Update dependency otplib to v13

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
otplib (source)	^12.0.1 → ^13.0.0

---

Release Notes

yeojz/otplib (otplib)

v13.5.0

Compare Source

What's Changed

• test: mutation-testing audit — close test gaps, add Stryker tooling + manual CI by @​yeojz in #​865
• chore(deps-dev): bump vite from 8.0.14 to 8.0.16 by @​dependabot[bot] in #​864
• chore(deps): bump the github-actions group across 1 directory with 7 updates by @​dependabot[bot] in #​872
• chore(deps-dev): bump the dev-dependencies-minor group across 1 directory with 10 updates by @​dependabot[bot] in #​871
• chore(deps): bump commander from 14.0.3 to 15.0.0 by @​dependabot[bot] in #​866
• fix: reject unknown hash algorithms instead of silently substituting by @​yeojz in #​874
• test(fuzz): cover scalar HOTP counter tolerance semantics by @​yeojz in #​876
• chore(deps-dev): bump vite from 8.1.5 to 8.2.0 by @​dependabot[bot] in #​875
• fix: constrain esbuild for VitePress by @​yeojz in #​877
• chore(deps-dev): resolve dependabot alerts via pnpm overrides by @​yeojz in #​878
• chore(deps-dev): migrate to TypeScript 6.0.3 by @​yeojz in #​879
• docs: collapse API section by default by @​yeojz in #​880
• release(packages): v13.5.0 by @​github-actions[bot] in #​881

Full Changelog: yeojz/otplib@v13.4.1...v13.5.0

---

Important behaviour change in this bugfix release.

[!NOTE]
This is a bugfix release but has potentially breaking behaviour for library users passing invalid inputs (which is more likely in non-TypeScript or loosely-typed environments).

This release (#​874) makes hash algorithm validation consistent and strict across all crypto plugins. Previously, an unrecognised algorithm string was handled differently by each plugin:

input	noble	node	web
'SHA1'	silently computed SHA-512	worked (OpenSSL alias tolerance)	threw a raw TypeError
'totally-bogus'	silently computed SHA-512	threw	threw

All three now reject anything outside sha1/sha256/sha512 (case-insensitive, single-separator aliases like SHA-1 or sha_256 accepted) by throwing the new AlgorithmUnsupportedError, instead of silently substituting a different digest.

A library dependents passing a correctly-spelled algorithm name ('sha1', 'SHA1', 'sha-256', etc.) sees no change other than clearer, stricter errors on genuinely invalid input. In TypeScript-strict environments this is mostly moot as algorithm is typed as 'sha1' | 'sha256' | 'sha512', so a hardcoded typo like 'SHA1' won't compile. It can still surface if the value comes from outside the type system (e.g. JSON.parse, process.env, or an as HashAlgorithm cast).

If you were relying on noble's old silent fallback to SHA-512 for a misspelled or unrecognised algorithm string, tokens generated/verified that way will stop matching after upgrading with no error on the old side, just tokens that quietly stop verifying.

To recover

• Change algorithm to sha512,
• or re-enroll the affected accounts.

See "Existing enrollments stopped verifying after an upgrade" for details.

