[dependabot]

Bumps webauthn from 3.4.3 to 3.5.0.

Release notes

Sourced from webauthn's releases.

v3.5.0

Added

• Add support for crossOrigin/topOrigin verification during credential registration and authentication by @​nicolastemciuc in #486.
• Add support for the attestation_formats option in WebAuthn::Credential.options_for_create by @​santiagorodriguez96 in #514.
• Add support for the hints option in WebAuthn::Credential.options_for_create and WebAuthn::Credential.options_for_get by @​santiagorodriguez96 in #513.
• Reject authenticator data where the BS (backup state) flag is set but the BE (backup eligibility) flag is not, during credential registration and authentication. Raises WebAuthn::BackupFlagsVerificationError. By @​santiagorodriguez96 in #516.
• Reject credential IDs longer than 1023 bytes during credential registration. Raises WebAuthn::CredentialIdLengthVerificationError. By @​santiagorodriguez96 in #517.
• Add WebAuthn.generate_user_handle as an alias for generate_user_id by @​ttanimichi in #503.

Changed

• Bump the default credential_options_timeout from 120_000 to 300_000 milliseconds (5 minutes) by @​santiagorodriguez96 in #515.
• WebAuthn::FakeClient#get now defaults backup_state to false. The previous default (backup_eligibility: false, backup_state: true) produced authenticator data that now fails verification. By @​santiagorodriguez96 in #516.
• Avoid mutating caller relying-party options by @​OskarEichler in #509.

Removed

• Remove TokenBinding verification during credential registration and authentication by @​nicolastemciuc in #450.
  • BREAKING CHANGE: WebAuthn::TokenBindingVerificationError no longer exists. Remove it from any rescue clauses.
  • BREAKING CHANGE: WebAuthn::FakeClient.new no longer accepts token_binding:.
  • BREAKING CHANGE: WebAuthn::ClientData no longer exposes #token_binding or #valid_token_binding_format?.

New Contributors

• @​ttanimichi made their first contribution in cedarcode/webauthn-ruby#500
• @​sandstrom made their first contribution in cedarcode/webauthn-ruby#505
• @​OskarEichler made their first contribution in cedarcode/webauthn-ruby#509

Full Changelog: cedarcode/webauthn-ruby@v3.4.3...v3.5.0

Changelog

Sourced from webauthn's changelog.

v3.5.0

Added

• Add support for crossOrigin/topOrigin verification during credential registration and authentication. #486 [@​nicolastemciuc]
• Add support for the attestation_formats option in WebAuthn::Credential.options_for_create. #514 [@​santiagorodriguez96]
• Add support for the hints option in WebAuthn::Credential.options_for_create and WebAuthn::Credential.options_for_get. #513 [@​santiagorodriguez96]
• Reject authenticator data where the BS (backup state) flag is set but the BE (backup eligibility) flag is not, during credential registration and authentication. Raises WebAuthn::BackupFlagsVerificationError. #516 [@​santiagorodriguez96]
• Reject credential IDs longer than 1023 bytes during credential registration. Raises WebAuthn::CredentialIdLengthVerificationError. #517 [@​santiagorodriguez96]
• Add WebAuthn.generate_user_handle as an alias for generate_user_id. #503 [@​ttanimichi]

Changed

• Bump the default credential_options_timeout from 120_000 to 300_000 milliseconds (5 minutes). #515 [@​santiagorodriguez96]
• WebAuthn::FakeClient#get now defaults backup_state to false. The previous default (backup_eligibility: false, backup_state: true) produced authenticator data that now fails verification. #516 [@​santiagorodriguez96]
• Avoid mutating caller relying-party options. #509 [@​OskarEichler]

Removed

• Remove TokenBinding verification during credential registration and authentication. #450 [@​nicolastemciuc]
  • BREAKING CHANGE: WebAuthn::TokenBindingVerificationError no longer exists. Remove it from any rescue clauses.
  • BREAKING CHANGE: WebAuthn::FakeClient.new no longer accepts token_binding:.
  • BREAKING CHANGE: WebAuthn::ClientData no longer exposes #token_binding or #valid_token_binding_format?.

Commits

• e8029aa Merge pull request #520 from cedarcode/sr--run-release-action-with-latest-ruby
• 8de01fc ci: run release action with latest ruby
• faaec49 Merge pull request #519 from cedarcode/sr--prepare-for-3-5-0-release
• 5987557 docs: update CHANGELOG with new release
• c60c04b build: bump gem version from v3.4.3 to v3.5.0
• ca6a2a9 Merge pull request #518 from cedarcode/sr--update-changelog
• a7c07de docs: update CHANGELOG with missing change
• 0027be3 Merge pull request #517 from cedarcode/sr--verify-credential-id-length
• b289950 docs: add missing PR link to changelog
• 20e2b36 Merge branch 'master' into sr--verify-credential-id-length
• Additional commits viewable in compare view