## go-webauthn/webauthn — v0.17.4…v0.18.0 _81 commits._ ### Features - **feat(metadata): update to r46 anchor (#780)** (20f33e6) - **feat(protocol): current user details signal constructor (#766)** (b6db923) - **feat: ml-dsa preference list and gated availability (#768)** (db1e068) - **feat(webauthncose): ml-dsa (#767)** (5fb926e) - **feat(protocol): client capability enumeration (#765)** (62f4489) - **feat(webauthncose): secp256k1 (#755)** (d5d3910) - **feat(webauthn): ceremony origin binding (#756)** (45aabc3) - **feat!: opaque origin configuration (#754)** (5415992) - **feat(protocol): related origins well-known document (#753)** (05d54dc) - **feat: typed extension inputs and outputs (#734)** (0661c81) - **feat(protocol): ecdsa attestation signature encoding policy (#743)** (29404e9) - **feat(protocol): compound sub-statement scope (#742)** (34271da) - **feat(protocol): relying party attestation policy (#741)** (3239ed0) ### Fixes - **fix(protocol): harden credential response and options handling (#763)** (de0ae6c) - **fix(protocol)!: validate relying party id as a domain string (#761)** (8f067a1) - **fix(webauthncbor): reject data trailing the first cbor item (#762)** (0801b5d) - **fix(webauthncose)!: fail closed on unknown hash algorithm (#760)** (05d9d99) - **fix(webauthncose): validate okp key algorithm (#759)** (98c528b) - **fix(protocol): opaque origin matching and validation (#758)** (37f065a) - **fix(webauthn): deprecations and handle check (#745)** (8619bb9) - **fix(protocol): compound attestation sub-statement unmarshalling (#751)** (a582ecf) - **fix(protocol): bind credential public key curve to its algorithm (#752)** (314c2be) - **fix(webauthn): use session relying party id (#747)** (ebb45e2) - **fix(webauthn): only update uv flag (#746)** (b39c822) - **fix(webauthn): include backup flag check in registration (#748)** (26a4868) - **fix(protocol): single signature encoding policy and canonical der (#744)** (99bbbdb) - **fix(metadata): consistent revocation policy and client timeouts (#740)** (34d324b) - **fix(metadata): align members with mds 3.1.1 and ctap 2.3 (#739)** (397152c) - **fix(metadata): report malformed status report urls (#738)** (ed82f7c) - **fix(metadata): honour status report order and effective dates (#736)** (8be5355) - **fix(metadata): handle certificate chains of any depth (#737)** (309ea69) - **fix(metadata): mds3 parsing conformance and cache integrity (#735)** (8115143) - **fix(protocol): credential public key match limited to ECDSA (#732)** (b4df26e) - **fix(protocol): compound returns incorrect type (#731)** (025d897) - **fix(protocol): androidkey union generated (#729)** (3ed3e75) - **fix(protocol): androidkey missing authorization list member (#727)** (9b02b19) - **fix(protocol): allow any attestation eku (#728)** (f4e33fc) - **fix(protocol): safetynet validation steps (#726)** (e12f6e8) - **fix(protocol): missing tpm steps (#725)** (f9a63f9) - **fix(protocol): possible panic conditions (#719)** (0ea14e7) - **fix(metadata): prevent panic corrupt blob (#698)** (c5fd013) ### Backend - **release: v0.18.0 (#782)** (109da34) ### Tests - **test: add fuzz tests (#777)** (bca8ebd) ### Docs - **docs: breaking (#781)** (4977ba1) - **docs: fix descriptions and links (#764)** (6233ca9) ### Chore - **build(deps): update github/codeql-action action to v4.37.9 (#779)** (f8eb85e) - **build(deps): update github/codeql-action action to v4.37.8 (#776)** (9b6dffd) - **build: update to go 1.27 (#775)** (2190797) - **build(deps): update dependency go to v1.27.0 (#774)** (97b0d9f) - **build(deps): update module github.com/stretchr/testify to v1.12.1 (#772)** (f815453) - **build(deps): update go toolchain directive to v1.27.0 (#773)** (a456bad) - **build(deps): update module github.com/fxamacker/cbor/v2 to v2.9.3 (#770)** (eeda85e) - **build(deps): update module github.com/stretchr/testify to v1.12.0 (#769)** (1cc46e1) - **build(deps): update step-security/harden-runner action to v2.21.0 (#757)** (da78d7f) - **build(deps): update go toolchain directive to v1.26.6 (#750)** (2c1e2ec) - **build(deps): update github/codeql-action action to v4.37.7 (#749)** (77a3248) - **build(deps): update module github.com/go-webauthn/x to v0.2.7 (#733)** (9999753) - **refactor(protocol): cleanup (#730)** (d161848) - **build(deps): update step-security/harden-runner action to v2.20.1 (#723)** (88219ba) - **build(deps): update github/codeql-action action to v4.37.6 (#722)** (d9d3f74) - **build(deps): update github/codeql-action action to v4.37.5 (#721)** (038227d) - **build(deps): update github/codeql-action action to v4.37.4 (#720)** (81fdf43) - **build(deps): update ossf/scorecard-action action to v2.4.4 (#718)** (ea4ab95) - **build(deps): update github/codeql-action action to v4.37.3 (#717)** (df6e3e1) - **build(deps): update github/codeql-action action to v4.37.2 (#716)** (1716b88) - **build(deps): update actions/checkout action to v7.0.1 (#715)** (b1c0cab) - **build(deps): update github/codeql-action action to v4.37.1 (#714)** (e4283e4) - **build(deps): update actions/setup-go action to v7 (#713)** (72920b8) - **build(deps): update github/codeql-action action to v4.37.0 (#712)** (591d23a) - **build(deps): update step-security/harden-runner action to v2.20.0 (#709)** (17c2368) - **build(deps): update go toolchain directive to v1.26.5 (#711)** (5027801) - **build(deps): update github/codeql-action action to v4.36.3 (#708)** (eb976e5) - **build(deps): update actions/setup-go action to v6.5.0 (#706)** (a5c6091) - **build(deps): update actions/checkout action to v7 (#705)** (66850fc) - **build(deps): update codecov/codecov-action action to v7 (#704)** (6362fe0) - **build(deps): update github/codeql-action action to v4.36.2 (#702)** (7e1208c) - **build(deps): update actions/checkout action to v6.0.3 (#700)** (f32ab3e) - **build(deps): update go toolchain directive to v1.26.4 (#701)** (0ef37de) - **build(deps): update github/codeql-action action to v4.36.1 (#699)** (f9896c7) - **ci: update ignore (#697)** (2da7665) - **build(deps): update github/codeql-action action to v4.36.0 (#696)** (c9d3bf2) _Recap by [Repo Wrapped](https://repowrapped.com/gh/go-webauthn/webauthn?utm_source=github-action)._