Skip to content

[deps] Auth: Update Fido2.AspNet to v4#6328

Open
renovate[bot] wants to merge 2 commits intomainfrom
renovate/fido2.aspnet-4.x
Open

[deps] Auth: Update Fido2.AspNet to v4#6328
renovate[bot] wants to merge 2 commits intomainfrom
renovate/fido2.aspnet-4.x

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Sep 15, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
Fido2.AspNet 3.0.1 → 4.0.0 age confidence

Release Notes

passwordless-lib/fido2-net-lib (Fido2.AspNet)

v4.0.0: - At last

I believe it's finally time to ship a new stable version, after shipping 17 betas of the 4.0.0 branch.

4.0 contains lots of breaking changes to the API, but also contains support for modern .net features and a lot of cleanups in terms of the webauthn implementation.

We wanted to include some refreshments to our MDS implementation and use of cache -- but we're punting it to a future release.

Here's a migration guide, authored by claude ai to get you started: https://github.com/passwordless-lib/fido2-net-lib/blob/main/Documentation/migration-guide-4.0.0.md

What's Changed

New Contributors

Full Changelog: passwordless-lib/fido2-net-lib@v3.0.1...4.0.0

Configuration

📅 Schedule: Branch creation - "every 2nd week starting on the 2 week of the year before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested review from a team and rr-bw September 15, 2025 03:06
@bitwarden-bot bitwarden-bot changed the title [deps] Auth: Update Fido2.AspNet to v4 [PM-25806] [deps] Auth: Update Fido2.AspNet to v4 Sep 15, 2025
@bitwarden-bot
Copy link

bitwarden-bot commented Sep 15, 2025

Internal tracking:

@renovate renovate bot changed the title [PM-25806] [deps] Auth: Update Fido2.AspNet to v4 [deps] Auth: Update Fido2.AspNet to v4 Sep 15, 2025
@rr-bw rr-bw requested review from ike-kottlowski and removed request for rr-bw September 16, 2025 15:40
@abergs
Copy link
Member

abergs commented Sep 17, 2025

Yeah this version bump requires a few updates to the interfaces. We probably need a ticket to track this work @ike-kottlowski.

@renovate renovate bot force-pushed the renovate/fido2.aspnet-4.x branch from 6f7015d to bd877ec Compare October 21, 2025 13:46
@renovate renovate bot force-pushed the renovate/fido2.aspnet-4.x branch from bd877ec to 883990c Compare November 10, 2025 15:33
@renovate renovate bot force-pushed the renovate/fido2.aspnet-4.x branch from 883990c to c47df81 Compare November 18, 2025 14:35
@renovate renovate bot added the major-update label Dec 3, 2025
@renovate renovate bot force-pushed the renovate/fido2.aspnet-4.x branch from c47df81 to 731abf8 Compare February 2, 2026 15:44
@ike-kottlowski ike-kottlowski added the ai-review Request a Claude code review label Feb 5, 2026
@claude
Copy link
Contributor

claude bot commented Feb 10, 2026 •
edited
Loading

Claude finished @renovate[bot]'s task in 1m 55s —— View job

Code Review Summary

Reviewed PR: [deps] Auth: Update Fido2.AspNet to v4 (#6328)

Overview

This Renovate-generated PR updates the Fido2.AspNet package from 3.0.1 to 4.0.0. The change is limited to a single line in src/Core/Core.csproj.

Assessment

This PR is incomplete and will not build in its current state.

As noted by @abergs, Fido2.AspNet 4.0.0 contains numerous breaking API changes. The version bump alone, without corresponding code updates, will cause compilation failures.

Breaking Changes Requiring Migration

Based on analysis of the codebase's Fido2 usage (21 files), the following breaking changes from the migration guide will require attention:

1. Status/ErrorMessage properties removed
The result types no longer have Status and ErrorMessage properties. Failures now throw Fido2VerificationException. Affected files:

  • /home/runner/work/server/server/src/Core/Auth/Identity/TokenProviders/WebAuthnTokenProvider.cs (line 122: res.Status == "ok")
  • /home/runner/work/server/server/src/Core/Auth/UserFeatures/WebAuthnLogin/Implementations/AssertWebAuthnLoginCredentialCommand.cs (lines 56-58: assertionVerificationResult.Status != "ok")

2. API method signature changes
Methods like RequestNewCredential, GetAssertionOptions, MakeNewCredentialAsync, and MakeAssertionAsync have updated signatures with wrapped parameter objects.

3. Type changes

  • CredentialMakeResult renamed to MakeNewCredentialResult
  • byte[] to Base64Url type changes for credential IDs
  • AaGuid is now a strongly typed struct

4. Callback delegate changes
IsCredentialIdUniqueToUserAsyncDelegate and IsUserHandleOwnerOfCredentialIdAsync may have updated signatures.

Files Requiring Updates

The following files use Fido2 types and will likely need modification:

  • src/Core/Auth/Identity/TokenProviders/WebAuthnTokenProvider.cs
  • src/Core/Auth/UserFeatures/WebAuthnLogin/Implementations/*Command.cs (4 files)
  • src/Core/Auth/UserFeatures/WebAuthnLogin/I*Command.cs (4 interface files)
  • src/Core/Services/Implementations/UserService.cs
  • src/Core/Auth/Models/TwoFactorProvider.cs
  • src/Api/Auth/Controllers/TwoFactorController.cs
  • Various request/response models

Recommendation

This PR should remain open as a tracking mechanism but requires significant implementation work before merging. The migration should:

  1. Update all Fido2 API call sites to match the new 4.0 signatures
  2. Replace Status == "ok" checks with try-catch for Fido2VerificationException
  3. Update type usages for renamed/changed types
  4. Add or update unit tests to cover the migration changes
  5. Verify WebAuthn registration and authentication flows work end-to-end

The internal ticket (PM-25806) should track this implementation work.

Automated code review by Claude

@renovate
Copy link
Contributor Author

renovate bot commented Feb 10, 2026

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@github-actions
Copy link
Contributor

github-actions bot commented Feb 10, 2026

Logo
Checkmarx One – Scan Summary & Details – 9191bf3a-d80d-421d-abb4-bd39569ab083

Great job! No new security vulnerabilities introduced in this pull request

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ike-kottlowski ike-kottlowski Awaiting requested review from ike-kottlowski

@abergs abergs Awaiting requested review from abergs

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

ai-review Request a Claude code review major-update

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@bitwarden-bot @abergs @ike-kottlowski