chore(deps): Update dependency @simplewebauthn/browser to v14

renovate commented

2026-09-07 00:14:03 +00:00

Collaborator

This PR contains the following updates:

Package	Change	Age	Confidence
@simplewebauthn/browser (source)	`^13.3.0` → `^14.0.0`

Release Notes

MasterKale/SimpleWebAuthn (@simplewebauthn/browser)

`v14.0.0`

Compare Source

The headlining feature of this release is @simplewebauthn/server gaining support for passkeys
using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those
same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44
passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers
start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for
more info 🚀

Setting our sites on the browser, @simplewebauthn/browser picks up a new sendSignal() method
as a single method to call all of the
WebAuthn Signal APIs. See
https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x
and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim
to support Node LTS releases through their Active and Maintenance windows as tracked on
the Node.js Releases page, and aim to support Deno
minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

[server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as
passkey public key algorithms when the runtime supports them. In runtimes that support these PQC
algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public
key algorithm during registration. See
https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info
(#785,
#794)
[browser] The new sendSignal() method offers a simple way to invoke the
WebAuthn Signal APIs. See
https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info
(#778)
[browser] The new browserSupportsPasskeys() helper method performs more robust WebAuthn
support detection by also checking for typical passkey-related WebAuthn features. See
https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys for more info
(#761)
[browser] The new getBrowserCapabilities() helper method wraps WebAuthn's
getClientCapabilities() with additional feature detection checks when possible. See
https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities for more info
(#761)
[server] verifyAuthenticationResponse() accepts an optional new expectedTopOrigin argument
that supports cross-origin authentication verification. See
https://simplewebauthn.dev/docs/advanced/server/cross-origin-support for more info
(#773)
[server] MetadataService.initialize() accepts an optional new logger argument that can be
used to capture MetadataService status output in a project-specific manner. See
https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging for more info
(#765)
[server] The typing of transports in excludeCredentials when calling
generateRegistrationOptions(), and allowCredentials when calling
generateAuthenticationOptions(), has been updated to string[] to make it easier to call these
methods (#776)
[server] "tpm" attestation verification is now more tolerant of variable casing in the TPM
manufacturer IDs (#772)
[server] generateRegistrationOptions() and verifyRegistrationResponse() now use the same
default list of allowed public key algorithms for supportedAlgorithmIDs
(#791)
[server] The validateCertificatePath() helper now supports x5c arrays containing
cross-signed certificates (#796)

Breaking Changes

[browser] [server] The minimum supported runtime versions have been increased to Node LTS 22.x
and higher, and Deno v2.4.x and higher
(#763)

Configuration

📅 Schedule: (in timezone Europe/Copenhagen)

