Merge pull request #2301 from w3c/history-since-l3-wd2

Add change history since Level 3 Working Draft 2

Author: emlun

index.bs

@@ -9964,6 +9964,32 @@ for their contributions as our W3C Team Contacts.
 
 This section summarizes the significant changes that have been made to this specification over time.
 
+## Changes since Web Authentication Level 3 Working draft 2 [[webauthn-3-20250127]] ## {#changes-since-l3-wd2}
+
+*These changes will be merged into the next section when finalizing Level 3.
+Changes to content that was not yet present in Level 2 are listed with a leading "(\*)" mark
+and will then be deleted from the merged change history.*
+
+Normative changes:
+
+- (*) Added dictionary extensions to {{AuthenticationExtensionsClientInputsJSON}}
+    and {{AuthenticationExtensionsClientOutputsJSON}} in definitions of extensions.
+- Added recommendation against using {{COSEAlgorithmIdentifier}} values -9, -51, -52 and -19
+    in {{PublicKeyCredentialCreationOptions/pubKeyCredParams}}.
+- Added requirement for ESP256 (-9), ESP384 (-51) and ESP512 (-52) public keys to use uncompressed form: [[#sctn-alg-identifier]]
+
+Editorial changes:
+
+- (*) Fixed section heading levels of test vectors subsections: [[webauthn-3-20250127#sctn-test-vectors]]
+- Removed outdated notes about permissions policy in [[webauthn-3-20250127#sctn-isUserVerifyingPlatformAuthenticatorAvailable]]
+    and [[webauthn-3-20250127#sctn-getClientCapabilities]].
+- Added algorithm -8 (EdDSA) to example code in [[webauthn-3-20250127#sctn-sample-registration]].
+- (*) Clarified meaning of `prf` extension output `enabled`: [[webauthn-3-20250127#dom-authenticationextensionsprfoutputs-enabled]]
+- (*) Fixed mistake in how test vectors were generated in [[webauthn-3-20250127#test-vectors-extensions-prf-ctap]].
+- (*) Changed Ed25519 test vectors to be generated from the seed `'packed.EdDSA'` instead of `'packed.Ed25519'`: [[#sctn-test-vectors-packed-eddsa]]
+- (*) Added Ed448 test vectors: [[#sctn-test-vectors-packed-ed448]]
+
+
 ## Changes since Web Authentication Level 2 [[webauthn-2-20210408]] ## {#changes-since-l2}
 
 ### Substantive Changes ### {#changes-l3-substantive}
@@ -9973,7 +9999,7 @@ The following changes were made to the [=Web Authentication API=] and the way it
 Changes:
 
 - Updated timeout guidance: [[#sctn-timeout-recommended-range]]
-- `uvm` extension no longer included; see instead L2 [[webauthn-2-20210408]]
+- `uvm` extension no longer included; see instead L2 [[webauthn-2-20210408]].
 - [=authData/attestedCredentialData/aaguid=] in [=attested credential data=] is no longer zeroed
     when {{PublicKeyCredentialCreationOptions/attestation}} preference is {{AttestationConveyancePreference/none}}: [[#sctn-createCredential]]