Skip to content

3.0.0 - WebAuthn Support; E2E-tested; TOTP leeway; UI fixes

Choose a tag to compare

@JamesAlias JamesAlias released this 22 Jun 14:32
ef9a099

What's Changed

This release adds WebAuthn / FIDO2 hardware security keys (e.g. YubiKey) as a
second factor alongside the existing TOTP support, raises the minimum platform requirements,
and introduces a full end-to-end test suite.

  • ⚠️ Breaking: drops Neos 7 (^8.0 | ^9.0 only) and PHP < 8.2 (^8.2).
  • ✨ WebAuthn / FIDO2: hardware security keys.
  • ✨ TOTP leeway: new totpLeewayInSeconds for clock drift.
  • ✨ Session-timeout: auto-reload to login on session expiry (new Neos UI saga).
  • 🔒 Security: otphp pinned to ^11.5; missing-account handling in the WebAuthn ceremony.
  • 🧹 Fixes/UX: reworked setup/login UI, cancel-login button, i18n, dedup fixes.
  • 🧪 Tests: new Playwright + Gherkin E2E suite across Neos 8/9 (PHP 8.2/8.5) + GH Actions.

New Contributors

Full Changelog: 2.0.1...3.0.0