chore(deps): bump otplib from 13.4.1 to 13.5.0

[dependabot]

Bumps otplib from 13.4.1 to 13.5.0.

Release notes

Sourced from otplib's releases.

v13.5.0

What's Changed

• test: mutation-testing audit — close test gaps, add Stryker tooling + manual CI by @​yeojz in yeojz/otplib#865
• chore(deps-dev): bump vite from 8.0.14 to 8.0.16 by @​dependabot[bot] in yeojz/otplib#864
• chore(deps): bump the github-actions group across 1 directory with 7 updates by @​dependabot[bot] in yeojz/otplib#872
• chore(deps-dev): bump the dev-dependencies-minor group across 1 directory with 10 updates by @​dependabot[bot] in yeojz/otplib#871
• chore(deps): bump commander from 14.0.3 to 15.0.0 by @​dependabot[bot] in yeojz/otplib#866
• fix: reject unknown hash algorithms instead of silently substituting by @​yeojz in yeojz/otplib#874
• test(fuzz): cover scalar HOTP counter tolerance semantics by @​yeojz in yeojz/otplib#876
• chore(deps-dev): bump vite from 8.1.5 to 8.2.0 by @​dependabot[bot] in yeojz/otplib#875
• fix: constrain esbuild for VitePress by @​yeojz in yeojz/otplib#877
• chore(deps-dev): resolve dependabot alerts via pnpm overrides by @​yeojz in yeojz/otplib#878
• chore(deps-dev): migrate to TypeScript 6.0.3 by @​yeojz in yeojz/otplib#879
• docs: collapse API section by default by @​yeojz in yeojz/otplib#880
• release(packages): v13.5.0 by @​github-actions[bot] in yeojz/otplib#881

Full Changelog: yeojz/otplib@v13.4.1...v13.5.0

---

Important behaviour change in this bugfix release.

[!NOTE] This is a bugfix release but has potentially breaking behaviour for library users passing invalid inputs (which is more likely in non-TypeScript or loosely-typed environments).

This release (#874) makes hash algorithm validation consistent and strict across all crypto plugins. Previously, an unrecognised algorithm string was handled differently by each plugin:

input	noble	node	web
'SHA1'	silently computed SHA-512	worked (OpenSSL alias tolerance)	threw a raw TypeError
'totally-bogus'	silently computed SHA-512	threw	threw

All three now reject anything outside sha1/sha256/sha512 (case-insensitive, single-separator aliases like SHA-1 or sha_256 accepted) by throwing the new AlgorithmUnsupportedError, instead of silently substituting a different digest.

A library dependents passing a correctly-spelled algorithm name ('sha1', 'SHA1', 'sha-256', etc.) sees no change other than clearer, stricter errors on genuinely invalid input. In TypeScript-strict environments this is mostly moot as algorithm is typed as 'sha1' | 'sha256' | 'sha512', so a hardcoded typo like 'SHA1' won't compile. It can still surface if the value comes from outside the type system (e.g. JSON.parse, process.env, or an as HashAlgorithm cast).

If you were relying on noble's old silent fallback to SHA-512 for a misspelled or unrecognised algorithm string, tokens generated/verified that way will stop matching after upgrading with no error on the old side, just tokens that quietly stop verifying.

To recover

• Change algorithm to sha512,
• or re-enroll the affected accounts.

See "Existing enrollments stopped verifying after an upgrade" for details.

Commits

• 97069d8 release(packages): v13.5.0 (#881)
• 44d0dfc chore(deps-dev): migrate to TypeScript 6.0.3 (#879)
• 6b991f5 fix: reject unknown hash algorithms instead of silently substituting (#874)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)