NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
Go modules · #1485 by repository stars
Last release 11 days ago
27 Sep 2026
Ships on a steady schedule
a new release about every 2 weeks
Most releases are documented
notes for 36 of the last 60 stable releases
Nothing withdrawn
no release was ever pulled
9 years old
336 releases · first in 2017
Nothing published for this version
Nothing published for this version
Nothing published for this version
protocol: accept anonca attestation trust anchors
One column per quarter.
Nothing published for this version
Nothing published for this version
Nothing published for this version
This release just updates dependencies.
This release just updates dependencies.
Nothing published for this version
Nothing published for this version
Nothing published for this version
This release is a fairly major milestone in the development of this library. It has quite a few breaking changes but has added support for most if not…
This release is a fairly major milestone in the development of this library. It has quite a few breaking changes but has
added support for most if not all of the extension requirements natively, and adds formal support for Post-Quantum
Cryptography with support for ML-DSA-44, ML-DSA-65, and ML-DSA-87 when used with go 1.27.
Details on the migration requirements for this version can be found int MIGRATION.md as they are substantial between
ths version and prior versions.
RegistrationOption and LoginOption now return an error, so any option implemented outside this module must be adjusted, and WithExtensions and WithAssertionExtensions accept extension options in place of a map. protocol.AuthenticationExtensions and protocol.AuthenticationExtensionsClientOutputs are structs rather than map[string]any, protocol.Extensions is removed, and ParsedPublicKeyCredential.GetAppID takes a protocol.SessionExtensions. SessionData.Extensions changes both its type and its encoded representation, so a session persisted by an earlier version cannot be decoded by this one, and a client extension output the Relying Party did not request now fails the ceremony unless Config.ExtensionsUnsolicitedOutputPolicy says otherwise.Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
This release just contains updates to dependencies.
This release just contains updates to dependencies.
Nothing published for this version
webauthn: include verify attestation func for credential
Nothing published for this version
protocol: remove unnecessary guard
Nothing published for this version
A bug with the Credential Record which was introduced early in the libraries lifecycle has resulted in a breaking change to the Credential struct. If…
A bug with the Credential Record which was
introduced early in the libraries lifecycle has resulted in a
breaking change to the Credential struct. If you are manually
serializing this struct instead of using encoding/json you
will be required to make manual changes; though Integrators
should consider these notes regardless.
protocol.CredentialTypeFIDOU2F has been removed;
replace uses with protocol.AttestationFormatFIDOUniversalSecondFactor
(cast to string where the destination field is a plain string).
The semantics of the AttestationType field on webauthn.Credential
and protocol.CredentialDescriptor have changed. Integrators that
inspect this field to detect a format (typically checking for
"fido-u2f") must switch to the new AttestationFormat field; the
FIDO-U2F AppID and AppIDExclude extension helpers now key on
AttestationFormat, so a descriptor literal constructed with
AttestationType: "fido-u2f" will no longer trigger them.
Stored Credential JSON records are migrated transparently by the
new UnmarshalJSON, but re-marshaled records will carry
attestationFormat rather than a format string in attestationType;
downstream consumers that parsed the legacy shape directly should
be updated.
The Credential.Verify method has been updated and may fail in
previous scenarios where it passed previously. It will also update
the AttestationType value as a side-effect when used.
The Cross-Origin verification semantics have changed
significantly due to the stabilization of the WebAuthn Level 3
specification. It is no longer possible to disable verification, and
Cross-Origin ceremonies must explicitly be allowed in this release.
protocol.TopOriginIgnoreVerificationMode has been removed. Code that
referenced it must switch to one of the other constants as there is
no longer a mode which disables the Top Origin verification such as:
webauthn.Config.validate now rewrites a zero-valued
RPTopOriginVerificationMode to TopOriginExplicitVerificationMode.
Integrators that left the field unset previously got ignore-mode
semantics (any Top Origin accepted); they now get strict matching
against RPTopOrigins and must populate that list, or explicitly
select a different mode; for Cross-Origin flows to succeed.
Cross-Origin ceremonies (those where the authenticator reports
crossOrigin = true in the ClientData) are rejected by default.
Integrators that rely on iframe-embedded or other Cross-Origin WebAuthn
flows must set webauthn.Config.RPAllowCrossOrigin = true. The library
continues to enforce Top Origin verification on accepted Cross-Origin
ceremonies per the configured mode.
protocol.CollectedClientData.Verify no longer accepts
TopOriginIgnoreVerificationMode; callers that pass an unknown mode
receive ErrNotImplemented with detail "unknown Top Origin
verification mode".
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
protocol: validate packed attca country
This release just updates dependencies.
This release just updates dependencies.
Nothing published for this version
metadata: update metadata authenticator statuses
Nothing published for this version
webauthn: credential flags not fully updated
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
webauthncose: validate keys earlier
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Your coding agent can read these notes before it upgrades. Set up the MCP server →