Skip to content

Bugfix/19657 passkeys and algorithms - #19660

Merged
brandonkelly merged 5 commits into
5.xfrom
bugfix/19657-passkeys-and-algorithms
Sep 18, 2026
Merged

brandonkelly merged 5 commits into
5.xfrom
bugfix/19657-passkeys-and-algorithms

Conversation

@i-just

@i-just i-just commented Sep 18, 2026

Copy link
Copy Markdown
Contributor

Description

webauthn-lib: 5.3.9 updated cbor-php and cose-lib dependencies to ^3.4 and ^4.8 respectively.
cose-lib: 4.8.0 started emitting warnings when non-standard ED256 and ED512 algorithms are used.

To minimise the impact of this change, I’ve:

  • set the non-standard acknowledgement for ED256
  • removed ED256 from the list of algorithms that are used during creation of passkeys, so that no new passkeys are created using it
  • cleaned up a list of algorithms used for verification so that it matches a list used for passkey creation (the list of algorithms used for passkey creation hasn’t changed since this feature was released in 5.0.0)

Since removing ED256 from the list of verification algorithms would render any passkeys created with that algorithm invalid, we should only drop that option in either 5.12 or 6.0. Hopefully, since that option was always last on the list, there shouldn’t be many of those.

Related issues

#19657

@brandonkelly
brandonkelly merged commit 13e60e9 into 5.x Sep 18, 2026
2 checks passed
@brandonkelly
brandonkelly deleted the bugfix/19657-passkeys-and-algorithms branch September 18, 2026 16:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants