Merge release 'release-2.3.0' branch into main

CHANGELOG.md

@@ -15,6 +15,32 @@ All notable changes to the **Sinch Java SDK** are documented in this file.
 > - `[tech]` — technical improvement
 
 ---
+## v2.3.0 - 2026-10-15
+
+### Voice
+- **[feature]** Support [Voice API v2](https://developers.sinch.com/docs/voice-2.0), exposed under `voice().v2()`
+- **[feature]** Support V2 `Calls` API: `start`, `get`, `list`, `interactByCallId` and `interactByCallName` endpoints
+- **[feature]** Support V2 `Batches` API: `start`, `get`, `getDetails` and `stop` endpoints
+- **[feature]** Support V2 `Sessions` API: `get` endpoint
+- **[feature]** Support V2 `Services` API: `create`, `get`, `list`, `update` and `delete` endpoints
+- **[feature]** Support V2 `SVAML` API: `describe` and `validate` endpoints
+- **[feature]** Support V2 Sinch Events: `validateAuthenticationHeader`, `parseEvent` and `serializeResponse`
+- **[doc]** Snippets for every Voice V2 endpoint, under `voice/v2/`
+- **[doc]** `sinch-events` example: new Voice V2 Sinch Events controller on `/VoiceV2Event`
+- **[test]** Extend V1 `SinchEventsService.validateAuthenticationHeader` coverage
+
+### SDK
+- **[feature]** `SinchClient` transport level settings: `TransportSettings` (`timeoutSeconds`, `useSinchAuth`)
+- **[feature]** `Idempotency-Key` support: for the operations that accept the header, the SDK generates a key when none is set and sends the same key on the `HTTP 429` retries of a call
+- **[test]** Extend `ApplicationAuthManager` signed request validation coverage
+
+### Verification
+- **[test]** Extend `SinchEventsService.validateAuthenticationHeader` coverage
+
+### Build
+- **[dependency]** Bump `jackson.version` to `2.21.7` to solve denial-of-service and unsafe deserialization vulnerabilities in `jackson-databind` (CVE-2026-19032, CVE-2026-68497, CVE-2026-83557, CVE-2026-91776 and CVE-2026-91777).
+- **[releasing]** Bump `central-publishing-maven-plugin` to `0.12.0`: Maven Central rejected the release bundle built with Apache Maven 3.10.0
+
 ## v2.2.0 - 2026-09-17
 
 ### SDK

README.md

@@ -24,6 +24,7 @@ To use Sinch services, you'll need a Sinch account and access keys. You can sign
 - [Handling Exceptions](#handling-exceptions)
 - [Proxy configuration](#proxy-configuration)
 - [Retry configuration](#retry-configuration)
+- [Transport settings](#transport-settings)
 - [Third-party dependencies](#third-party-dependencies)
 - [Examples](#examples)
 - [Changelog and Migration](#changelog--migration)
@@ -107,6 +108,7 @@ Note: The `${sdk.version}` needs to be set according to the released version to
 | Messaging       | [Conversation API](https://developers.sinch.com/docs/conversation/)          |
 |                 | [SMS API](https://developers.sinch.com/docs/sms/)                            |
 | Voice and Video | [Voice API](https://developers.sinch.com/docs/voice/)                        |
+|                 | [Voice API v2](https://developers.sinch.com/docs/voice-2.0)                  |
 | Numbers         | [Numbers API](https://developers.sinch.com/docs/numbers/)                    |
 | Verification    | [Verification API](https://developers.sinch.com/docs/verification/)          |
 |                 | [Number Lookup API](https://developers.sinch.com/docs/number-lookup-api-v2/) |
@@ -316,7 +318,17 @@ You can find a complete example in [examples/sinch-events](https://github.com/si
 
