[5.x]: web-auth/webauthn-lib 4.8.x has security advisory, conflicts with roave/security-advisories

[kbergha]

What happened?

Description

webauthn-lib 4.5.x to 4.8.x has a moderate security advisory:
GHSA-875x-g8p7-5w27

Craft 5.2.8 has web-auth/webauthn-lib ~4.8.0 as a dependency

Having roave/security-advisories with Roave/SecurityAdvisories@5f55b08 or newer now prevents updating Craft.
I've removed roave/security-advisories temporarily to complete my update locally.

Can you update webauthn-lib to 4.9.x?

Steps to reproduce

1. Have roave/security-advisories with dev-latest in require-dev in composer.json.
2. Using craft update or composer to update from 5.2.5 (or any previous 5.x version?) to 5.2.8

Expected behavior

Update completes without conflict.

Actual behavior

Error Output:
================
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1

    - craftcms/cms 5.2.8 requires web-auth/webauthn-lib ~4.8.0 -> satisfiable by web-auth/webauthn-lib[4.8.0, ..., 4.8.x-dev].
    - roave/security-advisories dev-latest conflicts with web-auth/webauthn-lib 4.8.7.
    - roave/security-advisories dev-latest conflicts with web-auth/webauthn-lib 4.8.6.
    - roave/security-advisories dev-latest conflicts with web-auth/webauthn-lib 4.8.5.
    - roave/security-advisories dev-latest conflicts with web-auth/webauthn-lib 4.8.4.
    - roave/security-advisories dev-latest conflicts with web-auth/webauthn-lib 4.8.3.
    - roave/security-advisories dev-latest conflicts with web-auth/webauthn-lib 4.8.2.
    - roave/security-advisories dev-latest conflicts with web-auth/webauthn-lib 4.8.1.
    - roave/security-advisories dev-latest conflicts with web-auth/webauthn-lib 4.8.0.
    - roave/security-advisories dev-latest conflicts with web-auth/webauthn-lib 4.8.x-dev.

Craft CMS version

5.2.8

PHP version

No response

Operating system and version

No response

Database type and version

No response

Image driver and version

No response

Installed plugins and versions

[brandonkelly]

Craft 5.3.9 is out with web-auth/webauthn-lib 4.9. Thanks for reporting this!