Release/1.15.1 #403

DennisDyallo · 2026-01-28T10:30:12Z

This pull request focuses on improving the security, maintainability, and clarity of the project's CI/CD workflows and development environment. The main updates include enhancing GitHub Actions security with runner hardening, upgrading and pinning action versions, refining permissions for least privilege, and adding support for Docker updates in Dependabot.

Bug Fixes:

Fixed regression in Piv sample app (#398

Documentation:

The documentation on PIV certificate sizes has been restructured to improve clarity and readability. Additionally, firmware behavior details and practical examples have been added/updated. (#356)

Dependencies:

Several dependencies across integration, unit, and utilities test projects, the test app, and the Yubico.Core and Yubico.YubiKey projects have been updated. (#388, #387, #386, #384)

CI/CD Workflow Security and Maintenance:

Added the step-security/harden-runner action to all major jobs in GitHub Actions workflows to audit and restrict outbound network calls, increasing build security. [1] [2] [3] [4] [5] [6] [7] [8] [9]
Upgraded and pinned versions of critical GitHub Actions (e.g., actions/checkout, actions/upload-artifact, actions/setup-dotnet, actions/attest-build-provenance, docker/setup-qemu-action, actions/download-artifact) to specific, newer versions for improved reliability and traceability. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15]

Permissions and Least Privilege:

Refined and documented permissions for each workflow and job, ensuring only the necessary access is granted (e.g., specifying when pull-requests: write, attestations: write, or packages: write are required). [1] [2] [3] [4] [5]

Dependabot and Development Environment:

Added Docker support to Dependabot for automated base image update checks, and changed the update schedule for GitHub Actions and Docker to weekly.
Updated .devcontainer/devcontainer.json to support multiple .NET versions (8.0, 9.0, 10.0) for local development, improving flexibility for contributors.

These changes collectively improve the security posture of CI/CD pipelines, keep dependencies up to date, and make the development environment more robust and contributor-friendly.

…ons topic

….SDK into docs-thirdpartypayment merging with origin

…ico/Yubico.NET.SDK into docs-thirdpartypayment

docs: third-party payment extension

docs: updated 1.15.0 release notes

Signed-off-by: StepSecurity Bot <[email protected]>

…ecurity-remediation [StepSecurity] Apply security best practices

Bumps nginx from `052b75a` to `66d420c`. --- updated-dependencies: - dependency-name: nginx dependency-version: alpine dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>

Bumps the github-actions group with 3 updates: [actions/setup-dotnet](https://github.com/actions/setup-dotnet), [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) and [github/codeql-action](https://github.com/github/codeql-action). Updates `actions/setup-dotnet` from 5.0.1 to 5.1.0 - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](actions/setup-dotnet@2016bd2...baa11fb) Updates `anthropics/claude-code-action` from 1.0.27 to 1.0.29 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@7145c3e...1b8ee3b) Updates `github/codeql-action` from 4.31.9 to 4.31.10 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@5d4e8d1...cdefb33) --- updated-dependencies: - dependency-name: actions/setup-dotnet dependency-version: 5.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: anthropics/claude-code-action dependency-version: 1.0.29 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action dependency-version: 4.31.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <[email protected]>

Bumps Microsoft.Bcl.AsyncInterfaces from 10.0.1 to 10.0.2 Bumps Microsoft.Bcl.Cryptography from 10.0.1 to 10.0.2 Bumps Microsoft.CodeAnalysis.NetAnalyzers from 10.0.101 to 10.0.102 Bumps Microsoft.Extensions.Configuration.Json from 10.0.1 to 10.0.2 Bumps Microsoft.Extensions.Logging.Abstractions from 10.0.1 to 10.0.2 Bumps Microsoft.Extensions.Options.ConfigurationExtensions from 10.0.1 to 10.0.2 Bumps System.Configuration.ConfigurationManager from 10.0.1 to 10.0.2 Bumps System.Formats.Asn1 from 10.0.1 to 10.0.2 Bumps System.Formats.Cbor from 10.0.1 to 10.0.2 Bumps Xunit.SkippableFact from 1.5.23 to 1.5.61 --- updated-dependencies: - dependency-name: Microsoft.Bcl.AsyncInterfaces dependency-version: 10.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all_packages - dependency-name: Microsoft.Bcl.Cryptography dependency-version: 10.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all_packages - dependency-name: System.Formats.Asn1 dependency-version: 10.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all_packages - dependency-name: Microsoft.CodeAnalysis.NetAnalyzers dependency-version: 10.0.102 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all_packages - dependency-name: Microsoft.CodeAnalysis.NetAnalyzers dependency-version: 10.0.102 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all_packages - dependency-name: Microsoft.Extensions.Configuration.Json dependency-version: 10.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all_packages - dependency-name: Microsoft.Extensions.Logging.Abstractions dependency-version: 10.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all_packages - dependency-name: Microsoft.Extensions.Logging.Abstractions dependency-version: 10.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all_packages - dependency-name: Microsoft.Extensions.Options.ConfigurationExtensions dependency-version: 10.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all_packages - dependency-name: System.Configuration.ConfigurationManager dependency-version: 10.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all_packages - dependency-name: System.Formats.Asn1 dependency-version: 10.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all_packages - dependency-name: System.Formats.Cbor dependency-version: 10.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all_packages - dependency-name: Xunit.SkippableFact dependency-version: 1.5.61 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all_packages ... Signed-off-by: dependabot[bot] <[email protected]>

