Repository: go-webauthn/webauthn
Pull request #415 (2025-04-28 23:13:11)

build(deps): update module github.com/google/go-tpm to v0.9.4
This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [github.com/google/go-tpm](https://redirect.github.com/google/go-tpm) | `v0.9.3` -> `v0.9.4` | [![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgoogle%2fgo-tpm/v0.9.4?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/go/github.com%2fgoogle%2fgo-tpm/v0.9.4?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/go/github.com%2fgoogle%2fgo-tpm/v0.9.3/v0.9.4?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgoogle%2fgo-tpm/v0.9.3/v0.9.4?slim=true)](https://docs.renovatebot.com/merge-confidence/) |

---

### Release Notes

<details>
<summary>google/go-tpm (github.com/google/go-tpm)</summary>

### [`v0.9.4`](https://redirect.github.com/google/go-tpm/releases/tag/v0.9.4)

[Compare Source](https://redirect.github.com/google/go-tpm/compare/v0.9.3...v0.9.4)

#### What's Changed

-   Tolerate differences in RSA private key libraries by [@&#8203;chrisfenner](https://redirect.github.com/chrisfenner) in [https://github.com/google/go-tpm/pull/383](https://redirect.github.com/google/go-tpm/pull/383)
-   Add TPM2\_HMAC implementation by [@&#8203;ludi317](https://redirect.github.com/ludi317) in [https://github.com/google/go-tpm/pull/385](https://redirect.github.com/google/go-tpm/pull/385)
-   Improve TPMUSymKeyBits and TPMUSymMode by [@&#8203;AlexandreEXFO](https://redirect.github.com/AlexandreEXFO) in [https://github.com/google/go-tpm/pull/384](https://redirect.github.com/google/go-tpm/pull/384)
-   Implement TCP TPM protocol by [@&#8203;chrisfenner](https://redirect.github.com/chrisfenner) in [https://github.com/google/go-tpm/pull/387](https://redirect.github.com/google/go-tpm/pull/387)
-   tpm2: Fix typo in MakeCredential cmd by [@&#8203;loicsikidi](https://redirect.github.com/loicsikidi) in [https://github.com/google/go-tpm/pull/391](https://redirect.github.com/google/go-tpm/pull/391)
-   TPM2\_PCR_Allocate support by [@&#8203;zhsh](https://redirect.github.com/zhsh) in [https://github.com/google/go-tpm/pull/394](https://redirect.github.com/google/go-tpm/pull/394)
-   Check for padding bytes in EK cert by [@&#8203;dwaynebradley](https://redirect.github.com/dwaynebradley) in [https://github.com/google/go-tpm/pull/397](https://redirect.github.com/google/go-tpm/pull/397)
-   add support for ECMQV by [@&#8203;chrisfenner](https://redirect.github.com/chrisfenner) in [https://github.com/google/go-tpm/pull/399](https://redirect.github.com/google/go-tpm/pull/399)

#### New Contributors

-   [@&#8203;ludi317](https://redirect.github.com/ludi317) made their first contribution in [https://github.com/google/go-tpm/pull/385](https://redirect.github.com/google/go-tpm/pull/385)
-   [@&#8203;loicsikidi](https://redirect.github.com/loicsikidi) made their first contribution in [https://github.com/google/go-tpm/pull/391](https://redirect.github.com/google/go-tpm/pull/391)
-   [@&#8203;zhsh](https://redirect.github.com/zhsh) made their first contribution in [https://github.com/google/go-tpm/pull/394](https://redirect.github.com/google/go-tpm/pull/394)
-   [@&#8203;dwaynebradley](https://redirect.github.com/dwaynebradley) made their first contribution in [https://github.com/google/go-tpm/pull/397](https://redirect.github.com/google/go-tpm/pull/397)

**Full Changelog**: https://github.com/google/go-tpm/compare/v0.9.3...v0.9.4

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/go-webauthn/webauthn).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNTcuMyIsInVwZGF0ZWRJblZlciI6IjM5LjI1Ny4zIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImdvIl19-->


coderabbitai[bot]: <!-- This is an auto-generated comment: summarize by coderabbit.ai -->
<!-- This is an auto-generated comment: skip review by coderabbit.ai -->

> [!IMPORTANT]
> ## Review skipped
> 
> Bot user detected.
> 
> To trigger a single review, invoke the `@coderabbitai review` command.
> 
> You can disable this status message by setting the `reviews.review_status` to `false` in the CodeRabbit configuration file.

<!-- end of auto-generated comment: skip review by coderabbit.ai -->
<!-- tips_start -->

---



<details>
<summary>🪧 Tips</summary>

### Chat

There are 3 ways to chat with [CodeRabbit](https://coderabbit.ai?utm_source=oss&utm_medium=github&utm_campaign=go-webauthn/webauthn&utm_content=415):

- Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  - `I pushed a fix in commit <commit_id>, please review it.`
  - `Generate unit testing code for this file.`
  - `Open a follow-up GitHub issue for this discussion.`
- Files and specific lines of code (under the "Files changed" tab): Tag `@coderabbitai` in a new review comment at the desired location with your query. Examples:
  - `@coderabbitai generate unit testing code for this file.`
  -	`@coderabbitai modularize this function.`
- PR comments: Tag `@coderabbitai` in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  - `@coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.`
  - `@coderabbitai read src/utils.ts and generate unit testing code.`
  - `@coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.`
  - `@coderabbitai help me debug CodeRabbit configuration file.`

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

### CodeRabbit Commands (Invoked using PR comments)

- `@coderabbitai pause` to pause the reviews on a PR.
- `@coderabbitai resume` to resume the paused reviews.
- `@coderabbitai review` to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
- `@coderabbitai full review` to do a full review from scratch and review all the files again.
- `@coderabbitai summary` to regenerate the summary of the PR.
- `@coderabbitai generate sequence diagram` to generate a sequence diagram of the changes in this PR.
- `@coderabbitai resolve` resolve all the CodeRabbit review comments.
- `@coderabbitai configuration` to show the current CodeRabbit configuration for the repository.
- `@coderabbitai help` to get help.

