I believe it's finally time to ship a new stable version, after shipping 17 betas of the 4.0.0 branch.

4.0 contains lots of breaking changes to the API, but also contains support for modern .net features and a lot of cleanups in terms of the webauthn implementation.

We wanted to include some refreshments to our MDS implementation and use of cache -- but we're punting it to a future release.

What's Changed

• Added draft of Vulnerability Disclosure Program by @abergs in Added draft of Vulnerability Disclosure Program #315
• Format Tests by @iamcarbon in Format Tests #320
• fix: usernameless demos by @imqdee in fix: usernameless demos #324
• Improve exception handling by @iamcarbon in Improve exception handling #323
• Improve Code Quality by @iamcarbon in Improve Code Quality #326
• Updated sourcelink by @abergs in Updated sourcelink #327
• Fix serialization error in Demo. Fixes On .Net 6, the System.Json.Text serializer now seems to choke on the return value in the MakeAssertion function. #328 by @abergs in Fix serialization error in Demo. Fixes #328 #329
• added [DynamicallyAccessedMembers(DynamicallyAccessedMemberTypes.PublicFields)] annotations to generic enums by @filipw in added [DynamicallyAccessedMembers(DynamicallyAccessedMemberTypes.PublicFields)] annotations to generic enums #330
• Check return value from Base64.DecodeFromUtf8InPlace(), throw if error by @aseigler in Check return value from Base64.DecodeFromUtf8InPlace(), throw if error #331
• Implement support for apple-appattest attestation format by @aseigler in Implement support for apple-appattest attestation format #322
• Add Mac and Linux to test pipeline by @aseigler in Add Mac and Linux to test pipeline #332
• Pipelines fixes by @abergs in Pipelines fixes #333
• Support ResidentKeyRequirement by @dIeGoLi in Support ResidentKeyRequirement #311
• Use file scoped namespaces by @iamcarbon in Use file scoped namespaces #343
• Fix TestAppleAppAttestProd test on macOS & Linux by @iamcarbon in Fix TestAppleAppAttestProd test on macOS & Linux #347
• Fixed clientDataJSON name by @namespacedevbox in Fixed clientDataJSON name #348
• Improve error handling by @iamcarbon in Improve error handling #344
• Update link in Readme by @mlh758 in Update link in Readme #354
• Update tests to get clean CI by @aseigler in Update tests to get clean CI #355
• Fixes Fido2Configuration.FullyQualifiedOrigins contains a null entry when configured from a configuration section on .NET 7 in Fixes Fido2Configuration.FullyQualifiedOrigins contains a null entry when configured from a configuration section on .NET 7 #360
• Improve Code Quality by @iamcarbon in Improve Code Quality #352
• Fix Conformance Test by @iamcarbon in Fix Conformance Test #363
• Strongly type AaGuid by @iamcarbon in Strongly type AaGuid #362
• SourceLink consolidation by @Regenhardt in SourceLink consolidation #384
• WIP: Support device public key and passkeys by @aseigler in WIP: Support device public key and passkeys #356
• Simplify enum mapping & update specification links by @iamcarbon in Simplify enum mapping & update specification links #368
• Make Origins readonly by @Regenhardt in Make Origins readonly #393
• Feature/blazor wasm by @Regenhardt in Feature/blazor wasm #379
• Use correct Origin in Blazor example by @abergs in Use correct Origin in Blazor example #408
• Support for PRF Extension by @kspearrin in Support for PRF Extension #390
• Improve Code Quality by @iamcarbon in Improve Code Quality #405
• Fix demo project starting exception: change TargetFrameworks to TargetFramework by @yedidyas in Fix demo project starting exception: change TargetFrameworks to TargetFramework #403
• Fix AuthenticationExtensionsClientInputs Example json prop name for conformance tests by @yedidyas in Fix AuthenticationExtensionsClientInputs Example json prop name for conformance tests #404
• [WIP] Make AuthenticatorData immutable and strongly type throughout library by @iamcarbon in [WIP] Make AuthenticatorData immutable and strongly type throughout library #412
• Add .bool to Output aswell by @abergs in Add .bool to Output aswell #409
• Added Enterprise attestation by @abergs in Added Enterprise attestation #410
• Prefer Ed25519 when available by @abergs in Prefer Ed25519 when available #413
• Add CredentialPropertiesOuput (RK Support) by @abergs in Add CredentialPropertiesOuput (RK Support) #411
• Enable C# 11 and embed base64 encoded certificates as UTF-8 data by @iamcarbon in Enable C# 11 and embed base64 encoded certificates as UTF-8 data #414
• Cleanup by @iamcarbon in Cleanup #417
• Improve Code Quality by @iamcarbon in Improve Code Quality #421
• [WIP] Improve Code Quality by @iamcarbon in [WIP] Improve Code Quality #422
• dotnet format by @abergs in dotnet format #425
• Breakout development services & improve naming by @iamcarbon in Breakout development services & improve naming #427
• Add smart-card and hybrid transports by @dbeinder in Add smart-card and hybrid transports #430
• Use DateTimeOffset by @joegoldman2 in Use DateTimeOffset #434
• Remove AuthenticatorSelection extension by @joegoldman2 in Remove AuthenticatorSelection extension #435
• Rename Fido2NetLib.cs file to Fido2.cs in order to match with the class name by @joegoldman2 in Rename Fido2NetLib.cs file to Fido2.cs in order to match with the class name #438
• Update to latest version of FIDO Metadata Service by @joegoldman2 in Update to latest version of FIDO Metadata Service #442
• Fix GitHub repository url by @joegoldman2 in Fix GitHub repository url #451
• Update System.IdentityModel.Tokens.Jwt and xunit by @iamcarbon in Update System.IdentityModel.Tokens.Jwt and xunit #431
• Rename CredentialMakeResult to MakeNewCredentialResult and adjust its namespace by @joegoldman2 in Rename CredentialMakeResult to MakeNewCredentialResult and adjust its namespace #433
• Remove hardcoded Metadata Service BLOB url to allow users to override it by @joegoldman2 in Remove hardcoded Metadata Service BLOB url to allow users to override it #444
• Add some missing comments on public methods by @joegoldman2 in Add some missing comments on public methods #440
• Rename AuthenticatorAttestationRawResponse.ResponseData to AttestationResponse by @joegoldman2 in Rename AuthenticatorAttestationRawResponse.ResponseData to AttestationResponse #455
• Rename clientDataJson to clientDataJSON by @joegoldman2 in Rename clientDataJson to clientDataJSON #450
