Update dependency otplib to v13

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
otplib (source)	^12.0.1 → ^13.0.0

---

Release Notes

yeojz/otplib (otplib)

v13.3.0: otplib 13.3.0

Compare Source

What's Changed

• ci: standardize workflow naming and add release artifacts by @​yeojz in #​775
• chore(deps-dev): bump turbo from 2.7.5 to 2.7.6 in the dev-dependencies-patch group by @​dependabot[bot] in #​773
• chore(deps): bump changesets/action from 1.5.3 to 1.6.0 in the github-actions group by @​dependabot[bot] in #​774
• chore(deps-dev): bump the dev-dependencies-minor group with 3 updates by @​dependabot[bot] in #​772
• feat(cli): add otplib-cli application by @​yeojz in #​771
• Potential fix for code scanning alert no. 2: Workflow does not contain permissions by @​yeojz in #​776
• Implement least privilege permissions across all GitHub workflows by @​Copilot in #​777
• feat(test): add distribution tests package for cross-runtime testing by @​yeojz in #​778
• chore(deps): bump commander from 14.0.2 to 14.0.3 in the dependencies-patch group by @​dependabot[bot] in #​781
• chore(deps): bump actions/checkout from 4 to 6 in the github-actions group by @​dependabot[bot] in #​785
• chore(deps-dev): bump turbo from 2.7.6 to 2.8.1 in the dev-dependencies-minor group by @​dependabot[bot] in #​782
• chore(deps-dev): bump lefthook from 2.0.15 to 2.0.16 in the dev-dependencies-patch group by @​dependabot[bot] in #​783
• feat: security improvements and HOTP update-counter command by @​yeojz in #​780
• chore: update docs by @​yeojz in #​786
• Pin GitHub Actions to commit SHAs and update dependencies by @​yeojz in #​787
• fix: harden OTP validation and URI parsing; bubble up TOTP replay controls through otplib by @​yeojz in #​788
• feat: add OTPHooks for custom token encoding and validation by @​yeojz in #​790
• chore(deps-dev): bump the dev-dependencies-minor group with 5 updates by @​dependabot[bot] in #​791
• chore(deps-dev): bump turbo from 2.8.1 to 2.8.3 in the dev-dependencies-patch group by @​dependabot[bot] in #​792
• release(cli): v2.0.0 by @​github-actions[bot] in #​795
• chore: upgrade development Node.js baseline to 24 by @​yeojz in #​794
• chore(deps-dev): bump @​types/node from 20.19.30 to 25.2.2 by @​dependabot[bot] in #​793
• release(packages): v13.3.0 by @​github-actions[bot] in #​796

New Contributors

• @​Copilot made their first contribution in #​777

Full Changelog: yeojz/otplib@v13.2.1...v13.3.0

v13.2.1

Compare Source

What's Changed

• docs: refine mobile hero and base32 guidance by @​yeojz in #​767
• docs: improve plugin guides and light mode UI contrast by @​yeojz in #​768
• ci: update package versions by @​github-actions[bot] in #​769

Full Changelog: yeojz/otplib@v13.2.0...v13.2.1

v13.2.0

Compare Source

What's Changed

• docs: add legacy Google Authenticator troubleshooting guide by @​yeojz in #​754
• feat: add tuple semantics for counterTolerance with look-ahead default by @​yeojz in #​753
• docs: clarify Base32 as default encoding for string secrets by @​yeojz in #​755
• feat(docs): improve landing page UI with cipher theme by @​yeojz in #​757
• feat(plugin-base32-bypass): add base32 bypass plugin by @​yeojz in #​756
• chore(deps-dev): bump prettier from 3.7.4 to 3.8.0 in the dev-dependencies-minor group by @​dependabot[bot] in #​758
• feat(totp): add afterTimeStep parameter for replay protection by @​yeojz in #​749
• feat(adapters): initialize guardrails once in v11/v12 adapter constructors by @​yeojz in #​763
• docs: fix wrapResult example to use sync functions by @​yeojz in #​764
• chore(deps-dev): bump the dev-dependencies-patch group across 1 directory with 10 updates by @​dependabot[bot] in #​761
• feat(plugin-base32-alt): add hex and base64 bypass plugins by @​yeojz in #​765
• ci: update package versions by @​github-actions[bot] in #​766

Callout

• HOTP counterTolerance tuple has been fixed to [number, number] instead of the previous number[] . There was an erroneous logic from the intended documentation/usage . Please double check your HOTP tolerance if it's used.

