Update @simplewebauthn/server to v14 and drop the removed transport type #125

Merged

ullrich merged 1 commit from simplewebauthn-server-14 into main 2026-09-07 12:26:58 +00:00

Conversation 0 Commits 1 Files changed 3 +118 -79

ullrich commented 2026-09-07 09:43:10 +00:00

Owner

Copy link

Replaces #120, which could not work as raised.

v14 removes the exported type AuthenticatorTransportFuture, so the version bump alone fails CI / Checks:

app/lib/auth.server.ts(12,3): error TS2724:
  '"@simplewebauthn/server"' has no exported member named
  'AuthenticatorTransportFuture'. Did you mean 'AuthenticatorTransport'?

Not a lockstep problem

The obvious theory — that this needs to move together with @simplewebauthn/browser, which #119 already took to v14 — is wrong. The two packages declare no peer dependency on each other, and main has been running browser v14 against server v13 without complaint. Reproduced locally with both on v14 and got the same single error.

What is true is that the bump and the code change have to arrive together, because the cast is required to compile against v13 and forbidden against v14. There is no intermediate state, which is why this can't be split into a code-first PR.

The change

v14 widened WebAuthnCredential.transports to plain string[], so the cast is no longer needed at all.

-      transports: cred.transports as AuthenticatorTransportFuture[] | undefined,
+      transports: cred.transports ?? undefined,

Deliberately not replaced with a cast to the new AuthenticatorTransport[]: v14 dropped "cable" and "smart-card" from that union, while credentials.transports is jsonb().$type<string[]>() in the schema and rows written by earlier versions may still hold those values. ?? undefined converts Drizzle's string[] | null to the string[] | undefined v14 wants without asserting anything about the contents.

Why #120 isn't just fixed in place

Its branch forked before #119 landed, so apps/journal/package.json and pnpm-lock.yaml both conflict with main — it reports mergeable: false. Close it in favour of this.

Verified locally

Server resolved to 14.0.1:

check	result
typecheck	exit 0
lint	exit 0
test	55 files passed, 15 skipped / 367 tests passed, 79 skipped

pnpm dedupe produces no further lockfile change, matching what renovate's postUpgradeTask would have done.

Unrelated, but worth knowing

main is currently red. Checks failed on #119's merge commit with the recurring gpx worker-timeout flake — all 89 tests passed, the vitest pool failed to start a forks worker. Not a regression from either simplewebauthn change.

Replaces #120, which could not work as raised. v14 removes the exported type `AuthenticatorTransportFuture`, so the version bump alone fails `CI / Checks`: ``` app/lib/auth.server.ts(12,3): error TS2724: '"@simplewebauthn/server"' has no exported member named 'AuthenticatorTransportFuture'. Did you mean 'AuthenticatorTransport'? ``` ### Not a lockstep problem The obvious theory — that this needs to move together with `@simplewebauthn/browser`, which #119 already took to v14 — is wrong. The two packages declare **no peer dependency on each other**, and `main` has been running browser v14 against server v13 without complaint. Reproduced locally with both on v14 and got the same single error. What *is* true is that the bump and the code change have to arrive together, because the cast is **required** to compile against v13 and **forbidden** against v14. There is no intermediate state, which is why this can't be split into a code-first PR. ### The change v14 widened `WebAuthnCredential.transports` to plain `string[]`, so the cast is no longer needed at all. ```diff - transports: cred.transports as AuthenticatorTransportFuture[] | undefined, + transports: cred.transports ?? undefined, ``` Deliberately **not** replaced with a cast to the new `AuthenticatorTransport[]`: v14 dropped `"cable"` and `"smart-card"` from that union, while `credentials.transports` is `jsonb().$type<string[]>()` in the schema and rows written by earlier versions may still hold those values. `?? undefined` converts Drizzle's `string[] | null` to the `string[] | undefined` v14 wants without asserting anything about the contents. ### Why #120 isn't just fixed in place Its branch forked before #119 landed, so `apps/journal/package.json` and `pnpm-lock.yaml` both conflict with `main` — it reports `mergeable: false`. Close it in favour of this. ### Verified locally Server resolved to 14.0.1: | check | result | |---|---| | `typecheck` | exit 0 | | `lint` | exit 0 | | `test` | 55 files passed, 15 skipped / 367 tests passed, 79 skipped | `pnpm dedupe` produces no further lockfile change, matching what renovate's `postUpgradeTask` would have done. ### Unrelated, but worth knowing `main` is currently red. `Checks` failed on #119's merge commit with the recurring gpx worker-timeout flake — all 89 tests passed, the vitest pool failed to start a forks worker. Not a regression from either simplewebauthn change.

ullrich added 1 commit 2026-09-07 09:43:11 +00:00

Update @simplewebauthn/server to v14 and drop the removed transport type ... 281ab28a85

Replaces renovate's #120, which could not work as raised. v14 removes the
exported type `AuthenticatorTransportFuture`, so the bump alone fails typecheck:

  app/lib/auth.server.ts(12,3): error TS2724:
    '"@simplewebauthn/server"' has no exported member named
    'AuthenticatorTransportFuture'. Did you mean 'AuthenticatorTransport'?

Not a lockstep problem with @simplewebauthn/browser, which #119 already moved to
v14: the two packages declare no peer dependency on each other, and main has
been running browser v14 against server v13 without complaint. The bump and the
code change simply have to arrive together, because the cast is required to
compile against v13 and forbidden against v14.

v14 widened `WebAuthnCredential.transports` to plain `string[]`, so the cast is
no longer needed at all. It is deliberately NOT replaced with a cast to the new
`AuthenticatorTransport[]`: v14 dropped "cable" and "smart-card" from that
union, while credentials.transports is jsonb().$type<string[]>() in the schema
and rows written by earlier versions may still hold those values. `?? undefined`
converts Drizzle's `string[] | null` to the `string[] | undefined` v14 expects
without asserting anything about the contents.

#120 also could not be salvaged in place: its branch forked before #119 landed,
so apps/journal/package.json and pnpm-lock.yaml both conflict with main and it
reports mergeable: false.

Verified locally with server resolved to 14.0.1:
  typecheck  exit 0
  lint       exit 0
  test       55 files passed, 15 skipped / 367 tests passed, 79 skipped
`pnpm dedupe` produces no further lockfile change, matching what renovate's
postUpgradeTask would have done.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W9K6hHEZx5aqyWZKHNrxsD

ullrich merged commit 5236111330 into main 2026-09-07 12:26:58 +00:00

ullrich referenced this pull request from a commit 2026-09-07 12:27:00 +00:00

Merge pull request 'Update @simplewebauthn/server to v14 and drop the removed transport type' (#125) from simplewebauthn-server-14 into main

ullrich deleted branch simplewebauthn-server-14 2026-09-07 12:27:01 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

dependencies

Dependency updates raised by Renovate (renovate.json5 labels)

  

major

Major version bump — always needs human review, never auto-merged

  

security-pin

Touches a pnpm.overrides CVE remediation pin, not an ordinary dependency

No labels

dependencies

major

security-pin

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

trails-cool/trails!125

No description provided.