Skip to content

chore(deps): bump libwebauthn to 0.5.0#166

Merged
iinuwa merged 3 commits into
mainfrom
chore/bump-libwebauthn-0.5.0
May 22, 2026
Merged

chore(deps): bump libwebauthn to 0.5.0#166
iinuwa merged 3 commits into
mainfrom
chore/bump-libwebauthn-0.5.0

Conversation

@AlfioEmanueleFresta
Copy link
Copy Markdown
Member

@AlfioEmanueleFresta AlfioEmanueleFresta commented May 18, 2026 •
edited
Loading

Bumps libwebauthn from 0.3.0 to v0.5.0.

Breaking: AppId origin requests now panic (unimplemented!). As far as I understand, that code path is on its way out. HTTPS origin requests are unaffected.

Runtime dependency: libwebauthn 0.5.0 validates rpId via the system Public Suffix List. credentialsd now needs the publicsuffix list package (publicsuffix-list-dafsa on Fedora, publicsuffix on Debian/Ubuntu) present at runtime, otherwise requests fail. Out of scope for this bump: declaring it as an explicit packaging dependency, or bundling our own PSL implementation. (Sorry, I don't know enough about packaging.)

Other changes are mechanical adaptations to libwebauthn API renames.

@AlfioEmanueleFresta
chore(deps): bump libwebauthn to 0.5.0
4cabdba 
- Rename feature flags: libnfc/pcsc -> nfc-backend-libnfc/nfc-backend-pcsc
- Migrate to the new from_json(RequestOrigin, PublicSuffixList, json) API
- Convert NavigationContext to libwebauthn RequestOrigin (synthesise https://<rp.id> for AppId origins)
- Use SystemPublicSuffixList::auto() to validate rpId
- MakeCredentialRequest.cross_origin renamed to top_origin
- CableQrCodeDevice::new_transient now takes a CableTransports arg (CloudAssistedOnly preserves legacy caBLE behaviour)
- Assertion no longer exposes large_blob_key
@AlfioEmanueleFresta AlfioEmanueleFresta force-pushed the chore/bump-libwebauthn-0.5.0 branch from c440113 to 4cabdba Compare May 18, 2026 19:40
@AlfioEmanueleFresta
Copy link
Copy Markdown
Member Author

AlfioEmanueleFresta commented May 18, 2026

FYI libwebauthn 0.5.0 added a CableTransports arg on CableQrCodeDevice::new_transient. Defaulted to CloudAssistedOrLocal so the QR advertises both WebSocket and direct BLE L2CAP. libwebauthn picks L2CAP on CTAP 2.3-aware peers and falls back to WebSocket for older clients. LMK if you'd rather have CloudAssistedOnly.

@iinuwa
Copy link
Copy Markdown
Member

iinuwa commented May 22, 2026

My SoloKey is working again now!

Defaulted to CloudAssistedOrLocal so the QR advertises both WebSocket and direct BLE L2CAP.

Yup, enabling BLE L2CAP is great!

I am having a problem testing hybrid in this build though. Filed linux-credentials/libwebauthn#225.

I am going to go ahead and merge this since this fixes a USB CTAP for me, and hybrid on Android with up-to-date GMS wasn't working before anyway.

iinuwa
iinuwa approved these changes May 22, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@iinuwa iinuwa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving, with issue mentioned above

@iinuwa iinuwa merged commit 4ad7c50 into main May 22, 2026
1 check passed
@iinuwa iinuwa deleted the chore/bump-libwebauthn-0.5.0 branch May 22, 2026 12:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@iinuwa iinuwa iinuwa approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@AlfioEmanueleFresta @iinuwa