Release Notes
- Fixes a WebAuthn login security bug: dbAuth's
webAuthnAuthenticate()no longer issues a session cookie when a signature fails verification — previously this specific failure mode threw no exception, so an attacker who knew a victim's credential ID (not secret in WebAuthn) could potentially authenticate as that user. Upgrade if your app uses dbAuth WebAuthn. - Fixes potential duplicate-React installs in
@cedarjs/vite,@cedarjs/auth,@cedarjs/router, and@cedarjs/ogimage-genthat could cause "Invalid hook call" errors and broken hooks/context when your app's React version differed from the framework's pinned version.
Changelog
🛠️ Fixes
fix(dbAuth): Reject unverified WebAuthn assertions (#2545) by @Tobbe
Fixes a security bug in dbAuth's WebAuthn login: webAuthnAuthenticate() now checks the verified result from verifyAuthenticationResponse() and throws a WebAuthnError instead of issuing a session cookie when a signature doesn't match the stored public key. This failure mode previously threw no exception on its own, so it had to be checked explicitly — otherwise a forged or mismatched signature could result in a valid session, and the only thing an attacker needs to reach this path is a credential ID for the victim, which is not secret in the WebAuthn model. Upgrade if your app uses dbAuth's WebAuthn support.
fix(deps): Declare react as a peer dependency in vite, auth, router, and ogimage-gen (#2505) by @Tobbe
Fixes potential duplicate React installs that could cause "Invalid hook call" errors and broken hooks/context: @cedarjs/vite, @cedarjs/auth, @cedarjs/router, and @cedarjs/ogimage-gen previously listed react (and, for some, react-dom) as a regular dependency pinned to an exact version, so an app using a different React version got a second, nested copy of React installed. React is now a peer dependency in these packages, matching how @cedarjs/web and @cedarjs/forms already handle it. You may see a Yarn YN0060 peer-range warning if your app's React version differs from 19.2.3 — this is expected and matches existing peer warnings from those other packages.
📦 Dependencies
fix(deps): update dependency @swc/core to v1.16.1 (#2515) by @renovate-bot
This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| @swc/core (source) | 1.16.0 → 1.16.1 |
Release Notes
Configuration
📅 Schedule: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
fix(deps): update dependency @fastify/http-proxy to v11.6.1 (#2513) by @renovate-bot
This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| @fastify/http-proxy | 11.6.0 → 11.6.1 |
Release Notes
fastify/fastify-http-proxy (@fastify/http-proxy)
v11.6.1
What's Changed
- ci: pin actions to commit-hash by @Fdawgs in #476
- ci: update dependabot.yml by @Tony133 in #478
- chore(.npmrc): add min-release-age by @Fdawgs in #479
- chore: bump fastify/workflows/.github/workflows/lock-threads.yml from 6.0.0 to 7.0.0 by @dependabot[bot] in #480
- chore: bump fastify/workflows/.github/workflows/plugins-ci.yml from 6.0.0 to 7.0.0 by @dependabot[bot] in #481
- fix: scope websocket upgrades to the proxy prefix by @xianjianlf2 in #475
New Contributors
- @xianjianlf2 made their first contribution in #475
Full Changelog: fastify/fastify-http-proxy@v11.6.0...v11.6.1
Configuration
📅 Schedule: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
