chore(deps): bump @simplewebauthn/server from 11.0.0 to 13.3.1

[dependabot]

Bumps @simplewebauthn/server from 11.0.0 to 13.3.1.

Release notes

Sourced from @​simplewebauthn/server's releases.

v13.3.1

Changes:

• [server] Fixed an issue with verifyRegistrationResponse() failing to verify some Packed and SafetyNet statements (#767)

v13.3.0

• [browser] startRegistration() and startAuthentication() will recognize punycode domains as valid domains when trying to identify why an error occurred (#750)
• [server] A new verifyMDSBlob() helper method has been added to verify and extract metadata statements from FIDO MDS blobs. See the docs here for more info (#752)

v13.2.3

Changes

• [server] Dependencies have been updated to fix a "Cannot get schema" error that may occur when verifying responses after upgrading to v13.2.0+ (#747)

v13.2.2

Changes

• [browser] [server] In the spirit of contributing to increased software supply chain transparency, both libraries are now published via GitHub Actions workflows. Package listings on JSR and NPM feature build transparency logs at the bottom of their respective pages (#725, #726, #727)

v13.2.1

Changes:

• [server] generateRegistrationOptions() will now correctly encoded the userID argument to base64url when it is an instance of Node's Buffer (#724)

v13.2.0

• [server] The return value from verifyRegistrationResponse() has been defined more strictly to communicate that registrationInfo will only ever be present if verified is true (#715)
• [server] verifyRegistrationResponse() can now verify attestations containing SHA256 hashes by using EC public keys with the P-384 curve (#721)
• [server] The Android SafetyNet "CTS profile match" system integrity check can now be disabled by setting attestationSafetyNetEnforceCTSCheck: false when calling verifyRegistrationResponse(). This check remains enforced by default (#722)
• [browser] [server] These libraries now have better support in Deno 2.2+ projects which use generic typing for Uint8Array via TypeScript 5.7. SimpleWebAuthn values of type Uint8Array_ are equivalent to Uint8Array in Deno 2.1 and earlier, and Uint8Array<ArrayBuffer> in Deno 2.2 and later. (#717)

v13.1.2

Changes

• [browser] [server] Exported the ResidentKeyRequirement type to help with type inference (#704)

v13.1.1

Changes:

• [server] "android-key" attestation statement verification has been modernized (#675)
• [server] More TPM manufacturers are recognized while verifying "tpm" attestation statements (#673)

v13.1.0

Changes:

• [server] The cross-fetch dependency has been removed from the project to silence in the console DeprecationWarning's about a "punycode" module (#661)
• [browser] startRegistration() and startAuthentication() will now warn about calls made using the pre-v11 call structure to encourage refactoring to use the current call structure, but still try to handle such calls the best they can (#664)

v13.0.0 - The one where they share a type

Hot on the heels of the last major release, v13 introduces support for registration hints! Refined types and improved attestation trust anchor verification are also included. Last but not least, we say goodbye to one of the project's packages for better docs and fewer dependencies to install. Read on for more information, including refactor advice for dealing with the retirement of @​simplewebauthn/types.

... (truncated)

Changelog

Sourced from @​simplewebauthn/server's changelog.

v13.3.1

Changes:

• [server] Fixed an issue with verifyRegistrationResponse() failing to verify some Packed and SafetyNet statements (#767)

v13.3.0

Changes:

• [browser] startRegistration() and startAuthentication() will recognize punycode domains when trying to identify why an error occurred (#750)
• [server] A new verifyMDSBlob() helper method has been added to verify and extract metadata statements from FIDO MDS blobs. See the docs here for more info (#752)

v13.2.3

Changes

• [server] Dependencies have been updated to fix a "Cannot get schema" error that may occur when verifying responses after upgrading to v13.2.0+ (#747)

v13.2.2

Changes

• [browser] [server] In the spirit of contributing to increased software supply chain transparency, both libraries are now published via GitHub Actions workflows. Package listings on JSR and NPM feature build transparency logs at the bottom of their respective pages (#725, #726, #727)

v13.2.1

Changes:

• [server] generateRegistrationOptions() will now correctly encoded the userID argument to base64url when it is an instance of Node's Buffer (#724)

v13.2.0

... (truncated)

Commits

• 615538f Update version to 13.3.1
• 61601dd Ignore E2E test for now
• 6c43af7 Use attStmt.alg in Safety Net and Packed Full
• 48e19ab Update version to 13.3.0
• 6bf921e Export as a helper
• 65e87a9 Rename method to verifyMDSBlob()
• 31d8314 Clean up from mdsBlobs removal
• adf33d3 Remove mdsBlobs argument
• 2a6b4f0 Extract blob verification into new exported helper
• 972713b (Unrelated) Fix a docstring typo
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​simplewebauthn/server since your current version.

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.