v0.17.4 (2026-05-22)

Dependency Updates

This release just contains updates to dependencies.

v0.17.4 Latest

Latest

Compare

Choose a tag to compare

v0.17.3 (2026-05-09)

Dependency Updates

This release just contains updates to dependencies.

v0.17.3

Compare

Choose a tag to compare

v0.17.2 (2026-05-03)

Bug Fixes

• webauthn: include verify attestation func for credential (#679) (1f354c8)

v0.17.2

Compare

Choose a tag to compare

0.17.1 (2026-05-03)

Bug Fixes

• protocol: remove unnecessary guard (#675) (1e07db1)
• webauthn: minimized encoding outputs (#670) (3847681)

v0.17.1

Compare

Choose a tag to compare

0.17.0 (2026-04-21)

• fix!: split attestation type and format (#658) (3c1e870), closes #658 #476
• feat!: tighten cross-origin defaults (#647) (80cc224), closes #647

Bug Fixes

• protocol: short-circuit apple attestation extension lookup (#664) (5296bc7)

Features

• webauthn: add authenticator registration filtering (#668) (0be632e)
• webauthn: credential message pack (#660) (c7d933c)

BREAKING CHANGES

• A bug with the Credential Record which was
  introduced early in the libraries lifecycle has resulted in a
  breaking change to the Credential struct. If you are manually
  serializing this struct instead of using encoding/json you
  will be required to make manual changes; though Integrators
  should consider these notes regardless.

  • protocol.CredentialTypeFIDOU2F has been removed;
    replace uses with protocol.AttestationFormatFIDOUniversalSecondFactor
    (cast to string where the destination field is a plain string).

  • The semantics of the AttestationType field on webauthn.Credential
    and protocol.CredentialDescriptor have changed. Integrators that
    inspect this field to detect a format (typically checking for
    "fido-u2f") must switch to the new AttestationFormat field; the
    FIDO-U2F AppID and AppIDExclude extension helpers now key on
    AttestationFormat, so a descriptor literal constructed with
    AttestationType: "fido-u2f" will no longer trigger them.

  • Stored Credential JSON records are migrated transparently by the
    new UnmarshalJSON, but re-marshaled records will carry
    attestationFormat rather than a format string in attestationType;
    downstream consumers that parsed the legacy shape directly should
    be updated.

  • The Credential.Verify method has been updated and may fail in
    previous scenarios where it passed previously. It will also update
    the AttestationType value as a side-effect when used.

• The Cross-Origin verification semantics have changed
  significantly due to the stabilization of the WebAuthn Level 3
  specification. It is no longer possible to disable verification, and
  Cross-Origin ceremonies must explicitly be allowed in this release.

  • protocol.TopOriginIgnoreVerificationMode has been removed. Code that
    referenced it must switch to one of the other constants as there is
    no longer a mode which disables the Top Origin verification such as:

    • TopOriginExplicitVerificationMode; match against RPTopOrigins only
      (recommended, and the new coerced default)
    • TopOriginAutoVerificationMode; match against the union of
      RPTopOrigins and RPOrigins
    • TopOriginImplicitVerificationMode; match against RPOrigins only

  • webauthn.Config.validate now rewrites a zero-valued
    RPTopOriginVerificationMode to TopOriginExplicitVerificationMode.
    Integrators that left the field unset previously got ignore-mode
    semantics (any Top Origin accepted); they now get strict matching
    against RPTopOrigins and must populate that list, or explicitly
    select a different mode; for Cross-Origin flows to succeed.

  • Cross-Origin ceremonies (those where the authenticator reports
    crossOrigin = true in the ClientData) are rejected by default.
    Integrators that rely on iframe-embedded or other Cross-Origin WebAuthn
    flows must set webauthn.Config.RPAllowCrossOrigin = true. The library
    continues to enforce Top Origin verification on accepted Cross-Origin
    ceremonies per the configured mode.

  • protocol.CollectedClientData.Verify no longer accepts
    TopOriginIgnoreVerificationMode; callers that pass an unknown mode
    receive ErrNotImplemented with detail "unknown Top Origin
    verification mode".

v0.17.0

Compare

Choose a tag to compare

0.16.5 (2026-04-19)

Bug Fixes

• protocol: validate packed attca country (#656) (819edc8)
• webauthn: ensure challenge length is valid (#657) (85e9e68)

Bug Fixes

• protocol: validate packed attca country (#656) (819edc8)
• webauthn: ensure challenge length is valid (#657) (85e9e68)

v0.16.5

Compare

Choose a tag to compare

v0.16.4 (2026-04-10)

This release just updates dependencies.

v0.16.4

Compare

Choose a tag to compare

v0.16.3 (2026-04-05)

Bug Fixes

• webauthncose: replace elliptic (#635) (3b8a663)

Features

• metadata: update metadata authenticator statuses (#641) (95d28bc)
• webauthncose: add dilithium cose types (#636) (4106b24)

Bug Fixes

• webauthncose: replace elliptic (#635) (3b8a663)

Features

• metadata: update metadata authenticator statuses (#641) (95d28bc)
• webauthncose: add dilithium cose types (#636) (4106b24)

v0.16.3

Compare

Choose a tag to compare

v0.16.2 (2026-04-02)

Bug Fixes

• top origins always fails (#626) (514306b)
• webauthn: credential flags not fully updated (#629) (a4b68c8)
• webauthn: nil panic on discovery (#631) (3545ead)

Features

• webauthn: messagepack encoding (#621) (bf8fe28)

Bug Fixes

• top origins always fails (#626) (514306b)
• webauthn: credential flags not fully updated (#629) (a4b68c8)
• webauthn: nil panic on discovery (#631) (3545ead)

Features

• webauthn: messagepack encoding (#621) (bf8fe28)

v0.16.2

Compare

Choose a tag to compare

v0.16.1 (2026-03-12)

Bug Fixes

• webauthncose: validate keys earlier (#615) (18ca901)

Bug Fixes

• webauthncose: validate keys earlier (#615) (18ca901)

0.16.0 (2026-03-01)

Bug Fixes

• webauthn: empty top origins not allowed (#562) (fe3b74c), closes #537
• webauthn: session expiration not enforced (#561) (f5adbbf), closes #552

Features

• protocol: compound attestation statements (#571) (cc4e649)
• protocol: enhance rpid validation (#564) (7610304), closes #553
• protocol: signals structs (#574) (f75a34a)
• webauthncose: allow ber integers in ecdsa sigs (#593) (68db4d4), closes #408
• webauthn: return explicit error on unknown credential (#560) (1defb4a), closes #550

0.15.0 (2025-11-09)

0.14.0 (2025-09-14)

Bug Fixes

• webauthn: edge case in owned credentials validation (#487) (9410f91)
• webauthn: skip mds validation for none format (#497) (a1b2775), closes #387

Features

• metadata: update schema to 3.1 (#454) (3c6b5a1)
• protocol: att format updates (#485) (c079c8b)
• protocol: update tpm manufacturers (#496) (46046ca)
• protocol: validate native app origins (#468) (0b2a549), closes #462 #463

v0.16.1

Compare

Choose a tag to compare