deps: bump github.com/go-webauthn/webauthn from 0.17.4 to 0.18.0

[dependabot]

Bumps github.com/go-webauthn/webauthn from 0.17.4 to 0.18.0.

Release notes

Sourced from github.com/go-webauthn/webauthn's releases.

v0.18.0

0.18.0 (2026-08-27)

This release is a fairly major milestone in the development of this library. It has quite a few breaking changes but has added support for most if not all of the extension requirements natively, and adds formal support for Post-Quantum Cryptography with support for ML-DSA-44, ML-DSA-65, and ML-DSA-87 when used with go 1.27.

Details on the migration requirements for this version can be found int https://github.com/go-webauthn/webauthn/blob/HEAD/MIGRATION.md as they are substantial between ths version and prior versions.

Bug Fixes

• metadata: align members with mds 3.1.1 and ctap 2.3 (#739) (397152c)
• metadata: consistent revocation policy and client timeouts (#740) (34d324b)
• metadata: handle certificate chains of any depth (#737) (309ea69)
• metadata: honour status report order and effective dates (#736) (8be5355)
• metadata: mds3 parsing conformance and cache integrity (#735) (8115143)
• metadata: prevent panic corrupt blob (#698) (c5fd013)
• metadata: report malformed status report urls (#738) (ed82f7c)
• protocol: allow any attestation eku (#728) (f4e33fc)
• protocol: androidkey missing authorization list member (#727) (9b02b19)
• protocol: androidkey union generated (#729) (3ed3e75)
• protocol: bind credential public key curve to its algorithm (#752) (314c2be)
• protocol: compound attestation sub-statement unmarshalling (#751) (a582ecf)
• protocol: compound returns incorrect type (#731) (025d897)
• protocol: credential public key match limited to ECDSA (#732) (b4df26e)
• protocol: harden credential response and options handling (#763) (de0ae6c)
• protocol: missing tpm steps (#725) (f9a63f9)
• protocol: opaque origin matching and validation (#758) (37f065a)
• protocol: possible panic conditions (#719) (0ea14e7)
• protocol: safetynet validation steps (#726) (e12f6e8)
• protocol: single signature encoding policy and canonical der (#744) (99bbbdb)
• webauthncbor: reject data trailing the first cbor item (#762) (0801b5d)
• webauthncose: validate okp key algorithm (#759) (98c528b)
• webauthn: deprecations and handle check (#745) (8619bb9)
• webauthn: include backup flag check in registration (#748) (26a4868)
• webauthn: only update uv flag (#746) (b39c822)
• webauthn: use session relying party id (#747) (ebb45e2)

Features

• metadata: update to r46 anchor (#780) (20f33e6)
• ml-dsa preference list and gated availability (#768) (db1e068)
• protocol: client capability enumeration (#765) (62f4489)
• protocol: compound sub-statement scope (#742) (34271da)
• protocol: current user details signal constructor (#766) (b6db923)
• protocol: ecdsa attestation signature encoding policy (#743) (29404e9), closes #710
• protocol: related origins well-known document (#753) (05d54dc)
• protocol: relying party attestation policy (#741) (3239ed0)

... (truncated)

Changelog

Sourced from github.com/go-webauthn/webauthn's changelog.

0.18.0 (2026-08-27)

This release is a fairly major milestone in the development of this library. It has quite a few breaking changes but has added support for most if not all of the extension requirements natively, and adds formal support for Post-Quantum Cryptography with support for ML-DSA-44, ML-DSA-65, and ML-DSA-87 when used with go 1.27.

Details on the migration requirements for this version can be found int [MIGRATION.md] as they are substantial between ths version and prior versions.

Bug Fixes

• metadata: align members with mds 3.1.1 and ctap 2.3 (#739) (397152c)
• metadata: consistent revocation policy and client timeouts (#740) (34d324b)
• metadata: handle certificate chains of any depth (#737) (309ea69)
• metadata: honour status report order and effective dates (#736) (8be5355)
• metadata: mds3 parsing conformance and cache integrity (#735) (8115143)
• metadata: prevent panic corrupt blob (#698) (c5fd013)
• metadata: report malformed status report urls (#738) (ed82f7c)
• protocol: allow any attestation eku (#728) (f4e33fc)
• protocol: androidkey missing authorization list member (#727) (9b02b19)
• protocol: androidkey union generated (#729) (3ed3e75)
• protocol: bind credential public key curve to its algorithm (#752) (314c2be)
• protocol: compound attestation sub-statement unmarshalling (#751) (a582ecf)
• protocol: compound returns incorrect type (#731) (025d897)
• protocol: credential public key match limited to ECDSA (#732) (b4df26e)
• protocol: harden credential response and options handling (#763) (de0ae6c)
• protocol: missing tpm steps (#725) (f9a63f9)
• protocol: opaque origin matching and validation (#758) (37f065a)
• protocol: possible panic conditions (#719) (0ea14e7)
• protocol: safetynet validation steps (#726) (e12f6e8)
• protocol: single signature encoding policy and canonical der (#744) (99bbbdb)
• webauthncbor: reject data trailing the first cbor item (#762) (0801b5d)
• webauthncose: validate okp key algorithm (#759) (98c528b)
• webauthn: deprecations and handle check (#745) (8619bb9)
• webauthn: include backup flag check in registration (#748) (26a4868)
• webauthn: only update uv flag (#746) (b39c822)
• webauthn: use session relying party id (#747) (ebb45e2)

Features

• metadata: update to r46 anchor (#780) (20f33e6)
• ml-dsa preference list and gated availability (#768) (db1e068)
• protocol: client capability enumeration (#765) (62f4489)
• protocol: compound sub-statement scope (#742) (34271da)
• protocol: current user details signal constructor (#766) (b6db923)
• protocol: ecdsa attestation signature encoding policy (#743) (29404e9), closes #710
• protocol: related origins well-known document (#753) (05d54dc)
• protocol: relying party attestation policy (#741) (3239ed0)
• typed extension inputs and outputs (#734) (0661c81)

... (truncated)

Commits

• 109da34 release: v0.18.0 (#782)
• 4977ba1 docs: breaking (#781)
• f8eb85e build(deps): update github/codeql-action action to v4.37.9 (#779)
• 20f33e6 feat(metadata): update to r46 anchor (#780)
• bca8ebd test: add fuzz tests (#777)
• 9b6dffd build(deps): update github/codeql-action action to v4.37.8 (#776)
• 2190797 build: update to go 1.27 (#775)
• 97b0d9f build(deps): update dependency go to v1.27.0 (#774)
• f815453 build(deps): update module github.com/stretchr/testify to v1.12.1 (#772)
• a456bad build(deps): update go toolchain directive to v1.27.0 (#773)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)