External redirects after logging are blocked. Note: Redirects to external URLs (e.g., https://example.com) are rejected to prevent open redirect attacks. This is a deliberate security measure. If an external redirect by other module (this module won't redirect the user) is detected, the user is redirected to their profile page instead, and a warning is logged.
Dependency update: Minimum version of web-auth/webauthn-lib bumped from ^5.2 to ^5.2.4.
This addresses GHSA-f7pm-6hr8-7ggm — an origin validation bypass in the upstream WebAuthn library.
Note:
There is a database update with this release, which means you need to run the database update after updating to this version from previous version. If you install this module for the first time on your site, then you can ignore this note.
