Nectenda/nectenda
Watch
1
0
Fork
You've already forked nectenda
 0
Code Issues 1 Pull requests Projects 5 Releases Packages Wiki Activity Actions

Update dependency @simplewebauthn/server to v14 #26

Closed
renovate wants to merge 1 commit from renovate/simplewebauthn-server-14.x into main
pull from: renovate/simplewebauthn-server-14.x
merge into: Nectenda:main
Conversation 1 Commits 1 Files changed 2 +69 -11
renovate commented 2026-09-21 10:25:35 +01:00
Collaborator
Copy link

This PR contains the following updates:

Package Change Age Confidence
@simplewebauthn/server (source) ^13.1.1 → ^14.0.0 age confidence

Release Notes

MasterKale/SimpleWebAuthn (@​simplewebauthn/server)

v14.0.2

Compare Source

This update fixes a CVSS v3 Moderate (5.4 / 10) and a CVSS v3 Moderate (6.3 / 10) security
vulnerabilities identified in @​simplewebauthn/server. See the security advisory linked below for
more information.

Changes:

  • [server] Revamped certificate revocation logic to only cryptographically verify and process
    CRLs from certificates that chained back to an RP-chosen trust anchor
    (GHSA-2g3p-m8c9-hhwh,
    GHSA-j3h4-m3m2-7p7j)

v14.0.1

Compare Source

Changes:

  • [server] Attestation statements using PQC algorithms can now be verified
    (#​800)

v14.0.0

Compare Source

The headlining feature of this release is @​simplewebauthn/server gaining support for passkeys
using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those
same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44
passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers
start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for
more info 🚀

Setting our sites on the browser, @​simplewebauthn/browser picks up a new sendSignal() method
as a single method to call all of the
WebAuthn Signal APIs. See
https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x
and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim
to support Node LTS releases through their Active and Maintenance windows as tracked on
the Node.js Releases page, and aim to support Deno
minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

Breaking Changes
  • [browser] [server] The minimum supported runtime versions have been increased to Node LTS 22.x
    and higher, and Deno v2.4.x and higher
    (#​763)

Configuration

📅 Schedule: (in timezone Europe/London)