- Fixed DigestData to use hash digest size instead of key size for RSA keys - Reuses MessageDigestOperations.ComputeMessageDigest for hashing - For RSA: returns raw digest (PadRsa handles signature padding) - For ECC: pads digest to key size with leading zeros if needed - Added unit tests for digest computation logic - Updated devcontainer to include .NET 8.0 and 10.0

…actions-f3c9c47414 chore(deps): bump the github-actions group with 3 updates

…all_packages-febfb66e60 Bump the all_packages group with 10 updates

chore(deps): bump nginx from `052b75a` to `66d420c`

fix(piv): Fix YubiKeySignatureGenerator.DigestData regression in Sample App

Bumps nginx from `66d420c` to `2622096`. --- updated-dependencies: - dependency-name: nginx dependency-version: alpine dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>

Bumps Microsoft.Extensions.Logging.Console from 10.0.0 to 10.0.2 --- updated-dependencies: - dependency-name: Microsoft.Extensions.Logging.Console dependency-version: 10.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all_packages - dependency-name: Microsoft.Extensions.Logging.Console dependency-version: 10.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all_packages - dependency-name: Microsoft.Extensions.Logging.Console dependency-version: 10.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all_packages ... Signed-off-by: dependabot[bot] <[email protected]>

Bumps the github-actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.14.0` | `2.14.1` | | [actions/checkout](https://github.com/actions/checkout) | `6.0.1` | `6.0.2` | | [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `3.1.0` | `3.2.0` | | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.29` | `1.0.37` | | [github/codeql-action](https://github.com/github/codeql-action) | `4.31.10` | `4.32.0` | Updates `step-security/harden-runner` from 2.14.0 to 2.14.1 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@20cf305...e3f713f) Updates `actions/checkout` from 6.0.1 to 6.0.2 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@8e8c483...de0fac2) Updates `actions/attest-build-provenance` from 3.1.0 to 3.2.0 - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@00014ed...96278af) Updates `anthropics/claude-code-action` from 1.0.29 to 1.0.37 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@1b8ee3b...2817c54) Updates `github/codeql-action` from 4.31.10 to 4.32.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@cdefb33...b20883b) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.14.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/attest-build-provenance dependency-version: 3.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: anthropics/claude-code-action dependency-version: 1.0.37 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action dependency-version: 4.32.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <[email protected]>

chore(deps): bump nginx from `66d420c` to `2622096`

…all_packages-74699dc37d Bump the all_packages group with 1 update

…actions-e40d636236 chore(deps): bump the github-actions group with 5 updates

…release/1.15.1

Copilot

Pull request overview

This release (v1.15.1) focuses on security, maintainability, and documentation improvements. Key updates include enhanced CI/CD security through GitHub Actions hardening, dependency updates, bug fixes, and improved documentation.

