Upgrading from 10.5.X to 10.6.0

Removal of the webauthn-json library

The webauthn-json library is no longer used in the product, because all major browsers now support native APIs that are equivalent to what webauthn-json provided.

The assets/js/lib/webauthn-json.js file has been removed from the server distribution. In addition, the following Velocity templates were updated to remove usages of the library:

  • authenticator/passkeys/js/authenticate-device.vm
  • authenticator/passkeys/js/register.vm
  • authenticator/webauthn/js/add-additional-device.vm
  • authenticator/webauthn/js/authenticate-device.vm
  • authenticator/webauthn/js/register.vm
  • authenticator/webauthn/js/common-js.vm

If any of these templates were customized in your deployment, they need to be updated, namely:

  • Replace usages of webauthnJSON.get with getPublicKeyCredential (defined in common-js.vm)
  • Replace usages of webauthnJSON.create with createPublicKeyCredential (defined in common-js.vm)

Preparing for version 11.0.0

This section contains important remarks in preparation for the upcoming 11.0.0 major release, scheduled for February 2026.

SDK - Removal of the CredentialDataAccessProvider interface

Note

The changes mentioned in this section are meant for authors of data access plugins, namely when implementing support for Credential Data Access using the CredentialDataAccessProvider interface.

The deprecated CredentialDataAccessProvider interface will be removed in version 11.0.0. The corresponding getCredentialDataAccessProvider method in the DataAccessProviderPluginDescriptor interface will also be removed.

Any data access plugin implementing that interface should be updated to implement one of the subtypes of the CredentialManagementDataAccessProvider interface before upgrading the server to version 11.0.0. Refer to the upgrade guide for version 10.0.0 for details on how to update such plugins.