• Align MSBuild properties across all projects by @joegoldman2 in Align MSBuild properties across all projects #437
• Update timeout data type to ulong by @joegoldman2 in Update timeout data type to ulong #462
• Rename origChallenge parameter in Fido2.MakeNewCredentialAsync by @joegoldman2 in Rename origChallenge parameter in Fido2.MakeNewCredentialAsync #460
• Added github workflow for building, testing and packing by @abergs in Added github workflow for building, testing and packing #464
• Removed publishing step from PRs by @abergs in Removed publishing step from PRs #475
• Use net8.0 SDK by @iamcarbon in Use net8.0 SDK #468
• Map authenticator transports on server side by @joegoldman2 in Map authenticator transports on server side #453
• List<PublicKeyCredentialDescriptor>/IEnumerable<PublicKeyCredentialDescriptor> to IReadOnlyList<PublicKeyCredentialDescriptor> by @joegoldman2 in List<PublicKeyCredentialDescriptor>/IEnumerable<PublicKeyCredentialDescriptor> to IReadOnlyList<PublicKeyCredentialDescriptor> #447
• Update AttestationVerifier api to Async by @iamcarbon in Update AttestationVerifier api to Async #458
• Remove binary serialization by @iamcarbon in Remove binary serialization #465
• Change List<byte[]> storedDevicePublicKeys to IReadOnlyList<byte[]> by @joegoldman2 in Change List<byte[]> storedDevicePublicKeys to IReadOnlyList<byte[]> #477
• Publish packages to nuget by @abergs in Publish packages to nuget #479
• Pubhlish to nuget by @abergs in Pubhlish to nuget #481
• Pubhlish to nuget by @abergs in Pubhlish to nuget #483
• Pubhlish to nuget by @abergs in Pubhlish to nuget #484
• Rename 'extensions' to 'clientExtensionResults' for deserialization by @jonashendrickx in Rename 'extensions' to 'clientExtensionResults' for deserialization #474
• Rename extensions to clientExtensionResults by @joegoldman2 in Rename extensions to clientExtensionResults #485
• [Draft] Add credProtect extension to Fido2.Models by @dbeinder in [Draft] Add credProtect extension to Fido2.Models #448
• Migrate to Microsoft.IdentityModel.JsonWebTokens by @iamcarbon in Migrate to Microsoft.IdentityModel.JsonWebTokens #476
• Tidy up tests by @iamcarbon in Tidy up tests #494
• Review lifecycle of services registered in the DI container by @joegoldman2 in Review lifecycle of services registered in the DI container #459
• Drop assertion-time attestation by @joegoldman2 in Drop assertion-time attestation #499
• Generate XML documentation file by @joegoldman2 in Generate XML documentation file #502
• Tidying by @iamcarbon in Tidying #500
• Update to .NET 8 by @joegoldman2 in Update to .NET 8 #503
• Rename Base64Converter.cs to Base64UrlConverter.cs by @joegoldman2 in Rename Base64Converter.cs to Base64UrlConverter.cs #506
• NuGet.org signatures have been updated - Fix Build by @jonashendrickx in NuGet.org signatures have been updated - Fix Build #525
• Added authenticatorDisplayName to ClientPropertiesOutput by @aritma-fredrikef in Added authenticatorDisplayName to ClientPropertiesOutput #526
• Improve Code Quality by @iamcarbon in Improve Code Quality #509
• Add support for largeBlob extension by @geel9 in Add support for largeBlob extension #508
• Missing nullable enable due to merges by @abergs in Missing nullable enable due to merges #527
• Implement PublicKeyCredentialHint for WebAuthn L3 by @jonashendrickx in Implement PublicKeyCredentialHint for WebAuthn L3 #524
• Resolve StoredCredential.Descriptor at access(?) by @abergs in Resolve StoredCredential.Descriptor at access(?) #528
• Remove base-class, Status and ErrorMessage by @abergs in Remove base-class, Status and ErrorMessage #529
• Update MetadataStatement to include friendly names by @joegoldman2 in Update MetadataStatement to include friendly names #544
• conformance 1.7.20 4 by @abergs in conformance 1.7.20 4 #531
• Fixing demo project makeAssertionOptions.status processing by @Fasjeit in Fixing demo project makeAssertionOptions.status processing #551
• Move Test folder to Tests/Fido2.Tests by @joegoldman2 in Move Test folder to Tests/Fido2.Tests #549
• Various cleanup by @joegoldman2 in Various cleanup #558
• Wrap arguments into classes by @abergs in Wrap arguments into classes #556
• README.md Medium link fixed by @jiiggy in README.md Medium link fixed #539
• Supporting attestation formats by @jonashendrickx in Supporting attestation formats #530
• Drop support for device public key (dpk) by @abergs in Drop support for device public key (dpk) #567
• Update Dependencies by @iamcarbon in Update Dependencies #569
• Change TPM manufacturer sting comparison handling by @aseigler in Change TPM manufacturer sting comparison handling #568
• Move KeyTypeParameter validation from CredentialPublicKey.Verify() into constructors by @aseigler in Move KeyTypeParameter validation from CredentialPublicKey.Verify() into constructors #571
• use coerceToArrayBuffer to post-process assertion options in Demo js by @dradovic in use coerceToArrayBuffer to post-process assertion options in Demo js #467
• AuthenticatorSelection Default to discourage UV by @abergs in AuthenticatorSelection Default to discourage UV #564
• Fix attestationObj camelCase by @abergs in Fix attestationObj camelCase #576
• Change AuthenticatorSelection.Default ResidentKey from discouraged to Preferred by @abergs in Change AuthenticatorSelection.Default ResidentKey from discouraged to Preferred #563
• Use BCL Base64Url implementation by @iamcarbon in Use BCL Base64Url implementation #575
• Introduce wrapping objects for Options-methods by @abergs in Introduce wrapping objects for Options-methods #562
• Explain EnableRelaxedDecoding by @abergs in Explain EnableRelaxedDecoding #578
• Allow customised pubKeyCredParams by @abergs in Allow customised pubKeyCredParams #579
• [Models] Enable nullable (1 of x) by @iamcarbon in [Models] Enable nullable (1 of x) #581
• [Models] Enable nullable (2 of 2) by @iamcarbon in [Models] Enable nullable (2 of 2) #585
• Update Github actions by @Regenhardt in Update Github actions #590
• Base64Url Id instead of byte[] by @Regenhardt in Base64Url Id instead of byte[] #586
• Update Dependencies by @ektrah in Update Dependencies #595
• Allow github push to fail while pushing to nuget by @abergs in Allow github push to fail while pushing to nuget #596
• fix nuget force by @abergs in fix nuget force #597
• Conformance fix: Remove trustpath subject-issuer comparison by @abergs in Conformance fix: Remove trustpath subject-issuer comparison #555

