Bump otplib from 12.0.1 to 13.5.0

[dependabot]

Bumps otplib from 12.0.1 to 13.5.0.

Release notes

Sourced from otplib's releases.

v13.5.0

What's Changed

• test: mutation-testing audit — close test gaps, add Stryker tooling + manual CI by @​yeojz in yeojz/otplib#865
• chore(deps-dev): bump vite from 8.0.14 to 8.0.16 by @​dependabot[bot] in yeojz/otplib#864
• chore(deps): bump the github-actions group across 1 directory with 7 updates by @​dependabot[bot] in yeojz/otplib#872
• chore(deps-dev): bump the dev-dependencies-minor group across 1 directory with 10 updates by @​dependabot[bot] in yeojz/otplib#871
• chore(deps): bump commander from 14.0.3 to 15.0.0 by @​dependabot[bot] in yeojz/otplib#866
• fix: reject unknown hash algorithms instead of silently substituting by @​yeojz in yeojz/otplib#874
• test(fuzz): cover scalar HOTP counter tolerance semantics by @​yeojz in yeojz/otplib#876
• chore(deps-dev): bump vite from 8.1.5 to 8.2.0 by @​dependabot[bot] in yeojz/otplib#875
• fix: constrain esbuild for VitePress by @​yeojz in yeojz/otplib#877
• chore(deps-dev): resolve dependabot alerts via pnpm overrides by @​yeojz in yeojz/otplib#878
• chore(deps-dev): migrate to TypeScript 6.0.3 by @​yeojz in yeojz/otplib#879
• docs: collapse API section by default by @​yeojz in yeojz/otplib#880
• release(packages): v13.5.0 by @​github-actions[bot] in yeojz/otplib#881

Full Changelog: yeojz/otplib@v13.4.1...v13.5.0

---

Important behaviour change in this bugfix release.

[!NOTE] This is a bugfix release but has potentially breaking behaviour for library users passing invalid inputs (which is more likely in non-TypeScript or loosely-typed environments).

This release (#874) makes hash algorithm validation consistent and strict across all crypto plugins. Previously, an unrecognised algorithm string was handled differently by each plugin:

input	noble	node	web
'SHA1'	silently computed SHA-512	worked (OpenSSL alias tolerance)	threw a raw TypeError
'totally-bogus'	silently computed SHA-512	threw	threw

All three now reject anything outside sha1/sha256/sha512 (case-insensitive, single-separator aliases like SHA-1 or sha_256 accepted) by throwing the new AlgorithmUnsupportedError, instead of silently substituting a different digest.

A library dependents passing a correctly-spelled algorithm name ('sha1', 'SHA1', 'sha-256', etc.) sees no change other than clearer, stricter errors on genuinely invalid input. In TypeScript-strict environments this is mostly moot as algorithm is typed as 'sha1' | 'sha256' | 'sha512', so a hardcoded typo like 'SHA1' won't compile. It can still surface if the value comes from outside the type system (e.g. JSON.parse, process.env, or an as HashAlgorithm cast).

If you were relying on noble's old silent fallback to SHA-512 for a misspelled or unrecognised algorithm string, tokens generated/verified that way will stop matching after upgrading with no error on the old side, just tokens that quietly stop verifying.

To recover

• Change algorithm to sha512,
• or re-enroll the affected accounts.

See "Existing enrollments stopped verifying after an upgrade" for details.

v13.4.1

What's Changed

• fix: override flatted package security alert by @​yeojz in yeojz/otplib#820
• fix: override picomatch and yaml package security alerts by @​yeojz in yeojz/otplib#822
• refactor(testing): replace custom Deno adapter with @​std/expect by @​yeojz in yeojz/otplib#821

... (truncated)

Commits

• 97069d8 release(packages): v13.5.0 (#881)
• 44d0dfc chore(deps-dev): migrate to TypeScript 6.0.3 (#879)
• 6b991f5 fix: reject unknown hash algorithms instead of silently substituting (#874)
• 1d997b0 release(packages): v13.4.1 (#854)
• 0e9566f docs(otplib): note 16-byte minimum and fix broken secret-handling link (#851)
• e01b4f1 chore(deps-dev): bump the dev-dependencies-patch group across 1 directory wit...
• 212534b chore(deps-dev): bump the dev-dependencies-minor group with 4 updates (#828)
• b54adad refactor(testing): rename test secret constants for semantic clarity (#832)
• 4898252 refactor(testing): centralize test secrets and normalize naming (#831)
• e5490bb release(packages): v13.4.0 (#819)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for otplib since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)