chore(deps): update dependency @simplewebauthn/types to v12

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@simplewebauthn/types (source)	^10.0.0 → ^12.0.0

---

Release Notes

MasterKale/SimpleWebAuthn (@​simplewebauthn/types)

v12.0.0

Compare Source

All SimpleWebAuthn packages are now available for installation from the
JavaScript Registry (JSR)! JSR is an "open-source package registry
for modern JavaScript and TypeScript" - you can read more about this new package registry and its
ESM-centric capabilities here.

All packages in v12.0.0 are functionally identical to v11.0.0! And JSR package hosting is in
addition to existing package hosting on NPM. Nothing changes about package installation via
npm install. Read on for more information.

Packages

• @​simplewebauthn/browser@12.0.0
• @​simplewebauthn/server@12.0.0
• @​simplewebauthn/types@12.0.0

Changes

• [browser] [server] [types] All packages can now be installed from JSR wherever JSR
  imports are supported (#​634)
• [browser] Deno projects using frameworks like Fresh can now import and use
  @​simplewebauthn/browser (#​634)

To install from JSR, use npx jsr add @simplewebauthn/... or deno add jsr:@simplewebauthn/...
depending on which package manager is available.

Projects using npm for package management:

npx jsr add @simplewebauthn/browser

npx jsr add @simplewebauthn/server

npx jsr add @simplewebauthn/types

Projects using deno for package management:

deno add jsr:@simplewebauthn/browser

deno add jsr:@simplewebauthn/server

deno add jsr:@simplewebauthn/types

Projects using HTTPS modules via deno.land/x:

v12.0.0 officially deprecates importing SimpleWebAuthn from deno.land/x. See Breaking Changes
below for refactor guidance.

Breaking Changes

Importing SimpleWebAuthn packages from "https://deno.land/x/simplewebauthn/..." URLs is no longer
supported. Please use Deno's native support for JSR imports instead, available in projects running
Deno v1.42 and higher.

Before:

import { generateAuthenticationOptions } from 'https://deno.land/x/simplewebauthn/deno/server.ts';

After:

import { generateAuthenticationOptions } from 'jsr:@simplewebauthn/server';

Alternatively, use deno add to install these packages from
JSR:

# Deno v1.42 and higher
deno add jsr:@simplewebauthn/server

import { generateAuthenticationOptions } from '@simplewebauthn/server';

v11.0.0

Compare Source

Say hello to support for automatic passkey registration, support for valid conditional UI <input>
elements stashed away in web components, and to the new WebAuthnCredential type that modernizes
some logic within.

There are some breaking changes in this release! Please see Breaking Changes below for refactor
guidance.

Packages

• @​simplewebauthn/browser@11.0.0
• @​simplewebauthn/server@11.0.0
• @​simplewebauthn/types@11.0.0

Changes

• [browser] [server] A new useAutoRegister argument has been added to startRegistration() to
  support attempts to automatically register passkeys for users who just completed non-passkey auth.
  verifyRegistrationResponse() has gained a new requireUserPresence option that can be set to
  false when verifying responses from startRegistration({ useAutoRegister: true, ... })
  (#​623)
• [browser] A new verifyBrowserAutofillInput argument has been added to
  startAuthentication() to disable throwing an error when a correctly configured <input> element
  cannot be found (but perhaps a valid one is present in a web component shadow's DOM)
  (#​621)
• [server] [types] The AuthenticatorDevice type has been renamed to WebAuthnCredential and
  has had its properties renamed. The return value out of verifyRegistrationResponse() and
  corresponding inputs into verifyAuthenticationResponse() have been updated accordingly. See
  Breaking Changes below for refactor guidance
  (#​625)
• [server] verifyRegistrationResponse() now verifies that the authenticator data AAGUID
  matches the leaf cert's id-fido-gen-ce-aaguid extension AAGUID when it is present
  (#​609)
• [server] TPM attestation verification recognizes the corrected TPM manufacturer identifier for
  IBM (#​610)
• [server] Types for the defunct authenticator extensions uvm and dpk have been removed
  (#​611)