v13.4.1

Compare Source

What's Changed

• fix: override flatted package security alert by @​yeojz in #​820
• fix: override picomatch and yaml package security alerts by @​yeojz in #​822
• refactor(testing): replace custom Deno adapter with @​std/expect by @​yeojz in #​821
• fix: override brace-expansion package security alert by @​yeojz in #​824
• chore: update github actions pinned images by @​yeojz in #​823
• Add @​otplib/plugin-base32-alt to dependencies by @​yeojz in #​825
• chore: harden supply chain with cooldown and version pinning by @​yeojz in #​826
• refactor(testing): centralize test secrets into shared module by @​yeojz in #​831
• chore(deps): bump the github-actions group with 5 updates by @​dependabot[bot] in #​827
• refactor(testing): rename test secret constants for semantic clarity by @​yeojz in #​832
• chore(deps-dev): bump the dev-dependencies-minor group with 4 updates by @​dependabot[bot] in #​828
• refactor: replace size-limit with native bundle size check by @​yeojz in #​835
• chore(deps-dev): bump vite from 7.3.1 to 8.0.0 by @​dependabot[bot] in #​830
• refactor/docs/unusedImport by @​ValeriYanev98 in #​837
• fix(security): address npm audit vulnerabilities by @​yeojz in #​839
• fix(docker): bump pnpm to 10.30.1 to match packageManager by @​yeojz in #​847
• docs: note short-secret guardrail override for legacy/test secrets by @​yeojz in #​848
• docs(getting-started): clarify when each function runs by @​yeojz in #​846
• chore(deps): bump vite from 5.4.21 to 8.0.10 by @​dependabot[bot] in #​845
• chore(deps-dev): bump the dev-dependencies-patch group across 1 directory with 6 updates by @​dependabot[bot] in #​849
• chore(deps-dev): bump the dev-dependencies-minor group across 1 directory with 6 updates by @​dependabot[bot] in #​841
• docs(otplib): note 16-byte minimum and fix broken secret-handling link by @​yeojz in #​851
• chore(deps-dev): bump @​codecov/bundle-analyzer from 1.9.1 to 2.0.1 by @​dependabot[bot] in #​843
• fix(benchmarks): adapt to tinybench v6 TaskResult shape by @​yeojz in #​852
• chore(deps): bump the github-actions group across 1 directory with 6 updates by @​dependabot[bot] in #​844
• chore(deps): bump @​noble/hashes and @​scure/base to 2.2.0 by @​yeojz in #​853
• chore(deps-dev): bump turbo from 2.9.9 to 2.9.14 by @​dependabot[bot] in #​855
• ci: split security audit into blocking prod and informational full scans by @​yeojz in #​857
• chore(deps-dev): bump vite from 8.0.10 to 8.0.11 by @​dependabot[bot] in #​856
• release(packages): v13.4.1 by @​github-actions[bot] in #​854

New Contributors

• @​ValeriYanev98 made their first contribution in #​837

Full Changelog: yeojz/otplib@v13.4.0...v13.4.1

v13.4.0

Compare Source

What's Changed

• fix(deps): resolve markdown-it ReDoS vulnerability by @​yeojz in #​798
• chore(deps-dev): bump the dev-dependencies-minor group with 3 updates by @​dependabot[bot] in #​800
• chore: update dependabot to monthly cadence by @​yeojz in #​802
• chore: upgrade dependencies to latest versions by @​Copilot in #​804
• Upgrade pnpm to 10.30.1 to fix audit endpoint issue by @​Copilot in #​805
• chore: override minimatch by @​yeojz in #​806
• docs: improve package READMEs with accurate API context and usage examples by @​yeojz in #​803
• Fix docs by @​BobTheShoplifter in #​807
• ci: skip reporting job on fork PRs by @​yeojz in #​808
• chore: override ajv to fix moderate ReDoS vulnerability by @​yeojz in #​809
• feat: add IIFE/CDN build support to otplib by @​yeojz in #​810
• fix: update release titles to use version-prefixed format by @​yeojz in #​811
• chore: move otplib-cli to packages/ and sync versioning by @​yeojz in #​812
• docs(totp): add string secrets and authenticator compatibility notes to README by @​yeojz in #​813
• chore(deps-dev): bump the dev-dependencies-patch group with 5 updates by @​dependabot[bot] in #​814
• chore(deps): bump the github-actions group with 3 updates by @​dependabot[bot] in #​816
• chore(deps-dev): bump @​eslint/js from 9.39.2 to 9.39.3 by @​dependabot[bot] in #​815
• fix: override undici package security alert by @​yeojz in #​818
• release(packages): v13.4.0 by @​github-actions[bot] in #​819

