chore(deps): bump otplib from 13.4.1 to 13.5.0

[dependabot]

Bumps otplib from 13.4.1 to 13.5.0.

Release notes

Sourced from otplib's releases.

v13.5.0

What's Changed

• test: mutation-testing audit — close test gaps, add Stryker tooling + manual CI by @​yeojz in yeojz/otplib#865
• chore(deps-dev): bump vite from 8.0.14 to 8.0.16 by @​dependabot[bot] in yeojz/otplib#864
• chore(deps): bump the github-actions group across 1 directory with 7 updates by @​dependabot[bot] in yeojz/otplib#872
• chore(deps-dev): bump the dev-dependencies-minor group across 1 directory with 10 updates by @​dependabot[bot] in yeojz/otplib#871
• chore(deps): bump commander from 14.0.3 to 15.0.0 by @​dependabot[bot] in yeojz/otplib#866
• fix: reject unknown hash algorithms instead of silently substituting by @​yeojz in yeojz/otplib#874
• test(fuzz): cover scalar HOTP counter tolerance semantics by @​yeojz in yeojz/otplib#876
• chore(deps-dev): bump vite from 8.1.5 to 8.2.0 by @​dependabot[bot] in yeojz/otplib#875
• fix: constrain esbuild for VitePress by @​yeojz in yeojz/otplib#877
• chore(deps-dev): resolve dependabot alerts via pnpm overrides by @​yeojz in yeojz/otplib#878
• chore(deps-dev): migrate to TypeScript 6.0.3 by @​yeojz in yeojz/otplib#879
• docs: collapse API section by default by @​yeojz in yeojz/otplib#880
• release(packages): v13.5.0 by @​github-actions[bot] in yeojz/otplib#881

Full Changelog: yeojz/otplib@v13.4.1...v13.5.0

---

Important behaviour change in this bugfix release.

[!NOTE] This is a bugfix release but has potentially breaking behaviour for library users passing invalid inputs (which is more likely in non-TypeScript or loosely-typed environments).

This release (#874) makes hash algorithm validation consistent and strict across all crypto plugins. Previously, an unrecognised algorithm string was handled differently by each plugin:

input	noble	node	web
'SHA1'	silently computed SHA-512	worked (OpenSSL alias tolerance)	threw a raw TypeError
'totally-bogus'	silently computed SHA-512	threw	threw

All three now reject anything outside sha1/sha256/sha512 (case-insensitive, single-separator aliases like SHA-1 or sha_256 accepted) by throwing the new AlgorithmUnsupportedError, instead of silently substituting a different digest.

A library dependents passing a correctly-spelled algorithm name ('sha1', 'SHA1', 'sha-256', etc.) sees no change other than clearer, stricter errors on genuinely invalid input. In TypeScript-strict environments this is mostly moot as algorithm is typed as 'sha1' | 'sha256' | 'sha512', so a hardcoded typo like 'SHA1' won't compile. It can still surface if the value comes from outside the type system (e.g. JSON.parse, process.env, or an as HashAlgorithm cast).

If you were relying on noble's old silent fallback to SHA-512 for a misspelled or unrecognised algorithm string, tokens generated/verified that way will stop matching after upgrading with no error on the old side, just tokens that quietly stop verifying.

To recover

• Change algorithm to sha512,
• or re-enroll the affected accounts.

See "Existing enrollments stopped verifying after an upgrade" for details.

Commits

• 97069d8 release(packages): v13.5.0 (#881)
• 44d0dfc chore(deps-dev): migrate to TypeScript 6.0.3 (#879)
• 6b991f5 fix: reject unknown hash algorithms instead of silently substituting (#874)
• See full diff in compare view