Full Changelog: yeojz/otplib@v13.1.1...v13.2.0

v13.1.1

Compare Source

What's Changed

• chore(deps-dev): bump the dev-dependencies-minor group with 3 updates by @​dependabot[bot] in #​743
• Feat/docs add hotp example by @​yeojz in #​745
• fix: ensure guardrails parameter propagates through HOTP and TOTP call chains by @​yeojz in #​748
• ci: update package versions by @​github-actions[bot] in #​751

Full Changelog: yeojz/otplib@v13.1.0...v13.1.1

v13.1.0

Compare Source

What's Changed

• TOTP tolerance writeup by @​yeojz in #​737
• feat: allow guardrails to be overridden by @​yeojz in #​738
• feat: add HOTP support to generateURI for both TOTP and HOTP strategies by @​yeojz in #​740
• ci: update package versions by @​github-actions[bot] in #​742

Full Changelog: yeojz/otplib@v13.0.2...v13.1.0

v13.0.2

What's Changed

• ci: update package versions by @​github-actions[bot] in #​726
• Configure Dependabot for npm and GitHub Actions by @​yeojz in #​727
• chore(deps): bump @​scure/base from 1.2.6 to 2.0.0 by @​dependabot[bot] in #​732
• chore(deps-dev): bump tinybench from 2.9.0 to 6.0.0 by @​dependabot[bot] in #​730
• chore(deps): bump the github-actions group with 7 updates by @​dependabot[bot] in #​729
• chore(deps-dev): bump the dev-dependencies-patch group with 2 updates by @​dependabot[bot] in #​734
• chore(deps): bump @​noble/hashes from 1.8.0 to 2.0.1 by @​dependabot[bot] in #​733
• feat: adding codecov bundle analyser upload by @​yeojz in #​735
• ci: update package versions by @​github-actions[bot] in #​736

Full Changelog: yeojz/otplib@v13.0.0...v13.0.2

v13.0.0

Compare Source

What's Changed

• Version 13: Rewrite by @​yeojz in #​721
• ci: update package versions by @​github-actions[bot] in #​725

Full Changelog: yeojz/otplib@v12.0.1...v13.0.0

Related Issues

Issue	Title
Closes #​711	Thirty-two... using new Buffer()
Closes #​703	Buffer... preventing Expo usage
Closes #​701	crypto.createHmac is not a function
Closes #​609	Can't resolve 'crypto'
Closes #​547	Cannot read property 'generate' of undefined
Closes #​361	Preset doesn't install core
Closes #​329	Edge SCRIPT1028 Error
Closes #​268	Broken Angular Karma tests
Closes #​207	TS verify/check Base32 typing
Closes #​178	Support for expo.io
Closes #​679	TS Consumer Version
Closes #​660	TSC target ES2017+
Closes #​693	Documentation offline
Closes #​425	API docs are broken
Closes #​677	Defaults to 15 bytes entropy
Closes #​671	Secret length too low
Closes #​376	Window=0 returns invalid
Closes #​555	Too many OTPs verified
Closes #​708	Window not taking delay
Closes #​698	Custom period (15s)
Closes #​511	Increase step time
Closes #​655	Distributed systems check
Closes #​610	Custom Timestamp
Closes #​536	Stop starting with "Zero"
Closes #​477	Secret padding in RFC
Closes #​710	Node.js Live Server
Closes #​696	2fa not working on live
Closes #​649	Client/Server different
Closes #​439	totp or authenticator
Closes #​704	Project Unmaintained

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.