chore(deps)(deps): bump webauthn from 2.7.1 to 3.0.0 in /backend

[dependabot]

Bumps webauthn from 2.7.1 to 3.0.0.

Release notes

Sourced from webauthn's releases.

v3.0.0: The PQC release

Changes:

• verify_registration_response() and verify_authentication_response() now support use of PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 algorithms for credential public key signature verification (#282)
  • See https://duo-labs.github.io/py_webauthn/advanced_use_cases.html#pqc-algorithm-support for more info
• generate_registration_options() will now encourage authenticators to create keypairs using EDDSA when available, signaling acceptance of ES256 or RS256 when EDDSA is unavailable (#284)
• Responses containing malformed CBOR data with duplicate keys will now be rejected (#285)

v2.8.0

Changes:

• "android-key" attestation verification is more tolerant of X.509 leaf certificates with values that violate ASN.1 DER parsing rules (#277)
• Dependencies have been updated, including cbor2>=5.6.5,<6.0.0 (#269, h/t @​typestring; #272), and cryptography>=46.0.0 and pyOpenSSL>=26.0.0 (#278)
• Two expired trust anchors have been retired (#279)
• A new trust anchor for "android-key" attestation has been added (#268)
• TPM manufacturer IDs are now normalized during "tpm" attestation verification to prevent casing-related lookup issues (#275)
• Registration verification will more consistently raise webauthn.helpers.exceptions.InvalidRegistrationResponse when encountering bad data. Likewise, authentication verification will more consistently raise webauthn.helpers.exceptions.InvalidAuthenticationResponse when encountering bad data (#271, #273, #276, #280)
• A docstring typo in verify_authentication_response() has been fixed (#266, h/t @​Densaugeo)

v2.8.0-alpha1

🚨🚨🚨THIS RELEASE IS UNSUPPORTED. OFFICIAL PQC SUPPORT WILL ARRIVE IN A FUTURE RELEASE🚨🚨🚨

Changes:

• verify_registration_response() and verify_authentication_response() now support use of ML-DSA public keys for authenticators with PQC support. Run pip install dilithium-py to enable this capability (#260)

Changelog

Sourced from webauthn's changelog.

v3.0.0

Changes:

• verify_registration_response() and verify_authentication_response() now support use of PQC ML-DSA-44, ML-DSA-65, and ML-DSA-87 algorithms for credential public key signature verification (#282)
• generate_registration_options() will now encourage authenticators to create keypairs using EDDSA when available, signaling acceptance of ES256 or RS256 when EDDSA is unavailable (#284)
• Responses containing malformed CBOR data with duplicate keys will now be rejected (#285)

v2.8.0

Changes:

• "android-key" attestation verification is more tolerant of X.509 leaf certificates with values that violate ASN.1 DER parsing rules (#277)
• Dependencies have been updated, including cbor2>=5.6.5,<6.0.0 (#269, h/t @​typestring; #272), and cryptography>=46.0.0 and pyOpenSSL>=26.0.0 (#278)
• Two expired trust anchors have been retired (#279)
• A new trust anchor for "android-key" attestation has been added (#268)
• TPM manufacturer IDs are now normalized during "tpm" attestation verification to prevent casing-related lookup issues (#275)
• Registration verification will more consistently raise webauthn.helpers.exceptions.InvalidRegistrationResponse when encountering bad data. Likewise, authentication verification will more consistently raise webauthn.helpers.exceptions.InvalidAuthenticationResponse when encountering bad data (#271, #273, #276, #280)
• A docstring typo in verify_authentication_response() has been fixed (#266, h/t @​Densaugeo)

Commits

• 44330eb Bump version to v3.0.0
• 2a926d8 Update CHANGELOG for v3.0.0
• 4c4dbcb Merge pull request #285 from duo-labs/fix/reject-cbor-key-collision
• 6df40fb Refine CBOR encoder helper error message
• 91384ae Disallow duplicate keys in CBOR data
• 6cc7093 Upgrade to latest cbor2
• bd64a13 Merge pull request #284 from duo-labs/feat/refined-default-pub-key-algs
• b51c0a1 Add tests for new default pub key algs
• 0b104f8 Reduce default pub key algs to three most popular
• d914a48 Remove unused import
• Additional commits viewable in compare view