Branch creation
- "before 6am on monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@simplewebauthn/browser](https://github.com/MasterKale/SimpleWebAuthn/tree/master/packages/browser#readme) ([source](https://github.com/MasterKale/SimpleWebAuthn/tree/HEAD/packages/browser)) | [`^13.3.0` → `^14.0.0`](https://renovatebot.com/diffs/npm/@simplewebauthn%2fbrowser/13.3.0/14.0.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@simplewebauthn%2fbrowser/14.0.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@simplewebauthn%2fbrowser/13.3.0/14.0.0?slim=true) | --- ### Release Notes <details> <summary>MasterKale/SimpleWebAuthn (@simplewebauthn/browser)</summary> ### [`v14.0.0`](https://github.com/MasterKale/SimpleWebAuthn/blob/HEAD/CHANGELOG.md#v1400---The-one-after-they-go-quantum) [Compare Source](https://github.com/MasterKale/SimpleWebAuthn/compare/v13.3.0...v14.0.0) The headlining feature of this release is **[@simplewebauthn/server](https://github.com/simplewebauthn/server)** gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See <https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support> for more info 🚀 Setting our sites on the browser, **[@simplewebauthn/browser](https://github.com/simplewebauthn/browser)** picks up a new `sendSignal()` method as a single method to call all of the [WebAuthn Signal APIs](https://w3c.github.io/webauthn/#sctn-signal-methods). See <https://simplewebauthn.dev/docs/packages/browser#sendsignal> for more info 🛜 As for breaking changes, the minimum supported version of Node has been raised to **Node LTS 22.x and higher**, and **Deno v2.4.x and higher**. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on [the Node.js Releases page](https://nodejs.org/en/about/previous-releases), and aim to support Deno minor releases for up to one year after their release That's not all, though. Continue reading for the full list of changes in this release! 🎉 **Changes:** - **\[server]** The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, `generateRegistrationOptions()` will include ML-DSA-44 as the most preferred public key algorithm during registration. See <https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support> for more info ([#785](https://github.com/MasterKale/SimpleWebAuthn/pull/785), [#794](https://github.com/MasterKale/SimpleWebAuthn/pull/794)) - **\[browser]** The new `sendSignal()` method offers a simple way to invoke the [WebAuthn Signal APIs](https://w3c.github.io/webauthn/#sctn-signal-methods). See <https://simplewebauthn.dev/docs/packages/browser#sendsignal> for more info ([#778](https://github.com/MasterKale/SimpleWebAuthn/pull/778)) - **\[browser]** The new `browserSupportsPasskeys()` helper method performs more robust WebAuthn support detection by also checking for typical passkey-related WebAuthn features. See <https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys> for more info ([#761](https://github.com/MasterKale/SimpleWebAuthn/pull/761)) - **\[browser]** The new `getBrowserCapabilities()` helper method wraps WebAuthn's `getClientCapabilities()` with additional feature detection checks when possible. See <https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities> for more info ([#761](https://github.com/MasterKale/SimpleWebAuthn/pull/761)) - **\[server]** `verifyAuthenticationResponse()` accepts an optional new `expectedTopOrigin` argument that supports cross-origin authentication verification. See <https://simplewebauthn.dev/docs/advanced/server/cross-origin-support> for more info ([#773](https://github.com/MasterKale/SimpleWebAuthn/pull/773)) - **\[server]** `MetadataService.initialize()` accepts an optional new `logger` argument that can be used to capture MetadataService status output in a project-specific manner. See <https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging> for more info ([#765](https://github.com/MasterKale/SimpleWebAuthn/pull/765)) - **\[server]** The typing of `transports` in `excludeCredentials` when calling `generateRegistrationOptions()`, and `allowCredentials` when calling `generateAuthenticationOptions()`, has been updated to `string[]` to make it easier to call these methods ([#776](https://github.com/MasterKale/SimpleWebAuthn/pull/776)) - **\[server]** `"tpm"` attestation verification is now more tolerant of variable casing in the TPM manufacturer IDs ([#772](https://github.com/MasterKale/SimpleWebAuthn/pull/772)) - **\[server]** `generateRegistrationOptions()` and `verifyRegistrationResponse()` now use the same default list of allowed public key algorithms for `supportedAlgorithmIDs` ([#791](https://github.com/MasterKale/SimpleWebAuthn/pull/791)) - **\[server]** The `validateCertificatePath()` helper now supports x5c arrays containing cross-signed certificates ([#796](https://github.com/MasterKale/SimpleWebAuthn/pull/796)) ##### Breaking Changes - **\[browser] \[server]** The minimum supported runtime versions have been increased to Node LTS 22.x and higher, and Deno v2.4.x and higher ([#763](https://github.com/MasterKale/SimpleWebAuthn/pull/763)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Copenhagen) - Branch creation - "before 6am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate added the

dependencies

major

labels

2026-09-07 00:14:03 +00:00

renovate added 1 commit

2026-09-07 00:14:03 +00:00

chore(deps): Update dependency @simplewebauthn/browser to v14

CD Staging / Build & Push Docker Images (pull_request) Has been skipped

Details

CD Staging / Build & Push Docker Images-1 (pull_request) Has been skipped

Details