Skip to content

chore(deps): Bump the fido2 group with 2 updates - #106

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/fido2-27cf06c97c
Open

chore(deps): Bump the fido2 group with 2 updates#106
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/fido2-27cf06c97c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updated Fido2 from 4.0.1 to 4.3.0.

Release notes

Sourced from Fido2's releases.

4.3.0

Backports two WebAuthn Level 3 validation checks from the 5.0.0-preview line to the 4.x line (#​689, #​690).

What changed

  • crossOrigin/topOrigin in the collected client data are now validated during both registration and authentication. A response with crossOrigin: true is rejected unless Fido2Configuration.AllowCrossOriginRequests is set; when present, topOrigin must match one of your configured origins.
  • An authenticator sending the backup-state (BS) flag without the backup-eligible (BE) flag is now rejected unconditionally — this combination is malformed per spec regardless of your configured backup policy.

⚠️ Breaking change

Cross-origin ceremonies were previously accepted with no validation at all. If your application intentionally performs WebAuthn ceremonies inside a cross-origin iframe, you need to opt in going forward:

var config = new Fido2Configuration
{
    // ...
    AllowCrossOriginRequests = true,
};

Same-origin applications (the vast majority) are unaffected. See the v4.3.0 Upgrade Guide (https://github.com/passwordless-lib/fido2-net-lib/blob/maintenance-4.x/Documentation/migration-guide-4.3.0.md) for details.

Also in this release

  • Fixed an unguarded topOrigin parse that could throw a raw UriFormatException on malformed input instead of the library's own Fido2VerificationException.
  • Fixed an intermittent test failure in Fido2MetadataServiceRepositoryTests (mostly surfaced on macOS CI runners), unrelated to the above but included for CI stability.

All Fido2 and Fido2.AspNet users on the 4.x line should review the upgrade guide before updating, in case cross-origin ceremonies apply to your deployment.

Full Changelog: passwordless-lib/fido2-net-lib@4.2.0...4.3.0

4.2.0

Full Changelog: passwordless-lib/fido2-net-lib@4.1.1...4.2.0

Security fixes for SSRF, an unauthenticated denial-of-service, and a metadata
validation bypass — see security advisory GHSA-jc6v-cf3v-w2fm for full details,
severity, and proof of concept.

  • SSRF via unpinned AIA fetches during attestation and MDS BLOB chain-building
  • Unauthenticated stack-overflow DoS in CBOR and ASN.1 decoding
  • Metadata cache poisoning for AAGUID-less (U2F) authenticators
  • Hardening: minimum challenge size, empty-challenge refusal, guarded topOrigin parsing

All Fido2 and Fido2.AspNet users on 4.x should upgrade to this version.

4.1.1

Blazor-only patch release. Fixes #​633 and #​634 — Fido2.BlazorWebAssembly packages from 4.0.0 through 5.0.0-preview.3 (including 4.1.0) shipped WebAuthn.ts instead of the compiled WebAuthn.js, so the module import 404'd on first use. No other changes from 4.1.0.

4.1.0

What's Changed

New Contributors

Full Changelog: passwordless-lib/fido2-net-lib@4.0.0...4.1.0

Commits viewable in compare view.

Updated Fido2.Models from 4.0.1 to 4.3.0.

Release notes

Sourced from Fido2.Models's releases.

4.3.0

Backports two WebAuthn Level 3 validation checks from the 5.0.0-preview line to the 4.x line (#​689, #​690).

What changed

  • crossOrigin/topOrigin in the collected client data are now validated during both registration and authentication. A response with crossOrigin: true is rejected unless Fido2Configuration.AllowCrossOriginRequests is set; when present, topOrigin must match one of your configured origins.
  • An authenticator sending the backup-state (BS) flag without the backup-eligible (BE) flag is now rejected unconditionally — this combination is malformed per spec regardless of your configured backup policy.

⚠️ Breaking change

Cross-origin ceremonies were previously accepted with no validation at all. If your application intentionally performs WebAuthn ceremonies inside a cross-origin iframe, you need to opt in going forward:

var config = new Fido2Configuration
{
    // ...
    AllowCrossOriginRequests = true,
};

Same-origin applications (the vast majority) are unaffected. See the v4.3.0 Upgrade Guide (https://github.com/passwordless-lib/fido2-net-lib/blob/maintenance-4.x/Documentation/migration-guide-4.3.0.md) for details.

Also in this release

  • Fixed an unguarded topOrigin parse that could throw a raw UriFormatException on malformed input instead of the library's own Fido2VerificationException.
  • Fixed an intermittent test failure in Fido2MetadataServiceRepositoryTests (mostly surfaced on macOS CI runners), unrelated to the above but included for CI stability.

All Fido2 and Fido2.AspNet users on the 4.x line should review the upgrade guide before updating, in case cross-origin ceremonies apply to your deployment.

Full Changelog: passwordless-lib/fido2-net-lib@4.2.0...4.3.0

4.2.0

Full Changelog: passwordless-lib/fido2-net-lib@4.1.1...4.2.0

Security fixes for SSRF, an unauthenticated denial-of-service, and a metadata
validation bypass — see security advisory GHSA-jc6v-cf3v-w2fm for full details,
severity, and proof of concept.

  • SSRF via unpinned AIA fetches during attestation and MDS BLOB chain-building
  • Unauthenticated stack-overflow DoS in CBOR and ASN.1 decoding
  • Metadata cache poisoning for AAGUID-less (U2F) authenticators
  • Hardening: minimum challenge size, empty-challenge refusal, guarded topOrigin parsing

All Fido2 and Fido2.AspNet users on 4.x should upgrade to this version.

4.1.1

Blazor-only patch release. Fixes #​633 and #​634 — Fido2.BlazorWebAssembly packages from 4.0.0 through 5.0.0-preview.3 (including 4.1.0) shipped WebAuthn.ts instead of the compiled WebAuthn.js, so the module import 404'd on first use. No other changes from 4.1.0.

4.1.0

What's Changed

New Contributors

Full Changelog: passwordless-lib/fido2-net-lib@4.0.0...4.1.0

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): Bump the fido2 group with 2 updates
7f3c983 
Bumps Fido2 from 4.0.1 to 4.3.0
Bumps Fido2.Models from 4.0.1 to 4.3.0

---
updated-dependencies:
- dependency-name: Fido2
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: fido2
- dependency-name: Fido2.Models
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: fido2
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, nuget. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot mentioned this pull request Oct 14, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants