chore(deps): Update dependency @simplewebauthn/server to v14 #120

Closed

renovate wants to merge 1 commit from renovate/simplewebauthn-server-14.x into main

pull from: renovate/simplewebauthn-server-14.x

merge into: trails-cool:main

trails-cool:main

trails-cool:vitest-5-complete-set

trails-cool:caddy-mta-sts

trails-cool:chore/development-deps

trails-cool:fix/restore-openspec-1.10

trails-cool:fix/sentry-upload-loud-and-documented

Conversation 0 Commits 1 Files changed 2 +113 -77

renovate commented 2026-09-07 00:14:45 +00:00

Collaborator

Copy link

This PR contains the following updates:

Package	Change	Age	Confidence
@simplewebauthn/server (source)	^13.3.2 → ^14.0.0

---

Release Notes

MasterKale/SimpleWebAuthn (@​simplewebauthn/server)

v14.0.0

Compare Source

The headlining feature of this release is @​simplewebauthn/server gaining support for passkeys
using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those
same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44
passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers
start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for
more info 🚀

Setting our sites on the browser, @​simplewebauthn/browser picks up a new sendSignal() method
as a single method to call all of the
WebAuthn Signal APIs. See
https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x
and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim
to support Node LTS releases through their Active and Maintenance windows as tracked on
the Node.js Releases page, and aim to support Deno
minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

• [server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as
  passkey public key algorithms when the runtime supports them. In runtimes that support these PQC
  algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public
  key algorithm during registration. See
  https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info
  (#​785,
  #​794)
• [browser] The new sendSignal() method offers a simple way to invoke the
  WebAuthn Signal APIs. See
  https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info
  (#​778)
• [browser] The new browserSupportsPasskeys() helper method performs more robust WebAuthn
  support detection by also checking for typical passkey-related WebAuthn features. See
  https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys for more info
  (#​761)
• [browser] The new getBrowserCapabilities() helper method wraps WebAuthn's
  getClientCapabilities() with additional feature detection checks when possible. See
  https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities for more info
  (#​761)
• [server] verifyAuthenticationResponse() accepts an optional new expectedTopOrigin argument
  that supports cross-origin authentication verification. See
  https://simplewebauthn.dev/docs/advanced/server/cross-origin-support for more info
  (#​773)
• [server] MetadataService.initialize() accepts an optional new logger argument that can be
  used to capture MetadataService status output in a project-specific manner. See
  https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging for more info
  (#​765)
• [server] The typing of transports in excludeCredentials when calling
  generateRegistrationOptions(), and allowCredentials when calling
  generateAuthenticationOptions(), has been updated to string[] to make it easier to call these
  methods (#​776)
• [server] "tpm" attestation verification is now more tolerant of variable casing in the TPM
  manufacturer IDs (#​772)
• [server] generateRegistrationOptions() and verifyRegistrationResponse() now use the same
  default list of allowed public key algorithms for supportedAlgorithmIDs
  (#​791)
• [server] The validateCertificatePath() helper now supports x5c arrays containing
  cross-signed certificates (#​796)

Breaking Changes

• [browser] [server] The minimum supported runtime versions have been increased to Node LTS 22.x
  and higher, and Deno v2.4.x and higher
  (#​763)

