Repository navigation
Bump cbor to ~> 0.6.2.2 and cose to ~> 1.4 - #523
Merged
santiagorodriguez96 merged 1 commit intoNov 10, 2026
Merged
Conversation
cose 1.4.0 requires cbor ~> 0.6.2.2, so both are bumped together. The full test suite passes against the new versions. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
santiagorodriguez96
approved these changes
Nov 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps two runtime dependencies:
cborfrom~> 0.5.9to~> 0.6.2.2cosefrom~> 1.1to~> 1.4cose 1.4.0 requires
cbor ~> 0.6.2.2, so the two move together.Compatibility
No webauthn source changes are needed.
cbor 0.5.9 → 0.6.2.2: the notable behavior change is that CBOR tags
32 (URI) and 35 (Regexp) now decode to a generic
CBOR::Taggedvalueinstead of being reconstructed into
URI/Regexpobjects. webauthn onlydecodes WebAuthn structures (attestation objects, authenticator data,
COSE keys), which are maps and arrays of integers and byte strings. It
never relies on URI/Regexp tag reconstruction, so this has no effect.
cose 1.3.1 → 1.4.0: the only library changes are internal correctness
fixes (stricter RSA-PSS key
algvalidation, and rebuilding theverification context per signature in
COSE::Sign, which webauthn doesnot use).
The full test suite passes against the new versions (514 examples, 0
failures).