Version 2.9.13 (v2.9.13.0)

Release|2026-08-30

New Features

• Supported XPass Q2 (XPQ2-DPB)

• Added unicast device discovery using the device IP address

• Added an option to accept DesFire cards only through EV2 Secure Messaging

• Added device capability flags

• Included security evidence in the distribution package

1. Supports new devices.

   • XPass Q2 (XPQ2-DPB)

2. Added unicast device discovery using the device IP address.

   The request is sent directly to one IPv4 address instead of being broadcast, so a device is still found when broadcast is blocked or the device is on another subnet.

   Note that a response timeout is reported as success. Check the device count returned by BS2_GetDevices rather than the return code.

   • Add API BS2_SearchDeviceByIP

3. Added an option to accept DesFire cards only through EV2 Secure Messaging.

   When enabled, a card that cannot use EV2 Secure Messaging fails authentication and the reason is reported as BS2_SUB_EVENT_AUTH_FAIL_EV2SM_REQUIRED.

   Please refer to the linked API descriptions below for supported devices and firmware versions.

   • Refer to structure BS2CardConfig

   • Refer to structure BS2DeviceCapabilities

4. Added device capability flags.

   A flag only indicates whether the device supports the feature, not whether the SDK provides a way to use it.

   • Refer to structure BS2DeviceCapabilities

   • y2k38Supported, ev2smSupported, videoStandbySupported

   • authFailLockoutSupported, doorUnlockLockImproveSupported, toggleDoorSupported

   • antiTailgatingSupported, elevatorCabinAuthSupported, reAuthPreventionSupported

5. Included security evidence in the distribution package.

   • SBOM (CycloneDX, Syft)

   • Vulnerability report (Grype)

   • SHA256SUMS.txt

   • Security assessment

Modified Features

1. The device search API BS2_SearchDevicesEx has been deprecated.

   Use BS2_SearchDevices together with BS2_SetEnableIPV4 / BS2_SetEnableIPV6 instead.

   BS2_SearchDeviceByIP is not a replacement. Its argument is the address of the target device, not a host or broadcast address.