Skip to content

build(deps): Bump yubiKit from 3.0.1 to 3.1.0#1366

Merged
AChep merged 1 commit into
masterfrom
dependabot/gradle/yubiKit-3.1.0
Apr 9, 2026
Merged

build(deps): Bump yubiKit from 3.0.1 to 3.1.0#1366
AChep merged 1 commit into
masterfrom
dependabot/gradle/yubiKit-3.1.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 8, 2026

Bumps yubiKit from 3.0.1 to 3.1.0.
Updates com.yubico.yubikit:android from 3.0.1 to 3.1.0

Release notes

Sourced from com.yubico.yubikit:android's releases.

YubiKit 3.1.0

This release introduces the new fido-android-ui module, desktop multi-device and NFC reader support, sensitive data hardening across all modules, and build tooling improvements.

New in this release:

  • fido-android-ui module (new):
    • High-level Kotlin API for WebAuthn operations using hardware security keys, including WebView integration and customizable UI; AndroidDemo includes usage examples (#277)
  • fido module:
    • Support for WebAuthn previewSign extension v4 (#304)
    • Fixed shared mutable state in HmacSecretExtension result lambda (#315)
    • Improved USB device detection using HID report descriptor parsing for FIDO Alliance usage page (0xF1D0) (#285)
  • desktop module:
    • Added multi-device selection support (DesktopDeviceSelector, listDeviceRecords, getDeviceBySerial, getDeviceBySelector, requireSingleDevice) (#287)
    • Added NFC reader support for external readers (e.g. OMNIKEY) alongside USB (#307)
  • oath module:
    • Added Destroyable interface to CredentialData for zeroing secret key material (#312)
  • piv module:
    • Added generateKey() as replacement for deprecated generateKeyValues() (#295)
  • core module:
    • Added ZeroingByteArrayOutputStream utility for secure memory handling (#312)
    • Fixed thread safety in UsbDeviceManager with volatile keyword (#285)
    • Made DeviceFilter methods public to allow proper extension (#285)
  • security (all modules):
    • Zero sensitive cryptographic material (private keys, PINs, shared secrets, ECDH outputs) after use across all modules (#312, #315)
    • Switched to SLF4J fluent API for lazy log argument evaluation to prevent sensitive data from being eagerly placed on the heap (#315)
  • testing:
    • Added YubiOtp device tests for Android and Desktop (#286)
  • build system:
    • Upgraded to AGP 9.1.0 (#284)
    • Added consumer ProGuard rules for R8/ProGuard compatibility (#294, #297)
    • Added release build support for AndroidDemo with signing and minification (#305)
    • Updated dependencies and GitHub Actions (#301, #316)

Full Changelog: 3.0.1...3.1.0

Changelog

Sourced from com.yubico.yubikit:android's changelog.

  • Version 3.1.0 (released 2026-03-31) ** new:
    • fido: added fido-android-ui module with high-level Kotlin API for WebAuthn operations using hardware security keys, including WebView integration and customizable UI; AndroidDemo includes usage examples
    • fido: support for WebAuthn previewSign extension v4
    • desktop: added multi-device selection support (DesktopDeviceSelector, listDeviceRecords, getDeviceBySerial, getDeviceBySelector, requireSingleDevice)
    • desktop: added NFC reader support for external readers (e.g. OMNIKEY) alongside USB
    • oath: added Destroyable interface to CredentialData for zeroing secret key material
    • core: added ZeroingByteArrayOutputStream utility for secure memory handling
    • piv: added generateKey() as replacement for deprecated generateKeyValues()
    • testing: added YubiOtp device tests for Android and Desktop ** fixes & improvements:
    • security: zero sensitive cryptographic material (private keys, PINs, shared secrets, ECDH outputs) after use across all modules
    • security: switched to SLF4J fluent API for lazy log argument evaluation to prevent sensitive data from being eagerly placed on the heap
    • fido: fixed shared mutable state in HmacSecretExtension result lambda
    • fido: improved USB device detection using HID report descriptor parsing for FIDO Alliance usage page (0xF1D0)
    • core: fixed thread safety in UsbDeviceManager with volatile keyword
    • core: made DeviceFilter methods public to allow proper extension
    • build: upgraded to AGP 9.1.0
    • build: added consumer ProGuard rules for R8/ProGuard compatibility
    • build: added release build support for AndroidDemo with signing and minification
    • build: updated dependencies and GitHub Actions
Commits

Updates com.yubico.yubikit:yubiotp from 3.0.1 to 3.1.0

Release notes

Sourced from com.yubico.yubikit:yubiotp's releases.

YubiKit 3.1.0

This release introduces the new fido-android-ui module, desktop multi-device and NFC reader support, sensitive data hardening across all modules, and build tooling improvements.