Changes:

Enhanced security posture by adding runner hardening and updating action versions across all workflows
Updated multiple project dependencies to latest versions (Microsoft.Bcl.Cryptography, Xunit.SkippableFact, etc.)
Fixed regression in PIV sample app's signature generation logic

Reviewed changes

Copilot reviewed 38 out of 38 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
docs/users-manual/toc.yml	Added new documentation section for third-party payment extension
docs/users-manual/getting-started/whats-new.md	Updated release notes for v1.15.1 and corrected v1.15.0 release date
docs/users-manual/application-piv/cert-size.md	Restructured PIV certificate size documentation for improved clarity
docs/users-manual/application-fido2/thirdpartypayment.md	Added comprehensive documentation for thirdPartyPayment extension
build/Versions.props	Bumped version to 1.15.1
Multiple test project files	Updated NuGet package versions across test projects
Yubico.YubiKey/tests/unit/.../YubiKeySignatureGeneratorTests.cs	Added unit tests verifying the PIV signature generation fix
Yubico.YubiKey/tests/unit/.../ConnectionManagerTests.cs	Removed file (likely moved or refactored)
Yubico.YubiKey/src/.../SmartCardConnection.cs	Extracted method calls to variables for clarity
Yubico.YubiKey/src/.../Fido2Session.LargeBlobs.cs	Moved variable declaration to reduce scope
Yubico.YubiKey/src/.../AuthenticatorOperationParameters.cs	Updated Guard method calls and removed duplicate extension method
Yubico.YubiKey/src/.../ConnectionManager.cs	Removed file (likely moved or refactored)
Yubico.YubiKey/src/Yubico.YubiKey.csproj	Updated multiple NuGet package references
Yubico.YubiKey/examples/.../YubiKeySignatureGenerator.cs	Fixed digest computation bug in signature generation
Yubico.Core/tests/Yubico.Core.UnitTests.csproj	Updated Xunit.SkippableFact package version
Yubico.Core/src/.../DesktopSmartCardConnection.cs	Extracted method call result to variable
Yubico.Core/src/Yubico.Core.csproj	Updated multiple Microsoft Extensions package references
SECURITY.md	Added security vulnerability disclosure policy
Dockerfile	Pinned nginx base image with SHA256 hash
.github/workflows/*.yml	Added harden-runner step and updated action versions across all workflows
.github/dependabot.yml	Changed GitHub Actions schedule to weekly and added Docker ecosystem
.devcontainer/devcontainer.json	Added support for .NET 8.0 and 10.0 versions

Yubico.YubiKey/src/Yubico/YubiKey/Fido2/AuthenticatorOperationParameters.cs

Yubico.YubiKey/examples/PivSampleCode/CertificateOperations/YubiKeySignatureGenerator.cs

github-actions · 2026-01-28T10:33:42Z

Test Results: Windows

2 files 2 suites 19s ⏱️
4 023 tests 4 004 ✅ 19 💤 0 ❌
4 025 runs 4 006 ✅ 19 💤 0 ❌

Results for commit f7bfcb4.

github-actions · 2026-01-28T10:33:49Z

Test Results: Ubuntu

2 files 2 suites 48s ⏱️
4 015 tests 3 996 ✅ 19 💤 0 ❌
4 017 runs 3 998 ✅ 19 💤 0 ❌

Results for commit f7bfcb4.

github-actions · 2026-01-28T10:33:56Z

Test Results: MacOS

4 files 4 suites 29s ⏱️
3 997 tests 3 997 ✅ 0 💤 0 ❌
3 999 runs 3 999 ✅ 0 💤 0 ❌

Results for commit f7bfcb4.

github-actions · 2026-01-28T10:34:05Z

Package	Line Rate	Branch Rate	Complexity	Health
Yubico.Core	45%	35%	4557	➖
Yubico.YubiKey	51%	46%	20946	➖
Summary	49% (36846 / 74598)	44% (8837 / 20082)	25503	➖

