Bump the go-dependencies group across 1 directory with 2 updates

[dependabot]

Bumps the go-dependencies group with 2 updates in the /vend directory: github.com/fxamacker/cbor/v2 and github.com/go-webauthn/webauthn.

Updates github.com/fxamacker/cbor/v2 from 2.9.2 to 2.9.3

Release notes

Sourced from github.com/fxamacker/cbor/v2's releases.

v2.9.3

This release fixes a potential panic when decoding into a time.Time from a CBOR byte string, map, or array under certain conditions.

Not affected: standard CBOR time data (RFC 8949 tag 0 or tag 1), and decoders configured with timeTag = DecTagRequired.

Upgrading to v2.9.3 is recommended.

The panic stack trace was publicly reported on 2026-08-17, and the fix was released the same day. Fuzz testing was extended to cover this class of bug, and fuzzing of v2.9.3 is ongoing.

What's Changed

• Skip data item when decoding to time.Time fails under certain conditions by @​fxamacker in fxamacker/cbor#803

Full Changelog: fxamacker/cbor@v2.9.2...v2.9.3

Commits

• f0c90b6 Merge pull request #803 from fxamacker/fxamacker/fix-unmarshal-to-time
• c20692a Skip data item when decoding to time.Time fails
• See full diff in compare view

Updates github.com/go-webauthn/webauthn from 0.17.4 to 0.18.0

Release notes

Sourced from github.com/go-webauthn/webauthn's releases.

v0.18.0

0.18.0 (2026-08-27)

This release is a fairly major milestone in the development of this library. It has quite a few breaking changes but has added support for most if not all of the extension requirements natively, and adds formal support for Post-Quantum Cryptography with support for ML-DSA-44, ML-DSA-65, and ML-DSA-87 when used with go 1.27.

Details on the migration requirements for this version can be found int https://github.com/go-webauthn/webauthn/blob/HEAD/MIGRATION.md as they are substantial between ths version and prior versions.

Bug Fixes

• metadata: align members with mds 3.1.1 and ctap 2.3 (#739) (397152c)
• metadata: consistent revocation policy and client timeouts (#740) (34d324b)
• metadata: handle certificate chains of any depth (#737) (309ea69)
• metadata: honour status report order and effective dates (#736) (8be5355)
• metadata: mds3 parsing conformance and cache integrity (#735) (8115143)
• metadata: prevent panic corrupt blob (#698) (c5fd013)
• metadata: report malformed status report urls (#738) (ed82f7c)
• protocol: allow any attestation eku (#728) (f4e33fc)
• protocol: androidkey missing authorization list member (#727) (9b02b19)
• protocol: androidkey union generated (#729) (3ed3e75)
• protocol: bind credential public key curve to its algorithm (#752) (314c2be)
• protocol: compound attestation sub-statement unmarshalling (#751) (a582ecf)
• protocol: compound returns incorrect type (#731) (025d897)
• protocol: credential public key match limited to ECDSA (#732) (b4df26e)
• protocol: harden credential response and options handling (#763) (de0ae6c)
• protocol: missing tpm steps (#725) (f9a63f9)
• protocol: opaque origin matching and validation (#758) (37f065a)
• protocol: possible panic conditions (#719) (0ea14e7)
• protocol: safetynet validation steps (#726) (e12f6e8)
• protocol: single signature encoding policy and canonical der (#744) (99bbbdb)
• webauthncbor: reject data trailing the first cbor item (#762) (0801b5d)
• webauthncose: validate okp key algorithm (#759) (98c528b)
• webauthn: deprecations and handle check (#745) (8619bb9)
• webauthn: include backup flag check in registration (#748) (26a4868)
• webauthn: only update uv flag (#746) (b39c822)
• webauthn: use session relying party id (#747) (ebb45e2)

Features

• metadata: update to r46 anchor (#780) (20f33e6)
• ml-dsa preference list and gated availability (#768) (db1e068)
• protocol: client capability enumeration (#765) (62f4489)
• protocol: compound sub-statement scope (#742) (34271da)
• protocol: current user details signal constructor (#766) (b6db923)
• protocol: ecdsa attestation signature encoding policy (#743) (29404e9), closes #710
• protocol: related origins well-known document (#753) (05d54dc)
• protocol: relying party attestation policy (#741) (3239ed0)

... (truncated)

Changelog

Sourced from github.com/go-webauthn/webauthn's changelog.