New in this release:

  • fido-android-ui module (new):
    • High-level Kotlin API for WebAuthn operations using hardware security keys, including WebView integration and customizable UI; AndroidDemo includes usage examples (#277)
  • fido module:
    • Support for WebAuthn previewSign extension v4 (#304)
    • Fixed shared mutable state in HmacSecretExtension result lambda (#315)
    • Improved USB device detection using HID report descriptor parsing for FIDO Alliance usage page (0xF1D0) (#285)
  • desktop module:
    • Added multi-device selection support (DesktopDeviceSelector, listDeviceRecords, getDeviceBySerial, getDeviceBySelector, requireSingleDevice) (#287)
    • Added NFC reader support for external readers (e.g. OMNIKEY) alongside USB (#307)
  • oath module:
    • Added Destroyable interface to CredentialData for zeroing secret key material (#312)
  • piv module:
    • Added generateKey() as replacement for deprecated generateKeyValues() (#295)
  • core module:
    • Added ZeroingByteArrayOutputStream utility for secure memory handling (#312)
    • Fixed thread safety in UsbDeviceManager with volatile keyword (#285)
    • Made DeviceFilter methods public to allow proper extension (#285)
  • security (all modules):
    • Zero sensitive cryptographic material (private keys, PINs, shared secrets, ECDH outputs) after use across all modules (#312, #315)
    • Switched to SLF4J fluent API for lazy log argument evaluation to prevent sensitive data from being eagerly placed on the heap (#315)
  • testing:
    • Added YubiOtp device tests for Android and Desktop (#286)
  • build system:
    • Upgraded to AGP 9.1.0 (#284)
    • Added consumer ProGuard rules for R8/ProGuard compatibility (#294, #297)
    • Added release build support for AndroidDemo with signing and minification (#305)
    • Updated dependencies and GitHub Actions (#301, #316)

Full Changelog: 3.0.1...3.1.0

Changelog

Sourced from com.yubico.yubikit:yubiotp's changelog.

  • Version 3.1.0 (released 2026-03-31) ** new:
    • fido: added fido-android-ui module with high-level Kotlin API for WebAuthn operations using hardware security keys, including WebView integration and customizable UI; AndroidDemo includes usage examples
    • fido: support for WebAuthn previewSign extension v4
    • desktop: added multi-device selection support (DesktopDeviceSelector, listDeviceRecords, getDeviceBySerial, getDeviceBySelector, requireSingleDevice)
    • desktop: added NFC reader support for external readers (e.g. OMNIKEY) alongside USB
    • oath: added Destroyable interface to CredentialData for zeroing secret key material
    • core: added ZeroingByteArrayOutputStream utility for secure memory handling
    • piv: added generateKey() as replacement for deprecated generateKeyValues()
    • testing: added YubiOtp device tests for Android and Desktop ** fixes & improvements:
    • security: zero sensitive cryptographic material (private keys, PINs, shared secrets, ECDH outputs) after use across all modules
    • security: switched to SLF4J fluent API for lazy log argument evaluation to prevent sensitive data from being eagerly placed on the heap
    • fido: fixed shared mutable state in HmacSecretExtension result lambda
    • fido: improved USB device detection using HID report descriptor parsing for FIDO Alliance usage page (0xF1D0)
    • core: fixed thread safety in UsbDeviceManager with volatile keyword
    • core: made DeviceFilter methods public to allow proper extension
    • build: upgraded to AGP 9.1.0
    • build: added consumer ProGuard rules for R8/ProGuard compatibility
    • build: added release build support for AndroidDemo with signing and minification
    • build: updated dependencies and GitHub Actions
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): Bump yubiKit from 3.0.1 to 3.1.0
cdbfbcf 
Bumps `yubiKit` from 3.0.1 to 3.1.0.

Updates `com.yubico.yubikit:android` from 3.0.1 to 3.1.0
- [Release notes](https://github.com/Yubico/yubikit-android/releases)
- [Changelog](https://github.com/Yubico/yubikit-android/blob/main/NEWS)
- [Commits](Yubico/yubikit-android@3.0.1...3.1.0)

Updates `com.yubico.yubikit:yubiotp` from 3.0.1 to 3.1.0
- [Release notes](https://github.com/Yubico/yubikit-android/releases)
- [Changelog](https://github.com/Yubico/yubikit-android/blob/main/NEWS)
- [Commits](Yubico/yubikit-android@3.0.1...3.1.0)

---
updated-dependencies:
- dependency-name: com.yubico.yubikit:android
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: com.yubico.yubikit:yubiotp
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Apr 8, 2026
@AChep AChep merged commit 58431cc into master Apr 9, 2026
7 checks passed
@AChep AChep deleted the dependabot/gradle/yubiKit-3.1.0 branch April 9, 2026 05:24
@github-actions github-actions Bot locked and limited conversation to collaborators Apr 9, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@AChep