Breaking Changes

[browser] Positional arguments in startRegistration() and startAuthentication() have been replaced by a single object

Property names in the object match the names of the previously-positional arguments. To update
existing implementations, wrap existing options in an object with corresponding properties:

Before:

startRegistration(options);
startAuthentication(options, true);

After:

startRegistration({ optionsJSON: options });
startAuthentication({ optionsJSON: options, useBrowserAutofill: true });

[server] [types] The AuthenticatorDevice type has been renamed to WebAuthnCredential

AuthenticatorDevice.credentialID and AuthenticatorDevice.credentialPublicKey have been shortened
to WebAuthnCredential.id and WebAuthnCredential.publicKey respectively.

verifyRegistrationResponse() has been updated accordingly to return a new credential value of
type WebAuthnCredential. Update code that stores credentialID, credentialPublicKey, and
counter out of verifyRegistrationResponse() to store credential.id, credential.publicKey,
and credential.counter instead:

Before:

const { registrationInfo } = await verifyRegistrationResponse({...});

storeInDatabase(
  registrationInfo.credentialID,
  registrationInfo.credentialPublicKey,
  registrationInfo.counter,
  body.response.transports,
);

After:

const { registrationInfo } = await verifyRegistrationResponse({...});

storeInDatabase(
  registrationInfo.credential.id,
  registrationInfo.credential.publicKey,
  registrationInfo.credential.counter,
  registrationInfo.credential.transports,
);

Update calls to verifyAuthenticationResponse() to match the new credential argument that
replaces the authenticator argument:

Before:

import { AuthenticatorDevice } from '@simplewebauthn/types';

const authenticator: AuthenticatorDevice = {
  credentialID: ...,
  credentialPublicKey: ...,
  counter: 0,
  transports: [...],
};

const verification = await verifyAuthenticationResponse({
  // ...
  authenticator,
});

After:

import { WebAuthnCredential } from '@simplewebauthn/types';

const credential: WebAuthnCredential = {
  id: ...,
  publicKey: ...,
  counter: 0,
  transports: [...],
};

const verification = await verifyAuthenticationResponse({
  // ...
  credential,
});

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

COMPARE TO master

Total Size Diff 📉 -266 Bytes

Diff by File

Name	Diff
packages/account/package.json	0 Bytes
packages/experience/package.json	0 Bytes
pnpm-lock.yaml	📉 -266 Bytes

[github-actions]

This PR is stale because it has been open 10 for days with no activity. Remove stale label or comment or this will be closed in 5 days.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.

[Copilot]

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.

[Copilot]

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Comments suppressed due to low confidence (2)

packages/experience/package.json:39

• @simplewebauthn/browser remains on major ^10.0.0 while @simplewebauthn/types is bumped to ^12.0.0. Since these packages are typically version-coupled, this major-version mismatch can cause type incompatibilities or build-time failures. Consider upgrading @simplewebauthn/browser to the corresponding major version, or keep @simplewebauthn/types on the same major as @simplewebauthn/browser.

    "@simplewebauthn/types": "^12.0.0",

packages/account/package.json:39

• The same dependency pair (@simplewebauthn/browser / @simplewebauthn/types) is being managed in multiple package.json files. If this repo uses workspace tooling (e.g., pnpm/yarn workspaces), consider centralizing or constraining these versions (e.g., workspace protocol / overrides) to prevent future cross-package version drift.

    "@simplewebauthn/types": "^12.0.0",

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Comments suppressed due to low confidence (2)

packages/experience/package.json:39

• This bumps @simplewebauthn/types to ^12.0.0 while @simplewebauthn/browser remains at ^10.0.0. These packages are typically versioned to be used together, and mixing major versions can lead to type incompatibilities (e.g., changed type exports or structural differences). Consider aligning the @simplewebauthn/browser major version with @simplewebauthn/types, or pinning @simplewebauthn/types to the compatible major version for the currently used browser package.

    "@simplewebauthn/types": "^12.0.0",

packages/account/package.json:39

• Same concern here: @simplewebauthn/types is now ^12.0.0 while @simplewebauthn/browser is still ^10.0.0. To avoid cross-package major-version mismatches and potential type conflicts, align both packages to the same major (upgrade browser as well, or keep types on ^10.x).

    "@simplewebauthn/types": "^12.0.0",

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (2)

packages/experience/package.json:39

• @simplewebauthn/browser is still pinned to ^10.0.0 while @simplewebauthn/types is bumped to ^12.0.0. Mixing major versions in a tightly-coupled library family is likely to cause type/API mismatches. Consider upgrading @simplewebauthn/browser to a compatible major version as well (or keep types on the same major as browser) to ensure the exported types align with the runtime package.

    "@simplewebauthn/types": "^12.0.0",

packages/account/package.json:39

• @simplewebauthn/browser remains at ^10.0.0 while @simplewebauthn/types is updated to ^12.0.0. This major-version mismatch can introduce incompatible typings relative to the runtime package. Align the major versions (upgrade browser, or keep types at the browser major) so both packages stay compatible.

    "@simplewebauthn/types": "^12.0.0",

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (2)

packages/experience/package.json:38

• @simplewebauthn/browser remains on ^10.0.0 while @simplewebauthn/types is bumped to ^12.0.0. Since these packages are typically version-aligned, this major mismatch is likely to introduce TypeScript incompatibilities (changed/removed types) during compilation. Consider upgrading @simplewebauthn/browser to a compatible major version as well, or keep @simplewebauthn/types on the matching major.

    "@simplewebauthn/types": "^12.0.0",

packages/account/package.json:39

• @simplewebauthn/browser remains on ^10.0.0 while @simplewebauthn/types is bumped to ^12.0.0. This major-version mismatch commonly leads to TS type errors due to divergent API/type shapes. Align majors by upgrading @simplewebauthn/browser accordingly or keeping @simplewebauthn/types on the ^10.x line.

    "@simplewebauthn/types": "^12.0.0",

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (2)

packages/experience/package.json:39

• @simplewebauthn/types was bumped to a new major (^12) while @simplewebauthn/browser remains at major ^10. If these packages are intended to be used together, mismatched majors can cause type incompatibilities (breaking builds or requiring casts). Consider aligning both packages to the same major version (upgrade @simplewebauthn/browser accordingly, or keep types on the matching major) and only split majors if you’ve verified compatibility.

    "@simplewebauthn/browser": "^10.0.0",
    "@simplewebauthn/types": "^12.0.0",

packages/account/package.json:39

• Same concern as in packages/experience: @simplewebauthn/types@^12 alongside @simplewebauthn/browser@^10 can introduce breaking type mismatches. Recommend keeping majors aligned across these two dependencies (or documenting/validating the intentional mismatch).

    "@simplewebauthn/browser": "^10.0.0",
    "@simplewebauthn/types": "^12.0.0",

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (2)

packages/experience/package.json:39

• @simplewebauthn/types is being bumped to a new major version while @simplewebauthn/browser remains at ^10.0.0 (same section). Mixing major versions between closely related packages can lead to incompatible type definitions and compile-time errors. Prefer aligning the major versions (e.g., bump @simplewebauthn/browser to the corresponding major if compatible), or keep @simplewebauthn/types on the same major as @simplewebauthn/browser.

    "@simplewebauthn/types": "^12.0.0",

packages/account/package.json:38

• Same issue as in packages/experience: @simplewebauthn/types is upgraded to ^12 while @simplewebauthn/browser remains ^10. To avoid type/tooling mismatches, align these package majors (upgrade browser to the matching major or keep types at ^10).