0.18.0 (2026-08-27)

This release is a fairly major milestone in the development of this library. It has quite a few breaking changes but has added support for most if not all of the extension requirements natively, and adds formal support for Post-Quantum Cryptography with support for ML-DSA-44, ML-DSA-65, and ML-DSA-87 when used with go 1.27.

Details on the migration requirements for this version can be found int [MIGRATION.md] as they are substantial between ths version and prior versions.

Bug Fixes

• metadata: align members with mds 3.1.1 and ctap 2.3 (#739) (397152c)
• metadata: consistent revocation policy and client timeouts (#740) (34d324b)
• metadata: handle certificate chains of any depth (#737) (309ea69)
• metadata: honour status report order and effective dates (#736) (8be5355)
• metadata: mds3 parsing conformance and cache integrity (#735) (8115143)
• metadata: prevent panic corrupt blob (#698) (c5fd013)
• metadata: report malformed status report urls (#738) (ed82f7c)
• protocol: allow any attestation eku (#728) (f4e33fc)
• protocol: androidkey missing authorization list member (#727) (9b02b19)
• protocol: androidkey union generated (#729) (3ed3e75)
• protocol: bind credential public key curve to its algorithm (#752) (314c2be)
• protocol: compound attestation sub-statement unmarshalling (#751) (a582ecf)
• protocol: compound returns incorrect type (#731) (025d897)
• protocol: credential public key match limited to ECDSA (#732) (b4df26e)
• protocol: harden credential response and options handling (#763) (de0ae6c)
• protocol: missing tpm steps (#725) (f9a63f9)
• protocol: opaque origin matching and validation (#758) (37f065a)
• protocol: possible panic conditions (#719) (0ea14e7)
• protocol: safetynet validation steps (#726) (e12f6e8)
• protocol: single signature encoding policy and canonical der (#744) (99bbbdb)
• webauthncbor: reject data trailing the first cbor item (#762) (0801b5d)
• webauthncose: validate okp key algorithm (#759) (98c528b)
• webauthn: deprecations and handle check (#745) (8619bb9)
• webauthn: include backup flag check in registration (#748) (26a4868)
• webauthn: only update uv flag (#746) (b39c822)
• webauthn: use session relying party id (#747) (ebb45e2)

Features

• metadata: update to r46 anchor (#780) (20f33e6)
• ml-dsa preference list and gated availability (#768) (db1e068)
• protocol: client capability enumeration (#765) (62f4489)
• protocol: compound sub-statement scope (#742) (34271da)
• protocol: current user details signal constructor (#766) (b6db923)
• protocol: ecdsa attestation signature encoding policy (#743) (29404e9), closes #710
• protocol: related origins well-known document (#753) (05d54dc)
• protocol: relying party attestation policy (#741) (3239ed0)
• typed extension inputs and outputs (#734) (0661c81)

... (truncated)

Commits

• 109da34 release: v0.18.0 (#782)
• 4977ba1 docs: breaking (#781)
• f8eb85e build(deps): update github/codeql-action action to v4.37.9 (#779)
• 20f33e6 feat(metadata): update to r46 anchor (#780)
• bca8ebd test: add fuzz tests (#777)
• 9b6dffd build(deps): update github/codeql-action action to v4.37.8 (#776)
• 2190797 build: update to go 1.27 (#775)
• 97b0d9f build(deps): update dependency go to v1.27.0 (#774)
• f815453 build(deps): update module github.com/stretchr/testify to v1.12.1 (#772)
• a456bad build(deps): update go toolchain directive to v1.27.0 (#773)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions