3.0.0 - WebAuthn Support; E2E-tested; TOTP leeway; UI fixes
What's Changed
This release adds WebAuthn / FIDO2 hardware security keys (e.g. YubiKey) as a
second factor alongside the existing TOTP support, raises the minimum platform requirements,
and introduces a full end-to-end test suite.
⚠️ Breaking: drops Neos 7 (^8.0 | ^9.0 only) and PHP < 8.2 (^8.2).- ✨ WebAuthn / FIDO2: hardware security keys.
- ✨ TOTP leeway: new totpLeewayInSeconds for clock drift.
- ✨ Session-timeout: auto-reload to login on session expiry (new Neos UI saga).
- 🔒 Security: otphp pinned to ^11.5; missing-account handling in the WebAuthn ceremony.
- 🧹 Fixes/UX: reworked setup/login UI, cancel-login button, i18n, dedup fixes.
- 🧪 Tests: new Playwright + Gherkin E2E suite across Neos 8/9 (PHP 8.2/8.5) + GH Actions.
New Contributors
- @tobiasgruber made their first contribution in #47
Full Changelog: 2.0.1...3.0.0