5.3.10

Release Notes for 5.3.10

5.3.x bugfix release (patch)

Security

This release fixes three low severity advisories:

• GHSA-p653-gg6c-rrjw: FidoAllianceCompliantMetadataService accepted, by default, a metadata BLOB that does not chain to a trust anchor.
• GHSA-pm4w-cq4x-rv8q: the assertion options of an account without credentials had an empty allowCredentials, while an unknown username got decoys.
• GHSA-8gvp-8vj9-p3q7: SimpleFakeCredentialGenerator emitted hex-encoded credential IDs, distinguishable from the binary IDs of real credentials.

Backward compatibility breaks

• FidoAllianceCompliantMetadataService requires a certificate chain validator and a root certificate URI, and throws an InvalidArgumentException without them (GHSA-p653-gg6c-rrjw). For the FIDO Alliance Metadata Service:

  FidoAllianceCompliantMetadataService::create(
      $httpClient,
      'https://mds.fidoalliance.org/',
      [],
      PhpCertificateChainValidator::create($httpClient),
      'https://secure.globalsign.com/cacert/root-r3.crt'
  );

• The authentication ceremony rejects an assertion whose backup eligibility (BE) flag differs from the one stored in the credential record (#981). BackupEligibilityChangedEvent is only dispatched when the flag is recorded for the first time. A credential record whose backupEligible is null is not checked and records the flag of its next assertion.

5.3.10

• Total issues resolved: 3
• Total pull requests resolved: 7
• Total contributors: 5

bug

• 982: fix(denormalizer): reject malformed response objects and mistyped credential members thanks to @Spomky and @luimen6
• 979: fix(symfony): read the right options in two WebauthnFirewallConfig getters thanks to @Spomky
• 975: fix(denormalizer): reject a public key credential with a missing member thanks to @Lars- and @luimen6
• 971: fix(metadata): accept metadata statements without userVerificationDetails thanks to @zhaozhouyang

break,bug,compliance,security

• 981: fix(assertion)!: reject assertions that change the backup eligibility of a credential thanks to @Spomky

DX,bug

• 980: fix(symfony): stop passing the removed $aliasMap to DoctrineOrmMappingsPass thanks to @Spomky and @ehymel

DX

• 977: ci: keep the analysis jobs green and mutate only the pull request diff thanks to @Spomky

Published @web-auth/webauthn-stimulus to NPM: https://www.npmjs.com/package/@web-auth/webauthn-stimulus/v/5.3.10