 ### Voice API
 
-The Voice API uses application credentials. Set `applicationKey` and `applicationSecret` (both available on the [Apps dashboard](https://dashboard.sinch.com/voice/apps)); `voiceRegion` is optional and defaults to a global region:
+**Note:** For all new projects, please use Voice API v2. This is especially important for projects involving:
+
+- AI capabilities like Streams and Voice Relay
+- Voice campaigns like Batch calling
+
+You should only use the older Voice API v1 if one of the following is a strict requirement:
+
+- The project must be in General Availability (GA).
+- The project requires In-App voice or Conferencing (until these features are available in v2).
+
+The Voice API v1 uses application credentials. Set `applicationKey` and `applicationSecret` (both available on the [Apps dashboard](https://dashboard.sinch.com/voice/apps)); `voiceRegion` is optional and defaults to a global region:
 
 ```java
 import com.sinch.sdk.SinchClient;
@@ -335,7 +347,7 @@ SinchClient client = new SinchClient(configuration);
 
 #### Sinch Events
 
-The Voice API delivers synchronous Sinch Events to the Event Destination URL configured for your app. Requests are signed with your application credentials, so validation requires the HTTP verb and URI of the controller handling the request, in addition to the `headers` and raw `body`:
+The Voice API v1 delivers synchronous Sinch Events to the Event Destination URL configured for your app. Requests are signed with your application credentials, so validation requires the HTTP verb and URI of the controller handling the request, in addition to the `headers` and raw `body`:
 
 ```java
 import com.sinch.sdk.domains.voice.api.v1.SinchEventsService;
@@ -351,6 +363,12 @@ Some events (for example an incoming call) expect a SVAML response: build it fro
 
 You can find a complete example in [examples/sinch-events](https://github.com/sinch/sinch-sdk-java/tree/main/examples/sinch-events).
 
+#### Voice API v2
+
+> **Note:** Support for the Voice API v2 is currently in preview.
+
+The Voice API v2 needs no extra parameters, use the [common client](#client-initialization) shown above.
+
 