  • Branch creation
    • "before 6am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@simplewebauthn/server](https://github.com/MasterKale/SimpleWebAuthn/tree/master/packages/server#readme) ([source](https://github.com/MasterKale/SimpleWebAuthn/tree/HEAD/packages/server)) | [`^13.1.1` → `^14.0.0`](https://renovatebot.com/diffs/npm/@simplewebauthn%2fserver/13.3.3/14.0.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@simplewebauthn%2fserver/14.0.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@simplewebauthn%2fserver/13.3.3/14.0.2?slim=true) | --- ### Release Notes <details> <summary>MasterKale/SimpleWebAuthn (@&#8203;simplewebauthn/server)</summary> ### [`v14.0.2`](https://github.com/MasterKale/SimpleWebAuthn/blob/HEAD/CHANGELOG.md#v1402) [Compare Source](https://github.com/MasterKale/SimpleWebAuthn/compare/v14.0.1...v14.0.2) This update fixes a CVSS v3 Moderate (5.4 / 10) and a CVSS v3 Moderate (6.3 / 10) security vulnerabilities identified in [@&#8203;simplewebauthn/server](https://github.com/simplewebauthn/server). See the security advisory linked below for more information. **Changes:** - **\[server]** Revamped certificate revocation logic to only cryptographically verify and process CRLs from certificates that chained back to an RP-chosen trust anchor ([GHSA-2g3p-m8c9-hhwh](https://github.com/MasterKale/SimpleWebAuthn/security/advisories/GHSA-2g3p-m8c9-hhwh), [GHSA-j3h4-m3m2-7p7j](https://github.com/MasterKale/SimpleWebAuthn/security/advisories/GHSA-j3h4-m3m2-7p7j)) ### [`v14.0.1`](https://github.com/MasterKale/SimpleWebAuthn/blob/HEAD/CHANGELOG.md#v1401) [Compare Source](https://github.com/MasterKale/SimpleWebAuthn/compare/v14.0.0...v14.0.1) **Changes:** - **\[server]** Attestation statements using PQC algorithms can now be verified ([#&#8203;800](https://github.com/MasterKale/SimpleWebAuthn/pull/800)) ### [`v14.0.0`](https://github.com/MasterKale/SimpleWebAuthn/blob/HEAD/CHANGELOG.md#v1400---The-one-after-they-go-quantum) [Compare Source](https://github.com/MasterKale/SimpleWebAuthn/compare/v13.3.3...v14.0.0) The headlining feature of this release is **[@&#8203;simplewebauthn/server](https://github.com/simplewebauthn/server)** gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See <https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support> for more info 🚀 Setting our sites on the browser, **[@&#8203;simplewebauthn/browser](https://github.com/simplewebauthn/browser)** picks up a new `sendSignal()` method as a single method to call all of the [WebAuthn Signal APIs](https://w3c.github.io/webauthn/#sctn-signal-methods). See <https://simplewebauthn.dev/docs/packages/browser#sendsignal> for more info 🛜 As for breaking changes, the minimum supported version of Node has been raised to **Node LTS 22.x and higher**, and **Deno v2.4.x and higher**. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on [the Node.js Releases page](https://nodejs.org/en/about/previous-releases), and aim to support Deno minor releases for up to one year after their release That's not all, though. Continue reading for the full list of changes in this release! 🎉 **Changes:** - **\[server]** The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, `generateRegistrationOptions()` will include ML-DSA-44 as the most preferred public key algorithm during registration. See <https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support> for more info ([#&#8203;785](https://github.com/MasterKale/SimpleWebAuthn/pull/785), [#&#8203;794](https://github.com/MasterKale/SimpleWebAuthn/pull/794)) - **\[browser]** The new `sendSignal()` method offers a simple way to invoke the [WebAuthn Signal APIs](https://w3c.github.io/webauthn/#sctn-signal-methods). See <https://simplewebauthn.dev/docs/packages/browser#sendsignal> for more info ([#&#8203;778](https://github.com/MasterKale/SimpleWebAuthn/pull/778)) - **\[browser]** The new `browserSupportsPasskeys()` helper method performs more robust WebAuthn support detection by also checking for typical passkey-related WebAuthn features. See <https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys> for more info ([#&#8203;761](https://github.com/MasterKale/SimpleWebAuthn/pull/761)) - **\[browser]** The new `getBrowserCapabilities()` helper method wraps WebAuthn's `getClientCapabilities()` with additional feature detection checks when possible. See <https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities> for more info ([#&#8203;761](https://github.com/MasterKale/SimpleWebAuthn/pull/761)) - **\[server]** `verifyAuthenticationResponse()` accepts an optional new `expectedTopOrigin` argument that supports cross-origin authentication verification. See <https://simplewebauthn.dev/docs/advanced/server/cross-origin-support> for more info ([#&#8203;773](https://github.com/MasterKale/SimpleWebAuthn/pull/773)) - **\[server]** `MetadataService.initialize()` accepts an optional new `logger` argument that can be used to capture MetadataService status output in a project-specific manner. See <https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging> for more info ([#&#8203;765](https://github.com/MasterKale/SimpleWebAuthn/pull/765)) - **\[server]** The typing of `transports` in `excludeCredentials` when calling `generateRegistrationOptions()`, and `allowCredentials` when calling `generateAuthenticationOptions()`, has been updated to `string[]` to make it easier to call these methods ([#&#8203;776](https://github.com/MasterKale/SimpleWebAuthn/pull/776)) - **\[server]** `"tpm"` attestation verification is now more tolerant of variable casing in the TPM manufacturer IDs ([#&#8203;772](https://github.com/MasterKale/SimpleWebAuthn/pull/772)) - **\[server]** `generateRegistrationOptions()` and `verifyRegistrationResponse()` now use the same default list of allowed public key algorithms for `supportedAlgorithmIDs` ([#&#8203;791](https://github.com/MasterKale/SimpleWebAuthn/pull/791)) - **\[server]** The `validateCertificatePath()` helper now supports x5c arrays containing cross-signed certificates ([#&#8203;796](https://github.com/MasterKale/SimpleWebAuthn/pull/796)) ##### Breaking Changes - **\[browser] \[server]** The minimum supported runtime versions have been increased to Node LTS 22.x and higher, and Deno v2.4.x and higher ([#&#8203;763](https://github.com/MasterKale/SimpleWebAuthn/pull/763)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/London) - Branch creation - "before 6am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC45My40IiwidXBkYXRlZEluVmVyIjoiNDQuOTMuNCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->
Update dependency @simplewebauthn/server to v14
Some checks failed
CI / build (push) Failing after 34s
Details
CI / build (pull_request) Failing after 27s
Details
CI / e2e (push) Has been skipped
Details
CI / e2e (pull_request) Has been skipped
Details
CI / promote (push) Has been skipped
Details
CI / promote (pull_request) Has been skipped
Details
0b3cf5764a
cruelacid commented 2026-09-21 14:29:16 +01:00
Owner
Copy link

