chore(deps): update dependency @simplewebauthn/server to v14

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@simplewebauthn/server (source)	^13.3.3 → ^14.0.2

---

Release Notes

MasterKale/SimpleWebAuthn (@​simplewebauthn/server)

v14.0.2

Compare Source

This update fixes a CVSS v3 Moderate (5.4 / 10) and a CVSS v3 Moderate (6.3 / 10) security
vulnerabilities identified in @​simplewebauthn/server. See the security advisory linked below for
more information.

Changes:

• [server] Revamped certificate revocation logic to only cryptographically verify and process
  CRLs from certificates that chained back to an RP-chosen trust anchor
  (GHSA-2g3p-m8c9-hhwh,
  GHSA-j3h4-m3m2-7p7j)

v14.0.1

Compare Source

Changes:

• [server] Attestation statements using PQC algorithms can now be verified
  (#​800)

v14.0.0

Compare Source

The headlining feature of this release is @​simplewebauthn/server gaining support for passkeys
using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those
same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44
passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers
start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for
more info 🚀

Setting our sites on the browser, @​simplewebauthn/browser picks up a new sendSignal() method
as a single method to call all of the
WebAuthn Signal APIs. See
https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x
and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim
to support Node LTS releases through their Active and Maintenance windows as tracked on
the Node.js Releases page, and aim to support Deno
minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

• [server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as
  passkey public key algorithms when the runtime supports them. In runtimes that support these PQC
  algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public
  key algorithm during registration. See
  https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info
  (#​785,
  #​794)
• [browser] The new sendSignal() method offers a simple way to invoke the
  WebAuthn Signal APIs. See
  https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info
  (#​778)
• [browser] The new browserSupportsPasskeys() helper method performs more robust WebAuthn
  support detection by also checking for typical passkey-related WebAuthn features. See
  https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys for more info
  (#​761)
• [browser] The new getBrowserCapabilities() helper method wraps WebAuthn's
  getClientCapabilities() with additional feature detection checks when possible. See
  https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities for more info
  (#​761)
• [server] verifyAuthenticationResponse() accepts an optional new expectedTopOrigin argument
  that supports cross-origin authentication verification. See
  https://simplewebauthn.dev/docs/advanced/server/cross-origin-support for more info
  (#​773)
• [server] MetadataService.initialize() accepts an optional new logger argument that can be
  used to capture MetadataService status output in a project-specific manner. See
  https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging for more info
  (#​765)
• [server] The typing of transports in excludeCredentials when calling
  generateRegistrationOptions(), and allowCredentials when calling
  generateAuthenticationOptions(), has been updated to string[] to make it easier to call these
  methods (#​776)
• [server] "tpm" attestation verification is now more tolerant of variable casing in the TPM
  manufacturer IDs (#​772)
• [server] generateRegistrationOptions() and verifyRegistrationResponse() now use the same
  default list of allowed public key algorithms for supportedAlgorithmIDs
  (#​791)
• [server] The validateCertificatePath() helper now supports x5c arrays containing
  cross-signed certificates (#​796)

Breaking Changes

• [browser] [server] The minimum supported runtime versions have been increased to Node LTS 22.x
  and higher, and Deno v2.4.x and higher
  (#​763)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 83ec807a-9775-4fad-ab6e-29c9fb4b866d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}