---

Configuration

📅 Schedule: (in timezone Europe/Copenhagen)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@simplewebauthn/server](https://github.com/MasterKale/SimpleWebAuthn/tree/master/packages/server#readme) ([source](https://github.com/MasterKale/SimpleWebAuthn/tree/HEAD/packages/server)) | [`^13.3.2` → `^14.0.0`](https://renovatebot.com/diffs/npm/@simplewebauthn%2fserver/13.3.3/14.0.0) |  |  | --- ### Release Notes <details> <summary>MasterKale/SimpleWebAuthn (@&#8203;simplewebauthn/server)</summary> ### [`v14.0.0`](https://github.com/MasterKale/SimpleWebAuthn/blob/HEAD/CHANGELOG.md#v1400---The-one-after-they-go-quantum) [Compare Source](https://github.com/MasterKale/SimpleWebAuthn/compare/v13.3.3...v14.0.0) The headlining feature of this release is **[@&#8203;simplewebauthn/server](https://github.com/simplewebauthn/server)** gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See <https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support> for more info 🚀 Setting our sites on the browser, **[@&#8203;simplewebauthn/browser](https://github.com/simplewebauthn/browser)** picks up a new `sendSignal()` method as a single method to call all of the [WebAuthn Signal APIs](https://w3c.github.io/webauthn/#sctn-signal-methods). See <https://simplewebauthn.dev/docs/packages/browser#sendsignal> for more info 🛜 As for breaking changes, the minimum supported version of Node has been raised to **Node LTS 22.x and higher**, and **Deno v2.4.x and higher**. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on [the Node.js Releases page](https://nodejs.org/en/about/previous-releases), and aim to support Deno minor releases for up to one year after their release That's not all, though. Continue reading for the full list of changes in this release! 🎉 **Changes:** - **\[server]** The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, `generateRegistrationOptions()` will include ML-DSA-44 as the most preferred public key algorithm during registration. See <https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support> for more info ([#&#8203;785](https://github.com/MasterKale/SimpleWebAuthn/pull/785), [#&#8203;794](https://github.com/MasterKale/SimpleWebAuthn/pull/794)) - **\[browser]** The new `sendSignal()` method offers a simple way to invoke the [WebAuthn Signal APIs](https://w3c.github.io/webauthn/#sctn-signal-methods). See <https://simplewebauthn.dev/docs/packages/browser#sendsignal> for more info ([#&#8203;778](https://github.com/MasterKale/SimpleWebAuthn/pull/778)) - **\[browser]** The new `browserSupportsPasskeys()` helper method performs more robust WebAuthn support detection by also checking for typical passkey-related WebAuthn features. See <https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys> for more info ([#&#8203;761](https://github.com/MasterKale/SimpleWebAuthn/pull/761)) - **\[browser]** The new `getBrowserCapabilities()` helper method wraps WebAuthn's `getClientCapabilities()` with additional feature detection checks when possible. See <https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities> for more info ([#&#8203;761](https://github.com/MasterKale/SimpleWebAuthn/pull/761)) - **\[server]** `verifyAuthenticationResponse()` accepts an optional new `expectedTopOrigin` argument that supports cross-origin authentication verification. See <https://simplewebauthn.dev/docs/advanced/server/cross-origin-support> for more info ([#&#8203;773](https://github.com/MasterKale/SimpleWebAuthn/pull/773)) - **\[server]** `MetadataService.initialize()` accepts an optional new `logger` argument that can be used to capture MetadataService status output in a project-specific manner. See <https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging> for more info ([#&#8203;765](https://github.com/MasterKale/SimpleWebAuthn/pull/765)) - **\[server]** The typing of `transports` in `excludeCredentials` when calling `generateRegistrationOptions()`, and `allowCredentials` when calling `generateAuthenticationOptions()`, has been updated to `string[]` to make it easier to call these methods ([#&#8203;776](https://github.com/MasterKale/SimpleWebAuthn/pull/776)) - **\[server]** `"tpm"` attestation verification is now more tolerant of variable casing in the TPM manufacturer IDs ([#&#8203;772](https://github.com/MasterKale/SimpleWebAuthn/pull/772)) - **\[server]** `generateRegistrationOptions()` and `verifyRegistrationResponse()` now use the same default list of allowed public key algorithms for `supportedAlgorithmIDs` ([#&#8203;791](https://github.com/MasterKale/SimpleWebAuthn/pull/791)) - **\[server]** The `validateCertificatePath()` helper now supports x5c arrays containing cross-signed certificates ([#&#8203;796](https://github.com/MasterKale/SimpleWebAuthn/pull/796)) ##### Breaking Changes - **\[browser] \[server]** The minimum supported runtime versions have been increased to Node LTS 22.x and higher, and Deno v2.4.x and higher ([#&#8203;763](https://github.com/MasterKale/SimpleWebAuthn/pull/763)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Copenhagen) - Branch creation - "before 6am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODEuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4MS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJtYWpvciJdfQ==-->

renovate added the

dependencies

major

labels 2026-09-07 00:14:45 +00:00

renovate added 1 commit 2026-09-07 00:14:46 +00:00

chore(deps): Update dependency @simplewebauthn/server to v14 3e0abc4ef3

renovate force-pushed renovate/simplewebauthn-server-14.x from 3e0abc4ef3 to 8e37d499b1 2026-09-07 09:25:34 +00:00 Compare

ullrich referenced this pull request from a commit 2026-09-07 09:42:54 +00:00

Update @simplewebauthn/server to v14 and drop the removed transport type

ullrich referenced this pull request 2026-09-07 09:43:10 +00:00

Update @simplewebauthn/server to v14 and drop the removed transport type #125

ullrich referenced this pull request from a commit 2026-09-07 09:52:20 +00:00

ci: stop starving vitest workers to death

ullrich referenced this pull request 2026-09-07 09:52:33 +00:00

ci: stop starving vitest workers to death #126

ullrich closed this pull request 2026-09-07 12:43:36 +00:00

Some checks failed

Hide checks

CD Staging / Build & Push Docker Images (pull_request) Has been skipped

Details

CD Staging / Build & Push Docker Images-1 (pull_request) Has been skipped

Details

CD Staging / Deploy Staging (pull_request) Has been skipped

Details

CD Staging / Deploy PR Preview (pull_request) Has been skipped

Details

renovate/stability-days Updates have met minimum release age requirement

Details

CI / Security Scan (pull_request) Successful in 1m15s

Required

Details

CI / Dockerfile Package Check (pull_request) Successful in 10s

Required

Details

CI / Checks (pull_request) Failing after 2m28s

Required

Details

CI / E2E Tests (pull_request) Has been skipped

Required

Details

CI / Visual Tests (pull_request) Successful in 1m48s

Required

Details

CI / Journal Image Smoke Test (pull_request) Successful in 25m38s

Required

Details

Cancel superseded CI / Cancel in-flight CI (pull_request) Successful in 21s

Details

CD Staging / Tear Down PR Preview (pull_request) Successful in 1m3s

Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

dependencies

Dependency updates raised by Renovate (renovate.json5 labels)

  

major

Major version bump — always needs human review, never auto-merged

  

security-pin

Touches a pnpm.overrides CVE remediation pin, not an ordinary dependency

No labels

dependencies

major

security-pin

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

trails-cool/trails!120

No description provided.