Deprecate allowUnrequestedExtensions

Author: emlun

NEWS

@@ -1,3 +1,14 @@
+== Version 1.12.4 (unreleased) ==
+
+Deprecated features:
+
+* Option `RelyingParty.allowUnrequestedExtensions` deprecated. The `false`
+  setting (default) is not compatible with WebAuthn Level 2 since authenticators
+  are now always allowed to add unsolicited extensions. The next major version
+  release will remove this option and always behave as if the option had been
+  set to `true`.
+
+
 == Version 1.12.3 (unreleased) ==
 
 Fixes:

webauthn-server-core/src/main/java/com/yubico/webauthn/RelyingParty.java

@@ -319,8 +319,13 @@ public class RelyingParty {
    *
    * @see <a href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-extensions">§9. WebAuthn
    *     Extensions</a>
+   * @deprecated The <code>false</code> setting (default) is not compatible with WebAuthn Level 2
+   *     since authenticators are now always allowed to add unsolicited extensions. The next major
+   *     version release will remove this option and always behave as if the option had been set to
+   *     <code>
+   *     true</code>.
    */
-  @Builder.Default private final boolean allowUnrequestedExtensions = false;
+  @Deprecated @Builder.Default private final boolean allowUnrequestedExtensions = false;
 
   /**
    * If <code>false</code>, {@link #finishRegistration(FinishRegistrationOptions)