Update module github.com/go-webauthn/webauthn to v0.13.0

This MR contains the following updates:

Package	Type	Update	Change
github.com/go-webauthn/webauthn	require	minor	v0.10.2 -> v0.13.0

---

Release Notes

go-webauthn/webauthn (github.com/go-webauthn/webauthn)

v0.13.0

Compare Source

Features

• protocol: cable transport (#​418) (af19983)
• protocol: verify alg param during registration (#​412) (4cad90a)

v0.12.3

Compare Source

Bug Fixes

• webauthn: empty aaguid fails login (#​398) (4b7cd31)

v0.12.2

Compare Source

This is just a maintenance release that just ensures dependencies are up to date.

v0.12.1

Compare Source

This is a release that just ensures the dependencies that should have been updated in 0.12.0 are actually up-to-date. Most importantly go 1.24.

v0.12.0

Compare Source

Bug Fixes

• metadata: cached file update fails without write access (#​383) (1398e76)
• protocol: ensure attca is parsed correctly (#​280) (ad0f7e2)
• webauthn: expose cred params functions (#​286) (e736323)
• webauthn: login validates attestation format (#​384) (a218507)

Features

• protocol: credential mediation (#​361) (b9a233f), closes #​347
• protocol: enhance errors (#​341) (3207315), closes #​365
• protocol: include intermediate certificate parsing (#​345) (339114c)
• protocol: update tpm manufacturers (#​374) (193f5b5)
• webauthn: add login option to manually set challenge (#​359) (3a57554), closes #​353
• webauthn: include new credential flags func (#​337) (e5657ab)
• webauthn: json v2 partial and unsupported compat (#​327) (bf37040)

v0.11.2

Compare Source

Bug Fixes

• protocol: out of date tpm manufacturers (#​283) (13ad30e)

v0.11.1

Compare Source

Bug Fixes

• metadata: file closed too early (#​273) (9ca2fae), closes #​264
• metadata: functional opt sets wrong value (#​272) (2b83ee0)

v0.11.0

Compare Source

Features

• allow empty modality values (#​257) (a5c838a), closes #​257
• metadata: rework as a provider (#​239) (6713911), closes #​239 #​77 #​154
• backup flag validation (#​240) (2195f33), closes #​240
• remove deprecated values (#​233) (f63fbc1), closes #​233 #​221
• config: allow rpid to be defined at execution time (#​234) (c673c3d), closes #​165
• parse credential bytes (#​258) (b382edc)
• support hints and attestation formats (#​216) (824017d)
• top origin verification (#​217) (0c97761), closes #​205
• webauthn level 3 (#​232) (482cf89)

BREAKING CHANGES

While I endeavor to avoid breaking changes some are necessary to support both better outcomes for implementers and fix issues which are not desirable. This release packs a quite a few, so it's important to take the time to read. While the details on adapting are not comprehensive, they should easy to understand and clarification will be added where it makes sense. Feel free to open a discussion if you're having issues migrating.

• MAJOR: A majority of the functionality that exists within the metadata package has been completely reworked. The rework has added a number of great validation options for implementers as well as allowing them to more easily manage metadata blobs and the refresh of these blobs in their own domain logic. This will require substantial work for anyone currently using it. I will aim to make a discussion explaining all of it in the coming days.
• The following fields and backwards compatible elements have been removed; Icon field from the CredentialEntity struct, WebAuthnIcon function from the User interface, RPIcon/RPOrigin/Timeout fields from the Config struct, Transports field from the CredentialCreationResponse (new field has existed in the AuthenticatorAttestationResponse struct for quite some time which matches the spec).
• The Backup Eligible and Backup State flags within the CredentialFlags struct (field of the Credential struct) are now strictly validated to be consistent with the spec. This breaks implementations which do not strictly adhere to the specification. Several major providers either have or are currently "upgrading" existing WebAuthn credential records to BE and BS passkeys.
• The default modality values are now empty by default. This allows additional browser flows to be accessible to implementers. This change will change default behavior. Previously the required resident key value was set to false, and the user verification option was set to 'preferred'. Implementers looking for consistent values should customize the Authenticator Selection Criteria during registration.

---

Configuration

Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

Ignore: Close this MR and you won't be reminded about this update again.

---

• If you want to rebase/retry this MR, check this box

---

This MR has been generated by Renovate Bot.

go.mod

 module git.autistici.org/ai3/go-common
 
-go 1.21.0
+go 1.23.0
 
-toolchain go1.23.1
+toolchain go1.24.3
 
 require (
 	github.com/NYTimes/gziphandler v1.1.1
@@ -11,10 +11,10 @@ require (
 	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/coreos/go-systemd/v22 v22.5.0
 	github.com/emersion/go-textwrapper v0.0.0-20200911093747-65d896831594
-	github.com/fxamacker/cbor/v2 v2.7.0
+	github.com/fxamacker/cbor/v2 v2.8.0
 	github.com/go-asn1-ber/asn1-ber v1.5.7
 	github.com/go-ldap/ldap/v3 v3.4.8
-	github.com/go-webauthn/webauthn v0.10.2
+	github.com/go-webauthn/webauthn v0.13.0
 	github.com/gofrs/flock v0.12.1
 	github.com/google/go-cmp v0.6.0
 	github.com/lunixbochs/struc v0.0.0-20200707160740-784aaebc1d40
@@ -28,7 +28,7 @@ require (
 	go.opentelemetry.io/otel/exporters/zipkin v1.9.0
 	go.opentelemetry.io/otel/sdk v1.10.0
 	go.opentelemetry.io/otel/trace v1.10.0
-	golang.org/x/crypto v0.27.0
+	golang.org/x/crypto v0.38.0
 	golang.org/x/sync v0.8.0
 )
 
@@ -39,10 +39,10 @@ require (
 	github.com/felixge/httpsnoop v1.0.3 // indirect
 	github.com/go-logr/logr v1.2.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-webauthn/x v0.1.9 // indirect
-	github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
+	github.com/go-webauthn/x v0.1.21 // indirect
+	github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
-	github.com/google/go-tpm v0.9.0 // indirect
+	github.com/google/go-tpm v0.9.5 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/klauspost/compress v1.17.9 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
@@ -54,6 +54,6 @@ require (
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	go.opentelemetry.io/otel/metric v0.31.0 // indirect
-	golang.org/x/sys v0.25.0 // indirect
+	golang.org/x/sys v0.33.0 // indirect
 	google.golang.org/protobuf v1.34.2 // indirect
 )