New Contributors

• @​BobTheShoplifter made their first contribution in #​807

Full Changelog: yeojz/otplib@v13.3.0...v13.4.0

v13.3.0

Compare Source

What's Changed

• ci: standardize workflow naming and add release artifacts by @​yeojz in #​775
• chore(deps-dev): bump turbo from 2.7.5 to 2.7.6 in the dev-dependencies-patch group by @​dependabot[bot] in #​773
• chore(deps): bump changesets/action from 1.5.3 to 1.6.0 in the github-actions group by @​dependabot[bot] in #​774
• chore(deps-dev): bump the dev-dependencies-minor group with 3 updates by @​dependabot[bot] in #​772
• feat(cli): add otplib-cli application by @​yeojz in #​771
• Potential fix for code scanning alert no. 2: Workflow does not contain permissions by @​yeojz in #​776
• Implement least privilege permissions across all GitHub workflows by @​Copilot in #​777
• feat(test): add distribution tests package for cross-runtime testing by @​yeojz in #​778
• chore(deps): bump commander from 14.0.2 to 14.0.3 in the dependencies-patch group by @​dependabot[bot] in #​781
• chore(deps): bump actions/checkout from 4 to 6 in the github-actions group by @​dependabot[bot] in #​785
• chore(deps-dev): bump turbo from 2.7.6 to 2.8.1 in the dev-dependencies-minor group by @​dependabot[bot] in #​782
• chore(deps-dev): bump lefthook from 2.0.15 to 2.0.16 in the dev-dependencies-patch group by @​dependabot[bot] in #​783
• feat: security improvements and HOTP update-counter command by @​yeojz in #​780
• chore: update docs by @​yeojz in #​786
• Pin GitHub Actions to commit SHAs and update dependencies by @​yeojz in #​787
• fix: harden OTP validation and URI parsing; bubble up TOTP replay controls through otplib by @​yeojz in #​788
• feat: add OTPHooks for custom token encoding and validation by @​yeojz in #​790
• chore(deps-dev): bump the dev-dependencies-minor group with 5 updates by @​dependabot[bot] in #​791
• chore(deps-dev): bump turbo from 2.8.1 to 2.8.3 in the dev-dependencies-patch group by @​dependabot[bot] in #​792
• release(cli): v2.0.0 by @​github-actions[bot] in #​795
• chore: upgrade development Node.js baseline to 24 by @​yeojz in #​794
• chore(deps-dev): bump @​types/node from 20.19.30 to 25.2.2 by @​dependabot[bot] in #​793
• release(packages): v13.3.0 by @​github-actions[bot] in #​796

New Contributors

• @​Copilot made their first contribution in #​777

Full Changelog: yeojz/otplib@v13.2.1...v13.3.0

v13.2.1

Compare Source

What's Changed

• docs: refine mobile hero and base32 guidance by @​yeojz in #​767
• docs: improve plugin guides and light mode UI contrast by @​yeojz in #​768
• ci: update package versions by @​github-actions[bot] in #​769

Full Changelog: yeojz/otplib@v13.2.0...v13.2.1

v13.2.0

Compare Source

What's Changed

• docs: add legacy Google Authenticator troubleshooting guide by @​yeojz in #​754
• feat: add tuple semantics for counterTolerance with look-ahead default by @​yeojz in #​753
• docs: clarify Base32 as default encoding for string secrets by @​yeojz in #​755
• feat(docs): improve landing page UI with cipher theme by @​yeojz in #​757
• feat(plugin-base32-bypass): add base32 bypass plugin by @​yeojz in #​756
• chore(deps-dev): bump prettier from 3.7.4 to 3.8.0 in the dev-dependencies-minor group by @​dependabot[bot] in #​758
• feat(totp): add afterTimeStep parameter for replay protection by @​yeojz in #​749
• feat(adapters): initialize guardrails once in v11/v12 adapter constructors by @​yeojz in #​763
• docs: fix wrapResult example to use sync functions by @​yeojz in #​764
• chore(deps-dev): bump the dev-dependencies-patch group across 1 directory with 10 updates by @​dependabot[bot] in #​761
• feat(plugin-base32-alt): add hex and base64 bypass plugins by @​yeojz in #​765
• ci: update package versions by @​github-actions[bot] in #​766

Callout

• HOTP counterTolerance tuple has been fixed to [number, number] instead of the previous number[] . There was an erroneous logic from the intended documentation/usage . Please double check your HOTP tolerance if it's used.

