Pre-release 1.9.0-RC2

• Dependency versions moved to new meta-module webauthn-server-parent. Users should never need to depend on webauthn-server-parent directly.

Artifacts built with openjdk 11.0.10 2021-01-19.

Pre-release 1.9.0-RC1

webauthn-server-attestation:

• Fixed that SimpleAttestationResolver would return empty transports when transports are unknown.

webauthn-server-core:

• Added support for the "apple" attestation statement format.

Artifacts built with openjdk 11.0.10 2021-01-19.

Version 1.8.0

Changes:

• BouncyCastle dependency is now optional.

  In order to opt out, depend on webauthn-server-core-minimal instead of webauthn-server-core. This is not recommended unless you know your JVM includes JCA providers for all signature algorithms.

  Note that webauthn-server-attestation still depends on BouncyCastle.

• Jackson deserializer for PublicKeyCredential now allows a rawId property to be present if id is not present, or if rawId equals id.

Artifacts built with openjdk 11.0.10 2021-01-19.

Version 1.7.0

webauthn-server-attestation:

• Updated name of AAGUID 2fc0579f811347eab116bb5a8db9202a to "YubiKey 5/5C NFC"
• Changed name of "YubiKey 5 Series security key" to "YubiKey 5 Series"

webauthn-server-core:

Changes:

• Fixed crash on unknown attestation statement formats
  • Unless RelyingParty.allowUntrustedAttestation is set to false, unknown attestation statements will now pass as untrusted attestations, instead of throwing an IllegalArgumentException.
• Disambiguated Jackson deserialization of class AuthenticatorTransport

New features:

• Class RegisteredCredential can now be serialized to and deserialized from JSON.

Artifacts built with openjdk 11.0.8 2020-07-14.

Pre-release 1.7.0-RC1

Changes:

• Fixed crash on unknown attestation statement formats
  • Unless RelyingParty.allowUntrustedAttestation is set to false, unknown attestation statements will now pass as untrusted attestations, instead of throwing an IllegalArgumentException.

New features:

• Class RegisteredCredential can now be serialized to and deserialized from JSON.

Artifacts built with openjdk 11.0.8 2020-07-14.

Version 1.6.4

• Changed dependency declarations to version ranges
• Bumped Guava dependency to version [24.1.1,30) in response to CVE-2018-10237

Artifacts built with openjdk 11.0.7 2020-04-14.

Version 1.6.3

webauthn-server-attestation:

• Added new YubiKey AAGUIDs to metadata.json

webauthn-server-core:

• Bumped Jackson dependency to version 2.11.0 in response to CVEs:
  • CVE-2020-9546
  • CVE-2020-10672
  • CVE-2020-10969
  • CVE-2020-11620
• Fixed incorrect JavaDoc on AssertionResult.isSignatureCounterValid(): it will also return true if both counters are zero.

Artifacts built with openjdk 11.0.6 2020-01-14.

Pre-release 1.6.3-RC1

webauthn-server-attestation:

• Added new YubiKey AAGUIDs to metadata.json

webauthn-server-core:

• Bumped Jackson dependency to version 2.11.0 in response to CVEs:
  • CVE-2020-9546
  • CVE-2020-10672
  • CVE-2020-10969
  • CVE-2020-11620
• Fixed incorrect JavaDoc on AssertionResult.isSignatureCounterValid(): it will also return true if both counters are zero.

Artifacts built with openjdk 11.0.6 2020-01-14.

Version 1.6.2

• Fixed dependencies missing from release POM metadata

Artifacts built with openjdk 11.0.6 2020-01-14.

Version 1.6.1

Security fixes:

• Bumped Jackson dependency to version 2.9.10.3 in response to CVE-2019-20330 and CVE-2020-8840

Artifacts built with openjdk 11.0.6 2020-01-14.