### Other keywords and placeholders

- Add `@coderabbitai ignore` anywhere in the PR description to prevent this PR from being reviewed.
- Add `@coderabbitai summary` to generate the high-level summary at a specific location in the PR description.
- Add `@coderabbitai` anywhere in the PR title to generate the title automatically.

### CodeRabbit Configuration File (`.coderabbit.yaml`)

- You can programmatically configure CodeRabbit by adding a `.coderabbit.yaml` file to the root of your repository.
- Please see the [configuration documentation](https://docs.coderabbit.ai/guides/configure-coderabbit) for more information.
- If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: `# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json`

### Documentation and Community

- Visit our [Documentation](https://docs.coderabbit.ai) for detailed information on how to use CodeRabbit.
- Join our [Discord Community](http://discord.gg/coderabbit) to get help, request features, and share feedback.
- Follow us on [X/Twitter](https://twitter.com/coderabbitai) for updates and announcements.

</details>

<!-- tips_end -->

Patch:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e69b5f0..fddb754 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -50,7 +50,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
+        uses: github/codeql-action/init@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3.28.17
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -60,7 +60,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
+        uses: github/codeql-action/autobuild@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3.28.17
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -73,6 +73,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
+        uses: github/codeql-action/analyze@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3.28.17
         with:
           category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index 6033b12..770b22b 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -71,6 +71,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
+        uses: github/codeql-action/upload-sarif@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3.28.17
         with:
           sarif_file: results.sarif
diff --git a/go.mod b/go.mod
index 5b2d3f4..396ba10 100644
--- a/go.mod
+++ b/go.mod
@@ -2,13 +2,13 @@ module github.com/go-webauthn/webauthn
 
 go 1.23.0
 
-toolchain go1.24.2
+toolchain go1.24.3
 
 require (
 	github.com/fxamacker/cbor/v2 v2.8.0
 	github.com/go-webauthn/x v0.1.20
 	github.com/golang-jwt/jwt/v5 v5.2.2
-	github.com/google/go-tpm v0.9.3
+	github.com/google/go-tpm v0.9.4
 	github.com/google/uuid v1.6.0
 	github.com/mitchellh/mapstructure v1.5.0
 	github.com/stretchr/testify v1.10.0
diff --git a/go.sum b/go.sum
index 0ec6084..66458bf 100644
--- a/go.sum
+++ b/go.sum
@@ -6,8 +6,8 @@ github.com/go-webauthn/x v0.1.20 h1:brEBDqfiPtNNCdS/peu8gARtq8fIPsHz0VzpPjGvgiw=
 github.com/go-webauthn/x v0.1.20/go.mod h1:n/gAc8ssZJGATM0qThE+W+vfgXiMedsWi3wf/C4lld0=
 github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
 github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
-github.com/google/go-tpm v0.9.3 h1:+yx0/anQuGzi+ssRqeD6WpXjW2L/V0dItUayO0i9sRc=
-github.com/google/go-tpm v0.9.3/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
+github.com/google/go-tpm v0.9.4 h1:awZRf9FwOeTunQmHoDYSHJps3ie6f1UlhS1fOdPEt1I=
+github.com/google/go-tpm v0.9.4/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
diff --git a/protocol/const.go b/protocol/const.go
index a1560f2..210f82b 100644
--- a/protocol/const.go
+++ b/protocol/const.go
@@ -9,3 +9,13 @@ const (
 	stmtCertInfo  = "certInfo"
 	stmtPubArea   = "pubArea"
 )
+
+var (
+	// internalRemappedAuthenticatorTransport handles remapping of AuthenticatorTransport values. Specifically it is
+	// intentional on remapping only transports that never made recommendation but are being used in the wild. It
+	// should not be used to handle transports that were ratified.
+	internalRemappedAuthenticatorTransport = map[string]AuthenticatorTransport{
+		// The Authenticator Transport 'hybrid' was previously named 'cable'; even if it was for a short period.
+		"cable": Hybrid,
+	}
+)


Test patch:
diff --git a/protocol/attestation.go b/protocol/attestation.go
index 11d9ce8..2d7d3af 100644
--- a/protocol/attestation.go
+++ b/protocol/attestation.go
@@ -114,7 +114,11 @@ func (ccr *AuthenticatorAttestationResponse) Parse() (p *ParsedAttestationRespon
 	}
 
 	for _, t := range ccr.Transports {
-		p.Transports = append(p.Transports, AuthenticatorTransport(t))
+		if transport, ok := internalRemappedAuthenticatorTransport[t]; ok {
+			p.Transports = append(p.Transports, transport)
+		} else {
+			p.Transports = append(p.Transports, AuthenticatorTransport(t))
+		}
 	}
 
 	return p, nil