 ### Your first request
 
@@ -542,6 +560,46 @@ Configuration configuration = Configuration.builder()
 SinchClient client = new SinchClient(configuration);
 ```
 
+## Transport settings
+
+`SinchClient` accepts optional transport-level settings alongside credentials. They apply to product API calls and to OAuth token fetches.
+
+| Field | Type | Default | Description |
+|-------|------|---------|-------------|
+| `timeoutSeconds` | `int` | `60` | HTTP I/O timeout in seconds. Pass `0` to disable the timeout. Negative values are rejected. |
+| `useSinchAuth` | `boolean` | `true` | When `true`, OAuth-capable APIs fetch a Sinch access token. Set `false` to disable Sinch authentication: no token is fetched and no `Authorization` header is added. With unified credentials only `projectId` is then required. Has no effect with SMS service plan credentials. |
+
+### Timeout
+
+```java
+import com.sinch.sdk.SinchClient;
+import com.sinch.sdk.models.Configuration;
+import com.sinch.sdk.models.TransportSettings;
+
+...
+Configuration configuration = Configuration.builder()
+        ...
+        .setTransportSettings(
+                TransportSettings.builder()
+                        .setTimeoutSeconds(30)
+                        .build())
+        .build();
+SinchClient client = new SinchClient(configuration);
+```
+
+### Disable Sinch OAuth
+
+```java
+Configuration configuration = Configuration.builder()
+        ...
+        .setTransportSettings(
+                TransportSettings.builder()
+                        .setUseSinchAuth(false)
+                        .build())
+        .build();
+SinchClient client = new SinchClient(configuration);
+```
+
 ## Third-party dependencies
 The SDK relies on the following third-party dependencies:
 - [Jackson](https://github.com/FasterXML/jackson-jakarta-rs-providers): provides JSON serialization/deserialization functionality.

client/resources/config-default.properties

@@ -18,6 +18,14 @@ voice-server-south-america=https://calling-sae1.api.sinch.com
 voice-server-south-east-asia1=https://calling-apse1.api.sinch.com
 voice-server-south-east-asia2=https://calling-apse2.api.sinch.com
 
+voice-v2-region=global
+voice-v2-server-global=https://voice.api.sinch.com
+voice-v2-server-us1=https://us1.voice.api.sinch.com
+voice-v2-server-br1=https://br1.voice.api.sinch.com
+voice-v2-server-eu1=https://eu1.voice.api.sinch.com
+voice-v2-server-sg1=https://sg1.voice.api.sinch.com
+voice-v2-server-au1=https://au1.voice.api.sinch.com
+
 conversation-region=
 conversation-server=https://%s.conversation.api.sinch.com
 template-management-conversation-server=https://%s.template.api.sinch.com

client/src/main/com/sinch/sdk/SDK.java

@@ -3,6 +3,6 @@
 public class SDK {
 
   public static final String NAME = "Sinch Java SDK";
-  public static final String VERSION = "2.3.0-dev";
+  public static final String VERSION = "2.4.0-dev";
   public static final String AUXILIARY_FLAG = "";
 }

client/src/main/com/sinch/sdk/SinchClient.java

@@ -17,6 +17,7 @@
 import com.sinch.sdk.models.NumbersContext;
 import com.sinch.sdk.models.SMSRegion;
 import com.sinch.sdk.models.SmsContext;
+import com.sinch.sdk.models.TransportSettings;
 import com.sinch.sdk.models.VerificationContext;
 import com.sinch.sdk.models.VoiceContext;
 import com.sinch.sdk.models.VoiceRegion;
@@ -46,6 +47,7 @@ public class SinchClient {
   private static final String VOICE_REGION_KEY = "voice-region";
   private static final String VOICE_APPLICATION_MANAGEMENT_SERVER_KEY =
       "voice-application-management-server";
+  private static final String VOICE_V2_REGION_KEY = "voice-v2-region";
 
   private static final String VERIFICATION_SERVER_KEY = "verification-server";
 
@@ -94,6 +96,7 @@ public SinchClient(Configuration configuration) {
     handleDefaultSmsSettings(configurationGuard, props, builder);
     handleDefaultVerificationSettings(configurationGuard, props, builder);
     handleDefaultVoiceSettings(configurationGuard, props, builder);
+    handleDefaultVoiceV2Settings(configurationGuard, props, builder);
     handleDefaultConversationSettings(configurationGuard, props, builder);
     handleDefaultNumberLookupSettings(configurationGuard, props, builder);
 
@@ -210,6 +213,45 @@ private void handleDefaultVoiceSettings(
     }
   }
 
+  private void handleDefaultVoiceV2Settings(
+      Configuration configuration, Properties props, Configuration.Builder builder) {
+
+    com.sinch.sdk.domains.voice.models.v2.VoiceRegion region =
+        configuration
+            .getVoiceV2Context()
+            .map(com.sinch.sdk.domains.voice.models.v2.VoiceContext::getVoiceRegion)
+            .orElse(null);
+
+    String voiceUrl =
+        configuration
+            .getVoiceV2Context()
+            .map(com.sinch.sdk.domains.voice.models.v2.VoiceContext::getVoiceUrl)
+            .orElse(null);
+
+    // default region to be used ?
+    if (null == region && props.containsKey(VOICE_V2_REGION_KEY)) {
+      region =
+          com.sinch.sdk.domains.voice.models.v2.VoiceRegion.from(
+              props.getProperty(VOICE_V2_REGION_KEY));
+    }
+
+    // server is not defined: use the region to set to an existing one and use "global" as a default
+    // fallback
+    if (StringUtil.isEmpty(voiceUrl)) {
+      com.sinch.sdk.domains.voice.models.v2.VoiceRegion regionForFormat =
+          null == region ? com.sinch.sdk.domains.voice.models.v2.VoiceRegion.GLOBAL : region;
+      voiceUrl = props.getProperty(String.format("voice-v2-server-%s", regionForFormat.value()));