    "@simplewebauthn/types": "^12.0.0",

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (3)

packages/experience/package.json:39

• @simplewebauthn/browser is still pinned to v10, but @simplewebauthn/types is bumped to v12. Since browser@10 depends on types@10 (see pnpm-lock.yaml snapshots), this introduces two major versions of @simplewebauthn/types in the workspace, which can lead to confusing or incompatible type relationships between startRegistration/startAuthentication return types and locally imported JSON types.

    "@simplewebauthn/browser": "^10.0.0",
    "@simplewebauthn/types": "^12.0.0",

packages/account/package.json:39

• @simplewebauthn/browser remains on v10 while @simplewebauthn/types is bumped to v12. Because browser@10 depends on types@10, this will install multiple majors of @simplewebauthn/types, which can cause type-level incompatibilities when combining browser APIs with types imported directly from @simplewebauthn/types.

    "@simplewebauthn/browser": "^10.0.0",
    "@simplewebauthn/types": "^12.0.0",

pnpm-lock.yaml:7618

• The lockfile update includes widespread metadata churn (e.g., adding libc fields for many platform packages) beyond the stated @simplewebauthn/types bump, which makes the PR harder to audit and may indicate a pnpm version/setting difference during lockfile regeneration.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (5)

packages/experience/package.json:39

• @simplewebauthn/browser remains on v10 while @simplewebauthn/types is bumped to v12. Since browser depends on @simplewebauthn/types@10.0.0 (see pnpm-lock.yaml), this introduces two versions of the types package and may cause TS type mismatches. Consider aligning the major versions.

    "@simplewebauthn/types": "^12.0.0",

packages/account/package.json:39

• @simplewebauthn/browser is still pinned to v10, but @simplewebauthn/types is bumped to v12. This creates two installed versions of @simplewebauthn/types (browser depends on 10.0.0 per pnpm-lock.yaml), which can lead to TypeScript type duplication/incompatibilities. Consider keeping @simplewebauthn/types aligned with the @simplewebauthn/browser major until the browser package is upgraded too.

    "@simplewebauthn/types": "^12.0.0",

pnpm-lock.yaml:13403

• The lockfile entry for the git-hosted oidc-provider dependency no longer includes an integrity hash (it switched to {gitHosted: true, tarball: ...}), which can reduce reproducibility/supply-chain verification compared to an integrity-pinned tarball. Please confirm this is an intended pnpm lockfile-format change for this repo (e.g., due to pnpm version) and that integrity verification is still enforced for git tarballs.
  pnpm-lock.yaml:9005
• pnpm-lock.yaml now flags @xmldom/xmldom@0.8.13 as deprecated with “critical issues”. Since this PR updates the lockfile, it would be good to follow up by upgrading the dependency/override that pulls this version to avoid known-bad releases.
  pnpm-lock.yaml:7902
• The newly added @simplewebauthn/types@12.0.0 entry is marked as deprecated in the lockfile. If this deprecation is accurate upstream, upgrading will introduce/keep install-time warnings and may indicate the package has moved/been superseded; please verify this update is still desired.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (2)

packages/experience/package.json:39

• @simplewebauthn/browser is still pinned to ^10.0.0, but this bumps the direct @simplewebauthn/types dependency to ^12.0.0, which results in multiple major versions of @simplewebauthn/types being installed (browser depends on @simplewebauthn/types@10.0.0 per pnpm-lock.yaml:19235-19238). This can cause TypeScript type incompatibilities between values produced by @simplewebauthn/browser and the types imported from @simplewebauthn/types. Align the major versions (upgrade @simplewebauthn/browser too, or keep @simplewebauthn/types at v10 until the browser package is upgraded).

    "@simplewebauthn/types": "^12.0.0",

packages/account/package.json:39

• @simplewebauthn/browser remains ^10.0.0 but @simplewebauthn/types is bumped to ^12.0.0, which leads to multiple major versions of @simplewebauthn/types in the dependency graph (browser depends on @simplewebauthn/types@10.0.0 per pnpm-lock.yaml:19235-19238). This can create TypeScript type mismatches. Align the major versions (upgrade @simplewebauthn/browser too, or keep @simplewebauthn/types at v10 until you can upgrade browser/server together).

