Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

build(deps): bump github.com/go-webauthn/webauthn from 0.10.2 to 0.11.0 #1154

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Aug 1, 2024

Bumps github.com/go-webauthn/webauthn from 0.10.2 to 0.11.0.

Release notes

Sourced from github.com/go-webauthn/webauthn's releases.

v0.11.0

v0.11.0 (2024-07-29)

Features

BREAKING CHANGES

While I endeavor to avoid breaking changes some are necessary to support both better outcomes for implementers and fix issues which are not desirable. This release packs a quite a few, so it's important to take the time to read. While the details on adapting are not comprehensive, they should easy to understand and clarification will be added where it makes sense. Feel free to open a discussion if you're having issues migrating.

  • MAJOR: A majority of the functionality that exists within the metadata package has been completely reworked. The rework has added a number of great validation options for implementers as well as allowing them to more easily manage metadata blobs and the refresh of these blobs in their own domain logic. This will require substantial work for anyone currently using it. I will aim to make a discussion explaining all of it in the coming days.
  • The following fields and backwards compatible elements have been removed; Icon field from the CredentialEntity struct, WebAuthnIcon function from the User interface, RPIcon/RPOrigin/Timeout fields from the Config struct, Transports field from the CredentialCreationResponse (new field has existed in the AuthenticatorAttestationResponse struct for quite some time which matches the spec).
  • The Backup Eligible and Backup State flags within the CredentialFlags struct (field of the Credential struct) are now strictly validated to be consistent with the spec. This breaks implementations which do not strictly adhere to the specification. Several major providers either have or are currently "upgrading" existing WebAuthn credential records to BE and BS passkeys.
  • The default modality values are now empty by default. This allows additional browser flows to be accessible to implementers. This change will change default behavior. Previously the required resident key value was set to false, and the user verification option was set to 'preferred'. Implementers looking for consistent values should customize the Authenticator Selection Criteria during registration.
Commits
  • f8b9177 release: v0.11.0 (#263)
  • 23532cc build(deps): bump github/codeql-action from 3.25.13 to 3.25.15 (#262)
  • 9b0debf build(deps): bump ossf/scorecard-action from 2.3.3 to 2.4.0 (#261)
  • b382edc feat: parse credential bytes (#258)
  • f5fa279 [StepSecurity] Apply security best practices (#259)
  • b5e375e docs: adjust readme (#235)
  • 6713911 feat(metadata)!: rework as a provider (#239)
  • a5c838a feat!: allow empty modality values (#257)
  • 7dee1ee build(deps): update dependency go to v1.22.5 (#250)
  • 98bd0cb build(deps): update module github.com/fxamacker/cbor/v2 to v2.7.0 (#249)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/go-webauthn/webauthn](https://github.com/go-webauthn/webauthn) from 0.10.2 to 0.11.0.
- [Release notes](https://github.com/go-webauthn/webauthn/releases)
- [Commits](go-webauthn/webauthn@v0.10.2...v0.11.0)

---
updated-dependencies:
- dependency-name: github.com/go-webauthn/webauthn
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot requested a review from jkennedyvz as a code owner August 1, 2024 04:46
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Aug 1, 2024
@dependabot dependabot bot requested a review from jrozner as a code owner August 1, 2024 04:46
@dependabot dependabot bot added the go Pull requests that update Go code label Aug 1, 2024
@dependabot dependabot bot requested a review from JoelAtDeluxe as a code owner August 1, 2024 04:46
Update WebAuthn implementation to remove deprecated fields and add new validation options.

* **Remove deprecated fields:**
  - Remove `WebAuthnIcon` function from `webauthnUser` struct in `backend/authschemes/webauthn/webauthnuser.go`.
  - Remove `RPOrigin` and `Timeout` fields from `WebauthnConfig` struct in `backend/config/authconfig.go`.
  - Remove references to `RPOrigin` and `Timeout` fields in `auth.Config` struct in `backend/authschemes/webauthn/webauthn.go`.

* **Add new validation options:**
  - Add `CredentialFlags` struct with `BackupEligible` and `BackupState` fields and a `Validate` method in `backend/authschemes/webauthn/types.go`.
  - Update `webAuthNSessionData` struct to include `Metadata` field in `backend/authschemes/webauthn/session.go`.
  - Update `makeWebauthNSessionData` and `makeDiscoverableWebauthNSessionData` functions to include `Metadata` parameter in `backend/authschemes/webauthn/session.go`.

* **Miscellaneous changes:**
  - Update `beginRegistration` function to remove `Timeout` and `RPOrigin` references in `backend/authschemes/webauthn/webauthn.go`.
  - Update `BindRoutes` function to fix formatting and add parentheses in `backend/authschemes/webauthn/webauthn.go`.

---

For more details, open the [Copilot Workspace session](https://copilot-workspace.githubnext.com/ashirt-ops/ashirt-server/pull/1154?shareId=XXXX-XXXX-XXXX-XXXX).
Copy link
Contributor Author

dependabot bot commented on behalf of github Sep 1, 2024

A newer version of github.com/go-webauthn/webauthn exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file go Pull requests that update Go code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant