[dependabot]

Bumps the api-major group with 2 updates in the /api directory: @simplewebauthn/server and undici.

Updates @simplewebauthn/server from 13.3.2 to 14.0.3

Release notes

Sourced from @​simplewebauthn/server's releases.

v14.0.3

Changes:

• [server] PQC support is now lazily evaluated. This delays Node from emitting its PQC warnings from when the Node process starts to when a method is called that checks for PQC support (#809)

v14.0.2

This update fixes a CVSS v3 Moderate (5.4) security vulnerability identified in @​simplewebauthn/server. See the security advisory linked below for more information.

Changes:

• [server] Revamped certificate revocation logic to only cryptographically verify and process CRLs from certificates that chained back to an RP-chosen trust anchor (GHSA-2g3p-m8c9-hhwh)

v14.0.1

• [server] Attestation statements using PQC algorithms can now be verified (#800)

v14.0.0 - The one after they go quantum

The headlining feature of this release is @​simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @​simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

Changes:

• [server] The PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 signature algorithms are now supported as passkey public key algorithms when the runtime supports them. In runtimes that support these PQC algorithms, generateRegistrationOptions() will include ML-DSA-44 as the most preferred public key algorithm during registration. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info (#785, #794)

• [browser] The new sendSignal() method offers a simple way to invoke the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info (#778)

• [browser] The new browserSupportsPasskeys() helper method performs more robust WebAuthn support detection by also checking for typical passkey-related WebAuthn features. See https://simplewebauthn.dev/docs/packages/browser#browsersupportspasskeys for more info (#761)

• [browser] The new getBrowserCapabilities() helper method wraps WebAuthn's getClientCapabilities() with additional feature detection checks when possible. See https://simplewebauthn.dev/docs/packages/browser#getbrowsercapabilities for more info (#761)

• [server] verifyAuthenticationResponse() accepts an optional new expectedTopOrigin argument that supports cross-origin authentication verification. See https://simplewebauthn.dev/docs/advanced/server/cross-origin-support for more info (#773, h/t @​agektmr)

• [server] MetadataService.initialize() accepts an optional new logger argument that can be used to capture MetadataService status output in a project-specific manner. See https://simplewebauthn.dev/docs/advanced/server/metadata-service#logging for more info (#765)

• [server] The typing of transports in excludeCredentials when calling generateRegistrationOptions(), and allowCredentials when calling generateAuthenticationOptions(), has been updated to string[] to make it easier to call these methods (#776)

• [server] "tpm" attestation verification is now more tolerant of variable casing in the TPM manufacturer IDs (#772)

• [server] generateRegistrationOptions() and verifyRegistrationResponse() now use the same default list of allowed public key algorithms for supportedAlgorithmIDs (#791)

• [server] The validateCertificatePath() helper now supports x5c arrays containing cross-signed certificates (#796)

Breaking Changes

• [browser] [server] The minimum supported runtime versions have been increased to Node LTS 22.x and higher, and Deno v2.4.x and higher (#763)

... (truncated)

Changelog

Sourced from @​simplewebauthn/server's changelog.

v14.0.3

Changes:

• [server] PQC support is now lazily evaluated. This delays Node from emitting its PQC warnings from when the Node process starts to when a method is called that checks for PQC support (#809)

v14.0.2

This update fixes a CVSS v3 Moderate (5.4 / 10) and a CVSS v3 Moderate (6.3 / 10) security vulnerabilities identified in @​simplewebauthn/server. See the security advisory linked below for more information.

Changes:

• [server] Revamped certificate revocation logic to only cryptographically verify and process CRLs from certificates that chained back to an RP-chosen trust anchor (GHSA-2g3p-m8c9-hhwh, GHSA-j3h4-m3m2-7p7j)

v14.0.1

Changes:

• [server] Attestation statements using PQC algorithms can now be verified (#800)

v14.0.0 - The one after they go quantum

The headlining feature of this release is @​simplewebauthn/server gaining support for passkeys using the ML-DSA-44, ML-DSA-65, and ML-DSA-87 PQC algorithms in supported runtimes. And in those same supported runtimes, SimpleWebAuthn will automatically encourage registration of ML-DSA-44 passkeys to future-proof Relying Parties as PQC-capable FIDO2 authenticators and credential managers start coming to market. See https://simplewebauthn.dev/docs/advanced/server/pqc-ml-dsa-support for more info 🚀

Setting our sites on the browser, @​simplewebauthn/browser picks up a new sendSignal() method as a single method to call all of the WebAuthn Signal APIs. See https://simplewebauthn.dev/docs/packages/browser#sendsignal for more info 🛜

As for breaking changes, the minimum supported version of Node has been raised to Node LTS 22.x and higher, and Deno v2.4.x and higher. Going forward, SimpleWebAuthn will more formally aim to support Node LTS releases through their Active and Maintenance windows as tracked on the Node.js Releases page, and aim to support Deno minor releases for up to one year after their release

That's not all, though. Continue reading for the full list of changes in this release! 🎉

... (truncated)

Commits

• 084e601 Update server version to v14.0.3
• cd402cc Lazily evaluate PQC support to prevent Node warnings on startup (#809)
• 7e3c4c4 Kinda makes more sense to do the AKI check first
• 21f99a2 Update server version to v14.0.2
• f03758a Merge commit from fork
• 0bfdc3b Update server version to v14.0.1
• 4831ce2 Fix X.509 parsing to support PQC use in attestation statements (#800)
• 3e2dc0c Update version to v14.0.0
• 618c0e9 Merge v14.0.0 milestone to master (#792)
• 4b189bd Update server version to 13.3.3
• Additional commits viewable in compare view

Updates undici from 7.30.0 to 8.12.3

Release notes

Sourced from undici's releases.

v8.12.3

What's Changed

• ci: use Python 3.14 for the WPT server on macOS by @​mrityunjay-pandey in nodejs/undici#6029
• build(deps-dev): bump neostandard from 0.13.0 to 0.14.0 by @​dependabot[bot] in nodejs/undici#6006
• build(deps-dev): bump eslint from 9.39.4 to 10.12.0 by @​dependabot[bot] in nodejs/undici#5967
• docs: document the options of interceptors.cache() by @​qodelicious in nodejs/undici#6050
• fix(h2): replace a connection that stops responding after a stream timeout by @​mcollina in nodejs/undici#6052
• fix(pool): keep caller async context for queued requests by @​mcollina in nodejs/undici#5982

New Contributors

• @​qodelicious made their first contribution in nodejs/undici#6050

Full Changelog: nodejs/undici@v8.12.2...v8.12.3

v8.12.2

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Cache poisoning and cross-user disclosure through cross-origin redirects

CVE-2026-109829 · GHSA-4w7w-5xrc-9h26

When an originless Agent combined redirect and shared-cache interceptors as compose(redirect(), cache()), a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through the decompress interceptor

CVE-2026-87029 · GHSA-55wc-3pg8-jfw6

... (truncated)

Commits

• ff9cc5e Bumped v8.12.3 (#6053)
• 0bbf614 fix(pool): keep caller async context for queued requests (#5982)
• aa1eef1 fix(h2): replace a connection that stops responding after a stream timeout (#...
• e34b872 docs: document the options of interceptors.cache() (#6050)
• e8f3423 build(deps-dev): bump eslint from 9.39.4 to 10.12.0 (#5967)
• b777e40 build(deps-dev): bump neostandard from 0.13.0 to 0.14.0 (#6006)
• 43700ff ci: use Python 3.14 for the WPT server on macOS (#6029)
• bb6cc0a Bumped v8.12.2 (#6021)
• b217373 fix(websocket): bound automatic PONG writes under backpressure
• 789ef26 fix(eventsource): bound retained SSE parser state
• Additional commits viewable in compare view