Skip to content

chore(deps): bump libwebauthn to 0.5.0#166

Open
AlfioEmanueleFresta wants to merge 2 commits into
mainfrom
chore/bump-libwebauthn-0.5.0
Open

chore(deps): bump libwebauthn to 0.5.0#166
AlfioEmanueleFresta wants to merge 2 commits into
mainfrom
chore/bump-libwebauthn-0.5.0

Conversation

@AlfioEmanueleFresta
Copy link
Copy Markdown
Member

@AlfioEmanueleFresta AlfioEmanueleFresta commented May 18, 2026

Bumps libwebauthn from 0.3.0 to v0.5.0.

Breaking: AppId origin requests now panic (unimplemented!). As far as I understand, that code path is on its way out. HTTPS origin requests are unaffected.

Runtime dependency: libwebauthn 0.5.0 validates rpId via the system Public Suffix List. credentialsd now needs the publicsuffix list package (publicsuffix-list-dafsa on Fedora, publicsuffix on Debian/Ubuntu) present at runtime, otherwise requests fail. Out of scope for this bump: declaring it as an explicit packaging dependency, or bundling our own PSL implementation. (Sorry, I don't know enough about packaging.)

Other changes are mechanical adaptations to libwebauthn API renames.

- Rename feature flags: libnfc/pcsc -> nfc-backend-libnfc/nfc-backend-pcsc
- Migrate to the new from_json(RequestOrigin, PublicSuffixList, json) API
- Convert NavigationContext to libwebauthn RequestOrigin (synthesise https://<rp.id> for AppId origins)
- Use SystemPublicSuffixList::auto() to validate rpId
- MakeCredentialRequest.cross_origin renamed to top_origin
- CableQrCodeDevice::new_transient now takes a CableTransports arg (CloudAssistedOnly preserves legacy caBLE behaviour)
- Assertion no longer exposes large_blob_key
@AlfioEmanueleFresta AlfioEmanueleFresta force-pushed the chore/bump-libwebauthn-0.5.0 branch from c440113 to 4cabdba Compare May 18, 2026 19:40
@AlfioEmanueleFresta
Copy link
Copy Markdown
Member Author

FYI libwebauthn 0.5.0 added a CableTransports arg on CableQrCodeDevice::new_transient. Defaulted to CloudAssistedOrLocal so the QR advertises both WebSocket and direct BLE L2CAP. libwebauthn picks L2CAP on CTAP 2.3-aware peers and falls back to WebSocket for older clients. LMK if you'd rather have CloudAssistedOnly.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant