Merge branch 'master' into milestone/v14.0.0

Author: MasterKale

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## v13.3.1
+
+**Changes:**
+
+- **[server]** Fixed an issue with `verifyRegistrationResponse()` failing to verify some Packed and
+  SafetyNet statements ([#767](https://github.com/MasterKale/SimpleWebAuthn/pull/767))
+
 ## v13.3.0
 
 **Changes:**

packages/server/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@simplewebauthn/server",
-  "version": "13.3.0",
+  "version": "13.3.1",
   "exports": {
     ".": "./src/index.ts",
     "./helpers": "./src/helpers/index.ts"

packages/server/src/registration/verifications/verifyAttestationAndroidSafetyNet.ts

@@ -148,6 +148,7 @@ export async function verifyAttestationAndroidSafetyNet(
     signature: signatureBuffer,
     data: signatureBaseBuffer,
     x509Certificate: leafCertBuffer,
+    hashAlgorithm: alg,
   });
   /**
    * END Verify Signature

packages/server/src/registration/verifications/verifyAttestationPacked.ts

@@ -157,6 +157,7 @@ export async function verifyAttestationPacked(
       signature: sig,
       data: signatureBase,
       x509Certificate: x5c[0],
+      hashAlgorithm: alg,
     });
   } else {
     verified = await verifySignature({

packages/server/src/services/metadataService.e2e.test.ts

@@ -2,7 +2,12 @@ import { assert } from '@std/assert';
 
 import { BaseMetadataService } from './metadataService.ts';
 
-Deno.test('should be able to load from FIDO MDS and get statement for YubiKey 5', async () => {
+/**
+ * This is a very expensive test to run as it involves live network traffic on each run, and can
+ * fail CI when MDS is having a bad day. I'm going to ignore it for now but keep it around as a
+ * good end-to-end test to have on-hand to run locally.
+ */
+Deno.test('should be able to load from FIDO MDS and get statement for YubiKey 5', { ignore: true }, async () => {
   const service = new BaseMetadataService();
 
   await service.initialize();