Full Changelog: yeojz/otplib@v13.1.1...v13.2.0

v13.1.1

Compare Source

What's Changed

• chore(deps-dev): bump the dev-dependencies-minor group with 3 updates by @​dependabot[bot] in #​743
• Feat/docs add hotp example by @​yeojz in #​745
• fix: ensure guardrails parameter propagates through HOTP and TOTP call chains by @​yeojz in #​748
• ci: update package versions by @​github-actions[bot] in #​751

Full Changelog: yeojz/otplib@v13.1.0...v13.1.1

v13.1.0

Compare Source

What's Changed

• TOTP tolerance writeup by @​yeojz in #​737
• feat: allow guardrails to be overridden by @​yeojz in #​738
• feat: add HOTP support to generateURI for both TOTP and HOTP strategies by @​yeojz in #​740
• ci: update package versions by @​github-actions[bot] in #​742

Full Changelog: yeojz/otplib@v13.0.2...v13.1.0

v13.0.2

What's Changed

• ci: update package versions by @​github-actions[bot] in #​726
• Configure Dependabot for npm and GitHub Actions by @​yeojz in #​727
• chore(deps): bump @​scure/base from 1.2.6 to 2.0.0 by @​dependabot[bot] in #​732
• chore(deps-dev): bump tinybench from 2.9.0 to 6.0.0 by @​dependabot[bot] in #​730
• chore(deps): bump the github-actions group with 7 updates by @​dependabot[bot] in #​729
• chore(deps-dev): bump the dev-dependencies-patch group with 2 updates by @​dependabot[bot] in #​734
• chore(deps): bump @​noble/hashes from 1.8.0 to 2.0.1 by @​dependabot[bot] in #​733
• feat: adding codecov bundle analyser upload by @​yeojz in #​735
• ci: update package versions by @​github-actions[bot] in #​736

Full Changelog: yeojz/otplib@v13.0.0...v13.0.2

v13.0.0

Compare Source

What's Changed

• Version 13: Rewrite by @​yeojz in #​721
• ci: update package versions by @​github-actions[bot] in #​725

Full Changelog: yeojz/otplib@v12.0.1...v13.0.0

Related Issues

Issue	Title
Closes #​711	Thirty-two... using new Buffer()
Closes #​703	Buffer... preventing Expo usage
Closes #​701	crypto.createHmac is not a function
Closes #​609	Can't resolve 'crypto'
Closes #​547	Cannot read property 'generate' of undefined
Closes #​361	Preset doesn't install core
Closes #​329	Edge SCRIPT1028 Error
Closes #​268	Broken Angular Karma tests
Closes #​207	TS verify/check Base32 typing
Closes #​178	Support for expo.io
Closes #​679	TS Consumer Version
Closes #​660	TSC target ES2017+
Closes #​693	Documentation offline
Closes #​425	API docs are broken
Closes #​677	Defaults to 15 bytes entropy
Closes #​671	Secret length too low
Closes #​376	Window=0 returns invalid
Closes #​555	Too many OTPs verified
Closes #​708	Window not taking delay
Closes #​698	Custom period (15s)
Closes #​511	Increase step time
Closes #​655	Distributed systems check
Closes #​610	Custom Timestamp
Closes #​536	Stop starting with "Zero"
Closes #​477	Secret padding in RFC
Closes #​710	Node.js Live Server
Closes #​696	2fa not working on live
Closes #​649	Client/Server different
Closes #​439	totp or authenticator
Closes #​704	Project Unmaintained

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.