Applied in 466cd09, with the fix it needed. v14 renamed AuthenticatorTransportFuture to AuthenticatorTransport; five occurrences in packages/identity/src/passkeys.ts. That rename is why this was red, and typecheck passing across every package is what says it was the whole of it.

Applied in 466cd09, with the fix it needed. v14 renamed AuthenticatorTransportFuture to AuthenticatorTransport; five occurrences in packages/identity/src/passkeys.ts. That rename is why this was red, and typecheck passing across every package is what says it was the whole of it.
cruelacid closed this pull request 2026-09-21 14:29:16 +01:00
Some checks are pending
CI / build (push) Failing after 34s
Details
CI / build (pull_request) Failing after 27s
Required
Details
CI / e2e (push) Has been skipped
Details
CI / e2e (pull_request) Has been skipped
Required
Details
CI / promote (push) Has been skipped
Details
CI / promote (pull_request) Has been skipped
Details
Release note / release-note (pull_request)
Required

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
area:docs
docs/

  
area:identity
packages/identity

  
area:ops
deploy/, CI, hosting

  
area:plugin
packages/plugin

  
area:server
packages/server

  
channel:community
Obsidian forum, Obsidian Discord, Reddit

  
channel:direct
Cold outreach to named firms

  
channel:owned
nectenda.com pages, the feedback board

  
channel:press
Hacker News, newsletters, outlets, YouTube creators

  
channel:social
Bluesky, Mastodon, X, YouTube accounts

  
e2ee-constrained
End-to-end encryption changes the shape of the answer

  
gate:at-ga
Held until Gates A-C close and terms/privacy leave DRAFT

  
gate:pre-ga
Safe to do before the launch gates close

  
marketing
Reach and positioning; work published off nectenda.com

  
parity
Relay feature-parity programme

  
relay:absent
4 - Not supported, not requested, not planned at Relay

  
relay:planned
2 - On Relay's roadmap (Active/Planned) or has an open PR

  
relay:requested
3 - Asked for by Relay users or under 'Considering'; not committed

  
relay:supported
1 - Relay ships this today

  
risk:additive
New message type, table or column; backward compatible

  
risk:contract
Changes something existing accounts or stored data depend on

  
risk:none
Client-only; the server is untouched

  
usability
How the product is understood and learned, not what it does

No labels
area:docs
area:identity
area:ops
area:plugin
area:server
channel:community
channel:direct
channel:owned
channel:press
channel:social
e2ee-constrained
gate:at-ga
gate:pre-ga
marketing
parity
relay:absent
relay:planned
relay:requested
relay:supported
risk:additive
risk:contract
risk:none
usability
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Nectenda/nectenda!26
No description provided.