

We're planning to upgrade to Swift 6 in an upcoming iOS release, most likely in early Q1 2027. Exact timing isn't finalized yet, but the upgrade may introduce language, compiler, and dependency compatibility changes.

What to do now: Start reviewing your modules and any third-party dependencies for Swift 6 readiness. We'll share detailed timelines as they firm up.

Android – Android API Target

We plan to update the Q2Mobility Android app to Android API level 37 (Android 17) by the end of the year. The minimum supported Android API continues to be level 29 (Android 10). To ensure seamless compatibility with the Q2 build system, we kindly request that you review and update your module if it includes any SDKs or third-party dependencies that target older versions of Android API levels. Please stay tuned for additional details and the exact timing of this update.

Android – Google Play Contacts Policy

Google Play is introducing a new policy covering the READ_CONTACTS permission, which requires a declaration in the Play Console by January 27, 2027. Because partner modules are built into the Q2Mobility app, any module that adds READ_CONTACTS to the merged manifest falls within the scope of that declaration.

Partners should review their modules, confirm whether READ_CONTACTS is present, and verify that Android 17's Contact Picker will satisfy the use case that requires it. Where the Contact Picker is sufficient, modules should adopt it rather than retaining the permission.

This is not limited to mSDK modules — it applies to any SDK or module that uses READ_CONTACTS, including third-party SDKs and transitive dependencies.

Developer Portal News

Company Admin's Can Now Provision Vault Keeper Access

Company admins can now grant or revoke Vault Keeper permissions for team members directly from My Organization → Members — the same toggle interface used for Sandbox and Shared Dev Server access. No support ticket needed.

Vault Keeper grants access to the Self Service Vault section, where users can:

• View secrets and certificates — look up secrets registered to your company across environment stores, company stores, and certificate stores, filtered by environment and service
• Create and edit secrets and certificates — register new secrets in Vault directly from the portal via Self Service → Vault → Create Secret

Request Live Demo on App Catalog Pages

App pages for accelerator and marketplace solutions in the FI Catalog now include a Request Live Demo button alongside the existing Request App button. Clicking it opens a modal where you can optionally share up to three availability windows (date + morning/afternoon/evening — no timezone required). Submitting fires two server-sent emails automatically: a notification to the app's partner contacts and Q2, and a confirmation back to you. For apps in the Q2 Reseller Program, the button instead prompts you to connect with your Q2 CSM.

Simplified App Order Views

The App Order page now tells you exactly who is blocking progress and what they need to do. Instead of long status sentences, the order sidebar shows a concise label — Pending Partner [Vendor Name] or Pending Customer [FI Name] — and a yellow badge above the stepper echoes the same message.

Tecton News

A Redesigned Docs Site

tecton.q2developer.com received a refresh just in time for DevDays! New navigational structure and hierarchy for better site organization, new sectional landing pages with a Tecton styling playground, and improved Getting Started documentation to help introduce all the ways to use Tecton in your projects.

Tecton 1.73 Released

This release, adds a new Date Picker component, and tightens up keyboard navigation and accessibility across the design system.

A New Way to Pick Dates

Date Picker joins the design system with single-date and date-range selection across both popover and mobile action sheet interfaces, with full responsive design and customizable styling for any date selection use case.

Keyboard Interaction, Focus, and Accessibility, Tightened Up

Button press states are now unified with focus-visible styling, Carousel keeps focus anchored on dynamic pagination dots, and Chart Area, Chart Bar, and Chart Donut all gained arrow-key navigation with screen reader announcements. Item is now activatable with Enter and Space. Calendar, Select, Pill, and Tag correctly return focus to their trigger when a popover closes, and Popover itself now closes on outside scroll.

Caliper API News

Expanding Open Banking with Transaction Retrieval

Open Banking is expanding its capabilities with the introduction of Get Generated Transactions, a new endpoint that makes generated payment transactions accessible through the Caliper API. The Open Banking endpoints enable commercial banking customers to initiate ACH, domestic wire, and international wire payments directly from ERP and third-party systems, without logging into Q2's digital banking interface (UUX). With this latest addition, developers can retrieve generated transactions programmatically, extending the integration beyond payment origination and making transaction information more accessible within existing business workflows.

Latest Releases

Caliper SDK (Python) v2.344.0 - CHANGELOG

Mobile SDK v26.10.0 - CHANGELOG

Tecton SDK v1.73.1 - CHANGELOG

Marketplace (Python) v0.8.9 - CHANGELOG

Caliper API (Python) v1.56.0 – CHANGELOG