v0.18.0

0.18.0 (2026-08-27)

This release is a fairly major milestone in the development of this library. It has quite a few breaking changes but has
added support for most if not all of the extension requirements natively, and adds formal support for Post-Quantum
Cryptography with support for ML-DSA-44, ML-DSA-65, and ML-DSA-87 when used with go 1.27.

Details on the migration requirements for this version can be found int MIGRATION.md as they are substantial between
ths version and prior versions.

Bug Fixes

• metadata: align members with mds 3.1.1 and ctap 2.3 (#739) (397152c)
• metadata: consistent revocation policy and client timeouts (#740) (34d324b)
• metadata: handle certificate chains of any depth (#737) (309ea69)
• metadata: honour status report order and effective dates (#736) (8be5355)
• metadata: mds3 parsing conformance and cache integrity (#735) (8115143)
• metadata: prevent panic corrupt blob (#698) (c5fd013)
• metadata: report malformed status report urls (#738) (ed82f7c)
• protocol: allow any attestation eku (#728) (f4e33fc)
• protocol: androidkey missing authorization list member (#727) (9b02b19)
• protocol: androidkey union generated (#729) (3ed3e75)
• protocol: bind credential public key curve to its algorithm (#752) (314c2be)
• protocol: compound attestation sub-statement unmarshalling (#751) (a582ecf)
• protocol: compound returns incorrect type (#731) (025d897)
• protocol: credential public key match limited to ECDSA (#732) (b4df26e)
• protocol: harden credential response and options handling (#763) (de0ae6c)
• protocol: missing tpm steps (#725) (f9a63f9)
• protocol: opaque origin matching and validation (#758) (37f065a)
• protocol: possible panic conditions (#719) (0ea14e7)
• protocol: safetynet validation steps (#726) (e12f6e8)
• protocol: single signature encoding policy and canonical der (#744) (99bbbdb)
• webauthncbor: reject data trailing the first cbor item (#762) (0801b5d)
• webauthncose: validate okp key algorithm (#759) (98c528b)
• webauthn: deprecations and handle check (#745) (8619bb9)
• webauthn: include backup flag check in registration (#748) (26a4868)
• webauthn: only update uv flag (#746) (b39c822)
• webauthn: use session relying party id (#747) (ebb45e2)

Features

• metadata: update to r46 anchor (#780) (20f33e6)
• ml-dsa preference list and gated availability (#768) (db1e068)
• protocol: client capability enumeration (#765) (62f4489)
• protocol: compound sub-statement scope (#742) (34271da)
• protocol: current user details signal constructor (#766) (b6db923)
• protocol: ecdsa attestation signature encoding policy (#743) (29404e9), closes #710
• protocol: related origins well-known document (#753) (05d54dc)
• protocol: relying party attestation policy (#741) (3239ed0)
• typed extension inputs and outputs (#734) (0661c81)
• webauthn: ceremony origin binding (#756) (45aabc3)
• webauthncose: ml-dsa (#767) (5fb926e), closes #639
• webauthncose: secp256k1 (#755) (d5d3910)

BREAKING CHANGES

• protocol: A credential response whose id and rawId disagree, or which omits rawId, is rejected. Registration previously accepted both, since the credential record is built from the attested credential id and nothing read the client's value.
• An IP address configured as a relying party id is
  rejected, so a Config carrying one now fails validation.
• HasherFromCOSEAlg returns (hash.Hash, bool) and no
  longer substitutes SHA-256 for an unregistered algorithm. Callers must
  handle the second value.
• webauthncose: A stored credential whose OKP key names an algorithm
  other than -8 or -19 no longer parses, failing the assertion rather than
  verifying with Ed25519.
• The rpOpaqueOrigins parameter has been added to protocol.CollectedClientData.Verify, protocol.ParsedCredentialCreationData.Verify and protocol.ParsedCredentialAssertionData.Verify, immediately after the existing rpOrigins parameter; callers which accept no opaque origins should pass nil. The webauthn.ConfigProvider interface has also gained a GetOpaqueOrigins method which implementations outside this module must provide.
• RegistrationOption and LoginOption now return an error, so any option implemented outside this module must be adjusted, and WithExtensions and WithAssertionExtensions accept extension options in place of a map. protocol.AuthenticationExtensions and protocol.AuthenticationExtensionsClientOutputs are structs rather than map[string]any, protocol.Extensions is removed, and ParsedPublicKeyCredential.GetAppID takes a protocol.SessionExtensions. SessionData.Extensions changes both its type and its encoded representation, so a session persisted by an earlier version cannot be decoded by this one, and a client extension output the Relying Party did not request now fails the ceremony unless Config.ExtensionsUnsolicitedOutputPolicy says otherwise.
• protocol: ConfigProvider requires GetSignaturePolicy. AttestationObject.Verify, AttestationObject.VerifyAttestation, ParsedCredentialAssertionData.Verify, ParsedCredentialCreationData.Verify, Credential.Verify, Credential.VerifyAttestationType and the attestation format validation handler registered by RegisterAttestationFormat take a SignaturePolicy. AttestationPolicy no longer carries a Signature member and webauthncose.SetExperimentalInsecureAllowBERIntegers is removed.
• protocol: AttestationObject.Verify and AttestationObject.VerifyAttestation take an AttestationPolicy, and ConfigProvider requires GetAttestationPolicy.
• metadata: Statement.CredentialExportProtocolConfigURL and its JSON counterpart are now named CredentialExchangeConfigURL, matching the credential exchange terminology the specification uses.
• metadata: the desired statuses given to ValidateStatusReports are now a
  set of acceptable current statuses rather than a set which must all appear
  somewhere in the report history.
• metadata: StatusReport.EffectiveDate and BiometricStatusReport.EffectiveDate are now *time.Time so an absent date is distinguishable from a zero value.