`@preconcurrency import SwiftCBOR` is required because SwiftCBOR's `CBOR` is not `Sendable`

[zunda-pixel]

Summary

AttestationObject is a public struct … : Sendable that stores the attestation statement as a CBOR:

public struct AttestationObject: Sendable {
    ...
    let attestationStatement: CBOR
}

SwiftCBOR's CBOR type isn't annotated Sendable, so the module currently silences the resulting concurrency diagnostics with @preconcurrency import SwiftCBOR.

Affected files

• Sources/WebAuthn/Ceremonies/Registration/AttestationObject.swift
• Tests/WebAuthnTests/Utils/TestModels/TestAttestationObject.swift
• Tests/WebAuthnTests/Utils/TestModels/TestCredentialPublicKey.swift

Why this matters

@preconcurrency suppresses the Sendable requirement rather than satisfying it. Under Swift 6 strict concurrency this is an unchecked assumption that CBOR is safe to share across isolation domains — a latent soundness gap, plus tech debt that leaks into the test targets.

Possible resolutions

1. 1Add Sendable conformance to CBOR upstream in SwiftCBOR, then drop the @preconcurrency attribute.
2. 2Adopt a CBOR library whose value type is already Sendable (e.g. edgeengineer/cbor), removing the need for @preconcurrency. See Replace SwiftCBOR with edgeengineer/cbor #126.

(The decode-crash and library-maintenance topics are separate — already handled by #61 / discussed in #36. This issue is specifically about the Sendable gap.)