New Contributors

• @imqdee made their first contribution in fix: usernameless demos #324
• @filipw made their first contribution in added [DynamicallyAccessedMembers(DynamicallyAccessedMemberTypes.PublicFields)] annotations to generic enums #330
• @namespacedevbox made their first contribution in Fixed clientDataJSON name #348
• @mlh758 made their first contribution in Update link in Readme #354
• @Regenhardt made their first contribution in SourceLink consolidation #384
• @kspearrin made their first contribution in Support for PRF Extension #390
• @yedidyas made their first contribution in Fix demo project starting exception: change TargetFrameworks to TargetFramework #403
• @dbeinder made their first contribution in Add smart-card and hybrid transports #430
• @joegoldman2 made their first contribution in Use DateTimeOffset #434
• @jonashendrickx made their first contribution in Rename 'extensions' to 'clientExtensionResults' for deserialization #474
• @aritma-fredrikef made their first contribution in Added authenticatorDisplayName to ClientPropertiesOutput #526
• @geel9 made their first contribution in Add support for largeBlob extension #508
• @Fasjeit made their first contribution in Fixing demo project makeAssertionOptions.status processing #551
• @jiiggy made their first contribution in README.md Medium link fixed #539
• @dradovic made their first contribution in use coerceToArrayBuffer to post-process assertion options in Demo js #467
• @ektrah made their first contribution in Update Dependencies #595

Full Changelog: v3.0.1...4.0.0