Upgrading webauthn 2 to 3
Review needed2.8.0 → 3.0.1Security1New1Changed1Fixed1
Review neededUpgrade verdict
1 changed default and a security fix.
In plain terms
- The library now refuses responses whose encoded data contains duplicate keys, closing a parsing ambiguity.
Must act 1 item needs code or config changes
What you must change
Security1
Responses containing malformed CBOR data with duplicate keys are now rejected.
API changes
Generated by DepDelta from published Python source. Not mixed with prose notes.
- added:
field COSEAlgorithmIdentifier.ML_DSA_44 - added:
field COSEAlgorithmIdentifier.ML_DSA_65 - added:
field COSEAlgorithmIdentifier.ML_DSA_87 - added:
field COSEKTY.ML_DSA - added:
field COSEKey.PUB
- changed:
function decode_credential_public_key(key: bytes) -> Union[DecodedOKPPublicKey, DecodedEC2PublicKey, DecodedRSAPublicKey] → function decode_credential_public_key(key: bytes) -> Union[DecodedOKPPublicKey, DecodedEC2PublicKey, DecodedRSAPublicKey, DecodedMLDSAPublicKey] - added:
class DecodedMLDSAPublicKey - added:
field DecodedMLDSAPublicKey.alg: COSEAlgorithmIdentifier - added:
field DecodedMLDSAPublicKey.kty: COSEKTY - added:
field DecodedMLDSAPublicKey.pub: bytes
- changed:
function decoded_public_key_to_cryptography(public_key: Union[DecodedOKPPublicKey, DecodedEC2PublicKey, DecodedRSAPublicKey]) -> Union[Ed25519PublicKey, EllipticCurvePublicKey, RSAPublicKey] → function decoded_public_key_to_cryptography(public_key: Union[DecodedOKPPublicKey, DecodedEC2PublicKey, DecodedRSAPublicKey, DecodedMLDSAPublicKey]) -> Union[Ed25519PublicKey, EllipticCurvePublicKey, RSAPublicKey, MLDSA44PublicKey, MLDSA65PublicKey, MLDSA87PublicKey]
- changed:
function verify_signature(*, public_key: CertificatePublicKeyTypes, signature_alg: COSEAlgorithmIdentifier, signature: bytes, data: bytes) -> None → function verify_signature(*, public_key: PublicKeyTypes, signature_alg: COSEAlgorithmIdentifier, signature: bytes, data: bytes) -> None