[dependabot]

Updated Fido2 from 4.2.0 to 4.3.1.

Release notes

Sourced from Fido2's releases.

4.3.1

Security fix — see GHSA-gw6g-q29j-3jvp

Also updates Blazor WebAssembly packages to 8.0.32 (GHSA-qjpx-jqm5-h2c4).

4.3.0

Backports two WebAuthn Level 3 validation checks from the 5.0.0-preview line to the 4.x line (#​689, #​690).

What changed

• crossOrigin/topOrigin in the collected client data are now validated during both registration and authentication. A response with crossOrigin: true is rejected unless Fido2Configuration.AllowCrossOriginRequests is set; when present, topOrigin must match one of your configured origins.
• An authenticator sending the backup-state (BS) flag without the backup-eligible (BE) flag is now rejected unconditionally — this combination is malformed per spec regardless of your configured backup policy.

⚠️ Breaking change

Cross-origin ceremonies were previously accepted with no validation at all. If your application intentionally performs WebAuthn ceremonies inside a cross-origin iframe, you need to opt in going forward:

var config = new Fido2Configuration
{
    // ...
    AllowCrossOriginRequests = true,
};

Same-origin applications (the vast majority) are unaffected. See the v4.3.0 Upgrade Guide (https://github.com/passwordless-lib/fido2-net-lib/blob/maintenance-4.x/Documentation/migration-guide-4.3.0.md) for details.

Also in this release

• Fixed an unguarded topOrigin parse that could throw a raw UriFormatException on malformed input instead of the library's own Fido2VerificationException.
• Fixed an intermittent test failure in Fido2MetadataServiceRepositoryTests (mostly surfaced on macOS CI runners), unrelated to the above but included for CI stability.

All Fido2 and Fido2.AspNet users on the 4.x line should review the upgrade guide before updating, in case cross-origin ceremonies apply to your deployment.

Full Changelog: passwordless-lib/fido2-net-lib@4.2.0...4.3.0

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

Failed to generate code suggestions for PR

[dependabot]

Superseded by #232.