8000 build(deps): bump webauthn from 2.8.0 to 3.0.1 in /fastapi_backend by dependabot[bot] · Pull Request #217 · adeelahmad/lense · GitHub
[go: up one dir, main page]

Skip to content

build(deps): bump webauthn from 2.8.0 to 3.0.1 in /fastapi_backend - #217

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/fastapi_backend/webauthn-3.0.1
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/fastapi_backend/webauthn-3.0.1

Conversation

@dependabot
@dependabot dependabot Bot commented on behalf of github Oct 7, 2026
Copy link
Copy Markdown
Contributor

Bumps webauthn from 2.8.0 to 3.0.1.

Release notes

Sourced from webauthn's releases.

v3.0.1

Changes:

  • verify_registration_response() now rejects responses with attestation statement formats that are not strings (#288, h/t @​DarkaMaul)

v3.0.0: The PQC release

Changes:

  • verify_registration_response() and verify_authentication_response() now support use of PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 algorithms for credential public key signature verification (#282)
  • generate_registration_options() will now encourage authenticators to create keypairs using EDDSA when available, signaling acceptance of ES256 or RS256 when EDDSA is unavailable (#284)
  • Responses containing malformed CBOR data with duplicate keys will now be rejected (#285)
Changelog

Sourced from webauthn's changelog.

v3.0.1

Changes:

  • verify_registration_response() now rejects responses with attestation statement formats that are not strings (#288, h/t @​DarkaMaul)

v3.0.0

Changes:

  • verify_registration_response() and verify_authentication_response() now support use of PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 algorithms for credential public key signature verification (#282)
  • generate_registration_options() will now encourage authenticators to create keypairs using EDDSA when available, signaling acceptance of ES256 or RS256 when EDDSA is unavailable (#284)
  • Responses containing malformed CBOR data with duplicate keys will now be rejected (#285)
Commits
  • d72e0f5 Bump version to v3.0.1
  • 732ca23 Update CHANGELOG for v3.0.1
  • b474c8d Merge pull request #288 from trail-of-forks/dm/reject-attestations-fmt
  • 5557d97 Reject early invalid attestation formats
  • 44330eb Bump version to v3.0.0
  • 2a926d8 Update CHANGELOG for v3.0.0
  • 4c4dbcb Merge pull request #285 from duo-labs/fix/reject-cbor-key-collision
  • 6df40fb Refine CBOR encoder helper error message
  • 91384ae Disallow duplicate keys in CBOR data
  • 6cc7093 Upgrade to latest cbor2
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [webauthn](https://github.com/duo-labs/py_webauthn) from 2.8.0 to 3.0.1.
- [Release notes](https://github.com/duo-labs/py_webauthn/releases)
- [Changelog](https://github.com/duo-labs/py_webauthn/blob/master/CHANGELOG.md)
- [Commits](duo-labs/py_webauthn@v2.8.0...v3.0.1)

---
updated-dependencies:
- dependency-name: webauthn
  dependency-version: 3.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 7, 2026
adeelahmad added a commit that referenced this pull request Oct 9, 2026
…luded (#239)

Rolls up Dependabot #212, #213, #214, #216, #217, #218, #219, #238 and
#237 without its BlockSuite bumps (0.22 drops the API the notes editor
uses). TypeScript 6 needed two typing fixes: the WebAuthn credential's
toJSON and the mic level buffer.


Claude-Session: https://claude.ai/code/session_01291QUFHs51wLhGQwp2DAh9

Co-authored-by: Adeel Ahmad <noreply@anthropic.com>
Copy link
Copy Markdown
Owner

Landed in #239 with the other dependency bumps, so I'm closing this one.


Generated by Claude Code

@adeelahmad adeelahmad closed this Oct 9, 2026
@dependabot @github
dependabot Bot commented on behalf of github Oct 9, 2026
Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/uv/fastapi_backend/webauthn-3.0.1 branch October 9, 2026 13:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

0