Minimum allowed line rate is 40%

equijano21 and others added 30 commits November 13, 2025 16:08

added file for thirdpartypayment, added file to toc under new extensi…

8ca9b79

…ons topic

makecredential code sample

9bc123a

more sample code

eb705f8

getassertion docs

150b96c

makecredential docs

18ff7f6

third party payment overview

c7d9118

updated release notes

f09da74

fixed typo

9e57faa

Merge branch 'develop' into docs-thirdpartypayment

ca04812

updated rns

fdb22e9

Merge branch 'docs-thirdpartypayment' of github.com:Yubico/Yubico.NET…

2f72e81

….SDK into docs-thirdpartypayment merging with origin

removed statements about typical cert sizes, reworked chapter

0a8eec5

spelled out certificates

56e0ec2

wrote out model and firmware in tables

485ca63

added note about cert sizes in practice

d3bd2ae

wrote out YubiKey

fefe4c0

added info from discussion with firmware team

38c5d2b

docs: add updated example to check for extension support

d1dc5f0

Merge branch 'develop' into docs-thirdpartypayment

ed1cef2

changed toc name

18518b0

merged originMerge branch 'docs-thirdpartypayment' of github.com:Yub…

a585fc6

…ico/Yubico.NET.SDK into docs-thirdpartypayment

fixed hmac toc entry

4a64f63

Merge pull request #349 from Yubico/docs-thirdpartypayment

31efc6e

docs: third-party payment extension

Merge branch 'main' into develop

11ccc40

additional info and edits from FW discussion

a064b5c

updated release date, added 2 doc rns

f9d6254

ci: persistCredentials on necessary step

0aa0a6f

Merge pull request #364 from Yubico/docs-1.15.0-rns

1f88bc6

docs: updated 1.15.0 release notes

[StepSecurity] Apply security best practices

79611ad

Signed-off-by: StepSecurity Bot <[email protected]>

Merge pull request #366 from step-security-bot/chore/GHA-091311-steps…

fd111bd

…ecurity-remediation [StepSecurity] Apply security best practices

dependabot bot and others added 19 commits January 14, 2026 08:16

chore(deps): bump nginx from 052b75a to 66d420c

836ce8c

Bumps nginx from `052b75a` to `66d420c`. --- updated-dependencies: - dependency-name: nginx dependency-version: alpine dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>

chore: remove notes

fb4d208

Merge pull request #393 from Yubico/dependabot/github_actions/github-…

35bfb83

…actions-f3c9c47414 chore(deps): bump the github-actions group with 3 updates

Merge pull request #394 from Yubico/dependabot/nuget/Yubico.Core/src/…

bd4a284

…all_packages-febfb66e60 Bump the all_packages group with 10 updates

Merge pull request #392 from Yubico/dependabot/docker/nginx-66d420c

72fe466

chore(deps): bump nginx from `052b75a` to `66d420c`

release notes for 1.15.1

4f72aaa

Merge pull request #398 from Yubico/fix/issue-395-digest-data-regression

0e287a6

fix(piv): Fix YubiKeySignatureGenerator.DigestData regression in Sample App

chore(deps): bump nginx from 66d420c to 2622096

434417b

Bumps nginx from `66d420c` to `2622096`. --- updated-dependencies: - dependency-name: nginx dependency-version: alpine dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>

docs: update release notes for version 1.15.1 with bug fix details

c8f6416

bump: update CommonVersion to 1.15.1

f7bfcb4

Merge pull request #400 from Yubico/dependabot/docker/nginx-2622096

83a3837

chore(deps): bump nginx from `66d420c` to `2622096`

Merge pull request #401 from Yubico/dependabot/nuget/Yubico.Core/src/…

59e8750

…all_packages-74699dc37d Bump the all_packages group with 1 update

Merge pull request #402 from Yubico/dependabot/github_actions/github-…

cf1db3a

…actions-e40d636236 chore(deps): bump the github-actions group with 5 updates

Merge remote-tracking branch 'origin/docs-1.15.1-release-notes' into …

beb9903

…release/1.15.1

DennisDyallo requested a review from Copilot January 28, 2026 10:30

DennisDyallo marked this pull request as ready for review January 28, 2026 10:30

Copilot AI reviewed Jan 28, 2026

View reviewed changes

Yubico.YubiKey/src/Yubico/YubiKey/Fido2/AuthenticatorOperationParameters.cs Show resolved Hide resolved

Yubico.YubiKey/examples/PivSampleCode/CertificateOperations/YubiKeySignatureGenerator.cs Show resolved Hide resolved

dainnilsson approved these changes Jan 28, 2026

View reviewed changes

DennisDyallo merged commit 94050ff into main Jan 28, 2026
14 of 15 checks passed

DennisDyallo deleted the release/1.15.1 branch January 28, 2026 11:36

DennisDyallo restored the release/1.15.1 branch January 28, 2026 12:22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Release/1.15.1 #403

Release/1.15.1 #403

Uh oh!

DennisDyallo commented Jan 28, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Jan 28, 2026

Uh oh!

github-actions bot commented Jan 28, 2026

Uh oh!

github-actions bot commented Jan 28, 2026

Uh oh!

github-actions bot commented Jan 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

Release/1.15.1 #403

Release/1.15.1 #403

Uh oh!

Conversation

DennisDyallo commented Jan 28, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Jan 28, 2026

Test Results: Windows

Uh oh!

github-actions bot commented Jan 28, 2026

Test Results: Ubuntu

Uh oh!

github-actions bot commented Jan 28, 2026

Test Results: MacOS

Uh oh!

github-actions bot commented Jan 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants