chore(deps): bump the go-deps group with 3 updates

[dependabot]

Bumps the go-deps group with 3 updates: github.com/SUNET/vc, github.com/go-oidfed/lib and github.com/go-webauthn/webauthn.

Updates github.com/SUNET/vc from 0.7.0 to 0.7.3

Commits

• 28383da Merge pull request #609 from SUNET/masv/fix/remove-credential-set-query-purpose
• fa5a230 Remove purpose from frontend.
• 34b8424 Remove the un-spec attr. Purpose from CredentialSetQuery.
• f72dbbe Merge pull request #608 from SUNET/masv/fix/credential-query-require-cryptogr...
• ae228e1 Must be true when nil.
• 48f1aad Merge pull request #606 from SUNET/masv/fix/credential-set-query-required
• c6dd4b0 Easier naming.
• 8ec063a Omitted must per spec render true.
• 28c9328 Merge pull request #603 from SUNET/masv/fix/claim_query_values
• 9b3c965 Test the complete roundtrip.
• Additional commits viewable in compare view

Updates github.com/go-oidfed/lib from 0.11.1 to 0.11.2

Release notes

Sourced from github.com/go-oidfed/lib's releases.

go-oidfed/lib 0.11.2

Dependencies

• github.com/cloudflare/circl 1.6.4 → 1.6.5
• github.com/gofiber/fiber/v2 2.52.14 → 2.52.15
• github.com/jwx-go/compsig/v4 4.0.4 → 4.0.5
• github.com/jwx-go/ed448/v4 4.0.4 → 4.0.5
• github.com/jwx-go/mldsa/v4 4.0.4 → 4.0.5
• github.com/lestrrat-go/jwx/v4 4.2.0 → 4.4.0
• github.com/redis/go-redis/v9 9.21.0 → 9.22.0
• github.com/stretchr/testify 1.11.1 → 1.12.1
• golang.org/x/text 0.40.0 → 0.41.0
• github.com/lestrrat-go/dsig 1.3.0 → 1.4.0 (indirect)
• golang.org/x/crypto 0.54.0 → 0.55.0 (indirect)

Changelog

Sourced from github.com/go-oidfed/lib's changelog.

go-oidfed/lib 0.11.2

Dependencies

• github.com/cloudflare/circl 1.6.4 → 1.6.5
• github.com/gofiber/fiber/v2 2.52.14 → 2.52.15
• github.com/jwx-go/compsig/v4 4.0.4 → 4.0.5
• github.com/jwx-go/ed448/v4 4.0.4 → 4.0.5
• github.com/jwx-go/mldsa/v4 4.0.4 → 4.0.5
• github.com/lestrrat-go/jwx/v4 4.2.0 → 4.4.0
• github.com/redis/go-redis/v9 9.21.0 → 9.22.0
• github.com/stretchr/testify 1.11.1 → 1.12.1
• golang.org/x/text 0.40.0 → 0.41.0
• github.com/lestrrat-go/dsig 1.3.0 → 1.4.0 (indirect)
• golang.org/x/crypto 0.54.0 → 0.55.0 (indirect)

Documentation

• Clarified the IssueTrustMarkOptions.SubjectClaims comment: subject claims override the spec's Extra claims.

Commits

• 8b63bf7 add changelog entry for 0.11.2
• 2bdc3a4 Merge pull request #193 from go-oidfed/dependabot/go_modules/github.com/jwx-g...
• 9b96196 chore(deps): bump github.com/jwx-go/compsig/v4 from 4.0.4 to 4.0.5
• 6ff5901 Merge pull request #191 from go-oidfed/dependabot/go_modules/github.com/jwx-g...
• 784787b Merge pull request #192 from go-oidfed/dependabot/go_modules/github.com/lestr...
• 92218bc Merge pull request #194 from go-oidfed/dependabot/go_modules/github.com/jwx-g...
• 786197d chore(deps): bump github.com/jwx-go/ed448/v4 from 4.0.4 to 4.0.5
• 9598b38 chore(deps): bump github.com/lestrrat-go/jwx/v4 from 4.3.0 to 4.4.0
• 1e4da60 chore(deps): bump github.com/jwx-go/mldsa/v4 from 4.0.4 to 4.0.5
• acf7a4b clarify comment on SubjectClaims overriding Extra claims
• Additional commits viewable in compare view

Updates github.com/go-webauthn/webauthn from 0.17.4 to 0.18.0

Release notes

Sourced from github.com/go-webauthn/webauthn's releases.

v0.18.0

0.18.0 (2026-08-27)

This release is a fairly major milestone in the development of this library. It has quite a few breaking changes but has added support for most if not all of the extension requirements natively, and adds formal support for Post-Quantum Cryptography with support for ML-DSA-44, ML-DSA-65, and ML-DSA-87 when used with go 1.27.

Details on the migration requirements for this version can be found int https://github.com/go-webauthn/webauthn/blob/HEAD/MIGRATION.md as they are substantial between ths version and prior versions.

Bug Fixes

• metadata: align members with mds 3.1.1 and ctap 2.3 (#739) (397152c)
• metadata: consistent revocation policy and client timeouts (#740) (34d324b)
• metadata: handle certificate chains of any depth (#737) (309ea69)
• metadata: honour status report order and effective dates (#736) (8be5355)
• metadata: mds3 parsing conformance and cache integrity (#735) (8115143)
• metadata: prevent panic corrupt blob (#698) (c5fd013)
• metadata: report malformed status report urls (#738) (ed82f7c)
• protocol: allow any attestation eku (#728) (f4e33fc)
• protocol: androidkey missing authorization list member (#727) (9b02b19)
• protocol: androidkey union generated (#729) (3ed3e75)
• protocol: bind credential public key curve to its algorithm (#752) (314c2be)
• protocol: compound attestation sub-statement unmarshalling (#751) (a582ecf)
• protocol: compound returns incorrect type (#731) (025d897)
• protocol: credential public key match limited to ECDSA (#732) (b4df26e)
• protocol: harden credential response and options handling (#763) (de0ae6c)
• protocol: missing tpm steps (#725) (f9a63f9)
• protocol: opaque origin matching and validation (#758) (37f065a)
• protocol: possible panic conditions (#719) (0ea14e7)
• protocol: safetynet validation steps (#726) (e12f6e8)
• protocol: single signature encoding policy and canonical der (#744) (99bbbdb)
• webauthncbor: reject data trailing the first cbor item (#762) (0801b5d)
• webauthncose: validate okp key algorithm (#759) (98c528b)
• webauthn: deprecations and handle check (#745) (8619bb9)
• webauthn: include backup flag check in registration (#748) (26a4868)
• webauthn: only update uv flag (#746) (b39c822)
• webauthn: use session relying party id (#747) (ebb45e2)

Features

• metadata: update to r46 anchor (#780) (20f33e6)
• ml-dsa preference list and gated availability (#768) (db1e068)
• protocol: client capability enumeration (#765) (62f4489)
• protocol: compound sub-statement scope (#742) (34271da)
• protocol: current user details signal constructor (#766) (b6db923)
• protocol: ecdsa attestation signature encoding policy (#743) (29404e9), closes #710
• protocol: related origins well-known document (#753) (05d54dc)
• protocol: relying party attestation policy (#741) (3239ed0)

... (truncated)

Changelog

Sourced from github.com/go-webauthn/webauthn's changelog.

0.18.0 (2026-08-27)

This release is a fairly major milestone in the development of this library. It has quite a few breaking changes but has added support for most if not all of the extension requirements natively, and adds formal support for Post-Quantum Cryptography with support for ML-DSA-44, ML-DSA-65, and ML-DSA-87 when used with go 1.27.

Details on the migration requirements for this version can be found int [MIGRATION.md] as they are substantial between ths version and prior versions.

Bug Fixes

• metadata: align members with mds 3.1.1 and ctap 2.3 (#739) (397152c)
• metadata: consistent revocation policy and client timeouts (#740) (34d324b)
• metadata: handle certificate chains of any depth (#737) (309ea69)
• metadata: honour status report order and effective dates (#736) (8be5355)
• metadata: mds3 parsing conformance and cache integrity (#735) (8115143)
• metadata: prevent panic corrupt blob (#698) (c5fd013)
• metadata: report malformed status report urls (#738) (ed82f7c)
• protocol: allow any attestation eku (#728) (f4e33fc)
• protocol: androidkey missing authorization list member (#727) (9b02b19)
• protocol: androidkey union generated (#729) (3ed3e75)
• protocol: bind credential public key curve to its algorithm (#752) (314c2be)
• protocol: compound attestation sub-statement unmarshalling (#751) (a582ecf)
• protocol: compound returns incorrect type (#731) (025d897)
• protocol: credential public key match limited to ECDSA (#732) (b4df26e)
• protocol: harden credential response and options handling (#763) (de0ae6c)
• protocol: missing tpm steps (#725) (f9a63f9)
• protocol: opaque origin matching and validation (#758) (37f065a)
• protocol: possible panic conditions (#719) (0ea14e7)
• protocol: safetynet validation steps (#726) (e12f6e8)
• protocol: single signature encoding policy and canonical der (#744) (99bbbdb)
• webauthncbor: reject data trailing the first cbor item (#762) (0801b5d)
• webauthncose: validate okp key algorithm (#759) (98c528b)
• webauthn: deprecations and handle check (#745) (8619bb9)
• webauthn: include backup flag check in registration (#748) (26a4868)
• webauthn: only update uv flag (#746) (b39c822)
• webauthn: use session relying party id (#747) (ebb45e2)

Features

• metadata: update to r46 anchor (#780) (20f33e6)
• ml-dsa preference list and gated availability (#768) (db1e068)
• protocol: client capability enumeration (#765) (62f4489)
• protocol: compound sub-statement scope (#742) (34271da)
• protocol: current user details signal constructor (#766) (b6db923)
• protocol: ecdsa attestation signature encoding policy (#743) (29404e9), closes #710
• protocol: related origins well-known document (#753) (05d54dc)
• protocol: relying party attestation policy (#741) (3239ed0)
• typed extension inputs and outputs (#734) (0661c81)

... (truncated)

Commits

• 109da34 release: v0.18.0 (#782)
• 4977ba1 docs: breaking (#781)
• f8eb85e build(deps): update github/codeql-action action to v4.37.9 (#779)
• 20f33e6 feat(metadata): update to r46 anchor (#780)
• bca8ebd test: add fuzz tests (#777)
• 9b6dffd build(deps): update github/codeql-action action to v4.37.8 (#776)
• 2190797 build: update to go 1.27 (#775)
• 97b0d9f build(deps): update dependency go to v1.27.0 (#774)
• f815453 build(deps): update module github.com/stretchr/testify to v1.12.1 (#772)
• a456bad build(deps): update go toolchain directive to v1.27.0 (#773)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.