emdash-cms/emdash @emdash-cms/auth@0.37.0

on GitHub

Minor Changes

• #2745 b8873c7 Thanks @ascorbic! - Adds PasskeyConfig.userVerification so sites can require, prefer, or discourage passkey user verification. Existing callers keep the preferred behavior.

  Adds typed, versioned challenge contexts for registration and authentication. Declare a codec with defineChallengeContext(), bind data with bindChallengeContext() when generating options, and pass the codec with an AtomicChallengeStore to verifyAuthenticationResponse() or verifyRegistrationResponse() to recover the typed value after verification.

  Atomic challenge stores declare readonly atomic: true, so an unrelated consume() method on an existing challenge store cannot silently change its behavior. EmDash retains optional challenge context data in its database-backed challenge store.

  Authentication rejects assertions whose signature counter drops from a nonzero value to zero because the counter change can indicate a cloned authenticator.

Patch Changes

• #2864 ecdba4d Thanks @camc314! - Updates Zod to 4.5 while keeping EmDash and native plugin schemas on one compatible version. Existing minute-precision ISO datetimes remain valid, and URL content fields continue to enforce configured length and pattern rules.