+    }
+
+    if (null != region || null != voiceUrl) {
+      builder.setVoiceV2Context(
+          com.sinch.sdk.domains.voice.models.v2.VoiceContext.builder()
+              .setVoiceRegion(region)
+              .setVoiceUrl(voiceUrl)
+              .build());
+    }
+  }
+
   private void handleDefaultConversationSettings(
       Configuration configuration, Properties props, Configuration.Builder builder) {
 
@@ -379,12 +421,21 @@ private void checkConfiguration(Configuration configuration) throws NullPointerE
     Objects.requireNonNull(configuration.getOAuthUrl(), "'oauthUrl' cannot be null");
   }
 
+  private TransportSettings transportSettings() {
+    return configuration.getTransportSettings().orElse(TransportSettings.DEFAULTS);
+  }
+
+  private boolean useSinchAuth() {
+    return transportSettings().getUseSinchAuth();
+  }
+
   private NumbersService numbersInit() {
     return new com.sinch.sdk.domains.numbers.adapters.NumbersService(
         getConfiguration().getUnifiedCredentials().orElse(null),
         configuration.getNumbersContext().orElse(null),
         configuration.getOAuthServer(),
-        this::getHttpClient);
+        this::getHttpClient,
+        useSinchAuth());
   }
 
   private SMSService smsInit() {
@@ -401,7 +452,8 @@ f, getConfiguration().getSmsContext().orElse(null), this::getHttpClient))
                     getConfiguration().getUnifiedCredentials().orElse(null),
                     getConfiguration().getSmsContext().orElse(null),
                     configuration.getOAuthServer(),
-                    this::getHttpClient));
+                    this::getHttpClient,
+                    useSinchAuth()));
   }
 
   private VerificationService verificationInit() {
@@ -414,7 +466,10 @@ private VerificationService verificationInit() {
   private VoiceService voiceInit() {
     return new com.sinch.sdk.domains.voice.adapters.VoiceService(
         getConfiguration().getApplicationCredentials().orElse(null),
+        getConfiguration().getUnifiedCredentials().orElse(null),
         getConfiguration().getVoiceContext().orElse(null),
+        getConfiguration().getVoiceV2Context().orElse(null),
+        getConfiguration().getOAuthServer(),
         this::getHttpClient);
   }
 
@@ -423,15 +478,17 @@ private ConversationService conversationInit() {
         getConfiguration().getUnifiedCredentials().orElse(null),
         getConfiguration().getConversationContext().orElse(null),
         getConfiguration().getOAuthServer(),
-        this::getHttpClient);
+        this::getHttpClient,
+        useSinchAuth());
   }
 
   private NumberLookupService lookupInit() {
     return new com.sinch.sdk.domains.numberlookup.adapters.NumberLookupService(
         getConfiguration().getUnifiedCredentials().orElse(null),
         getConfiguration().getNumberLookupContext().orElse(null),
         getConfiguration().getOAuthServer(),
-        this::getHttpClient);
+        this::getHttpClient,
+        useSinchAuth());
   }
 
   private Properties handlePropertiesFile(String fileName) {
@@ -454,7 +511,8 @@ private HttpClient getHttpClient() {
           local =
               new HttpClientApache(
                   configuration.getHttpProxyConfiguration().orElse(null),
-                  new DefaultRetryManager(configuration.getRetryConfiguration().orElse(null)));
+                  new DefaultRetryManager(configuration.getRetryConfiguration().orElse(null)),
+                  transportSettings().getTimeoutSeconds());
 
           // set SDK User-Agent
           String userAgent = formatSdkUserAgentHeader();

client/src/main/com/sinch/sdk/domains/conversation/adapters/ConversationService.java

@@ -13,6 +13,7 @@ public class ConversationService implements com.sinch.sdk.domains.conversation.C
   private final ConversationContext context;
   private final ServerConfiguration oAuthServer;
   private final Supplier<HttpClient> httpClientSupplier;
+  private final boolean useSinchAuth;
 
   private volatile com.sinch.sdk.domains.conversation.api.v1.ConversationService conversationV1;
   private volatile TemplatesService templates;
@@ -21,11 +22,13 @@ public ConversationService(
       UnifiedCredentials credentials,
       ConversationContext context,
       ServerConfiguration oAuthServer,
-      Supplier<HttpClient> httpClientSupplier) {
+      Supplier<HttpClient> httpClientSupplier,
+      boolean useSinchAuth) {
     this.credentials = credentials;
     this.context = context;
     this.oAuthServer = oAuthServer;
     this.httpClientSupplier = httpClientSupplier;
+    this.useSinchAuth = useSinchAuth;
   }
 
   public com.sinch.sdk.domains.conversation.api.v1.ConversationService v1() {
@@ -34,7 +37,7 @@ public com.sinch.sdk.domains.conversation.api.v1.ConversationService v1() {
         if (null == this.conversationV1) {
           this.conversationV1 =
               new com.sinch.sdk.domains.conversation.api.v1.adapters.ConversationService(
-                  credentials, context, oAuthServer, httpClientSupplier);
+                  credentials, context, oAuthServer, httpClientSupplier, useSinchAuth);
         }
       }
     }
@@ -46,7 +49,8 @@ public TemplatesService templates() {
       synchronized (this) {
         if (null == this.templates) {
           this.templates =
-              new TemplatesService(credentials, context, oAuthServer, httpClientSupplier);
+              new TemplatesService(
+                  credentials, context, oAuthServer, httpClientSupplier, useSinchAuth);
         }
       }
     }