release-2024-10-18: Dynamic captcha

This is Internet Identity release release-2024-10-18 for commit 14cbf0f3c15eaa476d2b42e8754188328448b5f5.

The sha256 of production asset internet_identity_production.wasm.gz is 6bd39a8f4730e9590ca144b3d618d9e3a7dfea389720fa81c9d2928a714623b5.

This release adds a new functionality that will improve the onboarding experience: dynamic captcha.

The captcha during the registration flow is considered a significant source of friction for onboarding new users.

The dynamic captcha aims to balance usability and resilience against bots by making it a dynamic element in the registration flow; only required when the registration rate is suspiciously high.

Update For Developers

If no configuration is passed, the captcha is enabled. However, developers can add the init_arg in their dfx.json to disable the captcha for their development environments. We updated the example to use the new argument.

What's Changed

• Wait longer for e2e test window to close by @frederikrothenberger in #2636
• Update release in README by @gix-bot in #2637
• Track registration rate and expose metrics by @frederikrothenberger in #2634
• Only require captcha if threshold rate is exceeded by @frederikrothenberger in #2638
• Remove unnecessary counters from persistent state by @frederikrothenberger in #2639
• Remove interface check breaking change exception by @frederikrothenberger in #2640
• Update node version by @gix-bot in #2641
• Update dfx by @gix-bot in #2642
• Update dapps list by @gix-bot in #2643
• Update dapps list by @gix-bot in #2644
• Update dapps list by @gix-bot in #2645
• Update dapps list by @gix-bot in #2646
• Update dapps list by @gix-bot in #2649
• Bump astro from 4.5.0 to 4.16.1 by @dependabot in #2648
• Make identity metadata update synchronous by @frederikrothenberger in #2651
• Add new metrics to monitor memory by @lmuntaner in #2650
• Add script test canisters by @lmuntaner in #2652
• Update lit-html by @frederikrothenberger in #2653
• Switch II front-end to API v2 for registration by @frederikrothenberger in #2654
• Run e2e tests with captcha disabled by @frederikrothenberger in #2656
• Remove registration stepper by @frederikrothenberger in #2657
• Add loader animation on registration completion by @frederikrothenberger in #2658
• Update rust version by @gix-bot in #2659
• Update instructions for dev-build without captcha by @frederikrothenberger in #2661
• Change how dynamic captcha stores data by @lmuntaner in #2660
• Add dfx deps default init args by @frederikrothenberger in #2662

Full Changelog: release-2024-10-01...release-2024-10-18

Build flavors

For more information please see the Build flavors section of the README.

Filename	sha256 (links to CI Run)
internet_identity_production.wasm.gz	6bd39a8f4730e9590ca144b3d618d9e3a7dfea389720fa81c9d2928a714623b5
internet_identity_dev.wasm.gz	94d0797edfc14ddf18c2d1406709df2931f37755a32de82f37caca5cdde8b04e
internet_identity_test.wasm.gz	d96af376f573a169d8758943c5712e4673a94ed14956068f77c142158ad82788
archive.wasm.gz	5cc69b679e8a51cb4b1449258b0939389b919774c2d7461256d62182574c7759
vc_demo_issuer.wasm.gz	d170e54c04344a67b7d293236400b30c214433ca461b803eb5f250b4ec720da2

Wasm Verification

To build the wasm modules yourself and verify their hashes, run the following commands from the root of the Internet Identity repository:

git pull # to ensure you have the latest changes.
git checkout 14cbf0f3c15eaa476d2b42e8754188328448b5f5
./scripts/verify-hash --ii-hash 6bd39a8f4730e9590ca144b3d618d9e3a7dfea389720fa81c9d2928a714623b5

Make sure to compare the hashes also with the proposal payload when verifying canister upgrade proposals.