    "@simplewebauthn/types": "^12.0.0",

[Copilot]

🔵 Needs a closer look

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (3)

packages/account/package.json:39

• @simplewebauthn/browser@10 depends on @simplewebauthn/types@10 (see pnpm-lock snapshot), but this package now pins @simplewebauthn/types to ^12. That results in two installed majors of @simplewebauthn/types, which can cause TypeScript type incompatibilities between the browser package’s types and the app’s imported types. Consider keeping @simplewebauthn/types on the same major as @simplewebauthn/browser unless you’re also upgrading @simplewebauthn/browser and refactoring call sites for the v11+ API.

    "@simplewebauthn/browser": "^10.0.0",
    "@simplewebauthn/types": "^12.0.0",

packages/experience/package.json:39

• @simplewebauthn/browser@10 brings in @simplewebauthn/types@10, but this package now directly depends on @simplewebauthn/types@^12, so pnpm will install both majors. To avoid split-brain types (and potential TS incompatibilities), keep @simplewebauthn/types aligned with the browser package’s major, or upgrade @simplewebauthn/browser and update code for the v11+ API changes.

    "@simplewebauthn/browser": "^10.0.0",
    "@simplewebauthn/types": "^12.0.0",

pnpm-lock.yaml:13403

• The lockfile change for the git-hosted oidc-provider tarball removed the integrity field. This weakens supply-chain verification and can reduce reproducibility; it likely indicates the lockfile was regenerated with a different pnpm version/format. Prefer keeping the integrity hash (or regenerating the lock with the repo’s standard pnpm version so integrity is preserved).

• Files reviewed: 2/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

The update introduces SimpleWebAuthn major-version skew (@simplewebauthn/browser@10 depending on @simplewebauthn/types@10 while directly installing @simplewebauthn/types@12), which can cause TypeScript incompatibilities and should be aligned or deferred.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (2)

packages/experience/package.json:39

• @simplewebauthn/types is bumped to v12 here, but this package still pins @simplewebauthn/browser to ^10.0.0. In the lockfile, @simplewebauthn/browser@10.0.0 depends on @simplewebauthn/types@10.0.0 (pnpm-lock.yaml:19214-19217), so this change installs two major versions of @simplewebauthn/types (10 and 12). That version skew can lead to TypeScript incompatibilities when values/types flow between @simplewebauthn/browser and direct @simplewebauthn/types imports. Consider upgrading the whole SimpleWebAuthn set together (browser/server/types to the same major) and updating call sites for any breaking API changes (v11+), or keep @simplewebauthn/types on ^10.0.0 until the migration is done.

    "@simplewebauthn/browser": "^10.0.0",
    "@simplewebauthn/types": "^12.0.0",

packages/account/package.json:39

• @simplewebauthn/types is bumped to v12 here, but this package still pins @simplewebauthn/browser to ^10.0.0. In the lockfile, @simplewebauthn/browser@10.0.0 depends on @simplewebauthn/types@10.0.0 (pnpm-lock.yaml:19214-19217), so this change installs two major versions of @simplewebauthn/types (10 and 12). That version skew can lead to TypeScript incompatibilities when values/types flow between @simplewebauthn/browser and direct @simplewebauthn/types imports. Consider upgrading the whole SimpleWebAuthn set together (browser/server/types to the same major) and updating call sites for any breaking API changes (v11+), or keep @simplewebauthn/types on ^10.0.0 until the migration is done.

