Avoid revert caused by slice overflow in WebAuthn.verify

[Amxx]

Fixes issue L01 in 5.6 audit.

PR Checklist

• Tests
• Documentation
• Changeset entry (run npx changeset add)

[changeset-bot]

🦋 Changeset detected

Latest commit: db9d2de

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
openzeppelin-solidity	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Walkthrough

A changeset declares a minor version bump for openzeppelin-solidity with a fix to WebAuthn.sol. The verify function previously could revert instead of returning false during challenge validation. The fix implements bounds-safe string extraction and comparison using utility libraries, checking clientDataJSON length before accessing the expected challenge slice. Supporting test changes include a new testVerifyIndexOutOfBounds case and new overloads for the _runVerify helper to parameterize challengeIndex and typeIndex values.

Suggested labels

bug

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Avoid revert caused by slice overflow in WebAuthn.verify' directly and clearly describes the main change: preventing a revert due to slice overflow in the WebAuthn verification function, which matches the core objective of the changeset.
Description check	✅ Passed	The description references fixing issue L01 from the 5.6 audit and indicates tests and changeset entry are included, which aligns with the changes shown in the raw summary covering WebAuthn.sol fixes and test additions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}