    "@simplewebauthn/browser": "^10.0.0",
    "@simplewebauthn/types": "^12.0.0",

• Files reviewed: 2/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

The update introduces a major-version mismatch between @simplewebauthn/browser@^10 and @simplewebauthn/types@^12 (and an unused direct types dependency in @logto/account), which should be resolved to avoid fragile/duplicated type dependencies.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (1)

packages/experience/package.json:39

• @simplewebauthn/types is being bumped to v12 while @simplewebauthn/browser remains on v10. This results in multiple major versions of @simplewebauthn/types in the dependency graph (browser@10 pulls in types@10), which can lead to confusing/fragile TypeScript type interoperability between values returned from @simplewebauthn/browser and the v12 type imports used in this package. Consider upgrading @simplewebauthn/browser to the same major (and updating call sites for v11+ API changes), or keep @simplewebauthn/types on v10 until the browser package upgrade is done.

    "@simplewebauthn/browser": "^10.0.0",
    "@simplewebauthn/types": "^12.0.0",

• Files reviewed: 2/3 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

The update introduces major-version skew between @simplewebauthn/browser@10 and a direct @simplewebauthn/types@12 dependency, resulting in two installed major versions of @simplewebauthn/types and potential type/API mismatches.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (2)

packages/account/package.json:39

• This bumps only @simplewebauthn/types to v12 while keeping @simplewebauthn/browser on v10; the lockfile now installs both @simplewebauthn/types@10 (required by browser v10) and @simplewebauthn/types@12 (direct), which can lead to duplicate/overlapping type definitions and version skew across WebAuthn APIs. Consider upgrading @simplewebauthn/browser to the same major (and updating call sites for any breaking API changes), or keep @simplewebauthn/types on v10 until the browser package is upgraded.

    "@simplewebauthn/browser": "^10.0.0",
    "@simplewebauthn/types": "^12.0.0",

packages/experience/package.json:39

• This bumps only @simplewebauthn/types to v12 while keeping @simplewebauthn/browser on v10; the lockfile now installs both @simplewebauthn/types@10 (required by browser v10) and @simplewebauthn/types@12 (direct), which can lead to duplicate/overlapping type definitions and version skew across WebAuthn APIs. Consider upgrading @simplewebauthn/browser to the same major (and updating call sites for any breaking API changes), or keep @simplewebauthn/types on v10 until the browser package is upgraded.

    "@simplewebauthn/browser": "^10.0.0",
    "@simplewebauthn/types": "^12.0.0",

• Files reviewed: 2/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟢 Approval recommended

No unresolved review comments; dependency manifests and lockfile are consistent.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

• Files reviewed: 2/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

The updated @simplewebauthn/types@^12 version is now out of sync with @simplewebauthn/browser@^10, which installs multiple types versions and can cause TypeScript type incompatibilities.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Suppressed comments (2)

packages/experience/package.json:39

• @simplewebauthn/browser is still pinned to ^10.0.0 while @simplewebauthn/types is bumped to ^12.0.0. This causes pnpm to install two versions of @simplewebauthn/types (browser@10 depends on types@10), and can introduce type incompatibilities when values returned from @simplewebauthn/browser are used with types imported from @simplewebauthn/types. Consider aligning the versions by either upgrading @simplewebauthn/browser to ^12.0.0 (and refactoring for the v11+ API), or keeping @simplewebauthn/types on ^10.0.0 until the browser package is upgraded.

    "@simplewebauthn/browser": "^10.0.0",
    "@simplewebauthn/types": "^12.0.0",

packages/account/package.json:39

• @simplewebauthn/browser remains on ^10.0.0 while @simplewebauthn/types is updated to ^12.0.0. Since browser@10 depends on types@10, this results in multiple installed versions of @simplewebauthn/types and can lead to type mismatches when combining browser return values with types imported from @simplewebauthn/types. Consider upgrading @simplewebauthn/browser to ^12.0.0 (with the necessary API refactor) or keeping @simplewebauthn/types at ^10.0.0 until the browser upgrade happens.

    "@simplewebauthn/browser": "^10.0.0",
    "@simplewebauthn/types": "^12.0.0",

• Files reviewed: 2/3 changed files
• Comments generated: 0 new
• Review effort level: Lite