pragmarx/google2fa

PHP 8.6 (beta) support, Psalm static analysis, and CI/governance modernization.

Added

• PHP 8.6 (beta) added to the CI matrix, with automatic fallback while the
  toolchain catches up
• Psalm static analysis alongside PHPStan, including psalm/plugin-phpunit so
  the test suite resolves cleanly
• SECURITY.md, SUPPORT.md, and a Version Support policy documenting which
  branches receive fixes
• CONTRIBUTING.md, issue/PR templates, CODEOWNERS, and Dependabot
  (composer + github-actions)
• composer.json support block and expanded keywords

Changed

• Widened dev-tooling constraints: PHPUnit ~9-13, PHPStan ^1.0|^2.0
• Modernized CI: explicit PHP<->PHPUnit compatibility matrix, pcov coverage,
  updated action versions, added a legacy-stack verification job
• Simplified getTimestamp()'s division (credit: Michal Spacek, #232)

Fixed

• Codecov upload no longer hard-fails CI when the token is unavailable
  (e.g. fork pull requests)
• Removed the dead code-quality job and retired Scrutinizer (unused,
  pointed at a coverage file no longer produced)
• Three separate GitHub Actions were stuck on deprecated Node.js 20
  (actions/cache, codecov-action's internal pin, actions/setup-node)

No behavioral changes to secret generation, HMAC computation, or OTP
verification. See docs/audit/9.x-ci-and-governance/03-src-security-review.md
for the line-by-line review.

Added

• Support for PHP 8.6 (beta) in the CI test matrix, with automatic fallback (continue-on-error) while the toolchain catches up
• Psalm static analysis alongside PHPStan, including the psalm/plugin-phpunit plugin so PHPUnit's TestCase hierarchy resolves correctly
• SECURITY.md, SUPPORT.md, and a Version Support policy documenting which branches receive fixes
• composer.json support block (issues/source/docs/security) and expanded keywords (totp, hotp, otp, mfa, rfc4226, rfc6238)

Changed

• Widened dev-tooling constraints: PHPUnit ~9|~10|~11|~12|~13, PHPStan ^1.0|^2.0
• Modernized CI: explicit PHP↔PHPUnit compatibility matrix, pcov coverage, updated action versions, added a legacy-stack verification job
• Simplified getTimestamp()'s division (credit: Michal Špaček, cherry-picked from #232)

Fixed

• Codecov upload no longer hard-fails CI when secrets.CODECOV_TOKEN is unavailable (e.g. on fork pull requests)
• Removed the dead code-quality job (Prettier/Node.js) that never ran against this PHP-only package
• Retired .scrutinizer.yml, which pointed at a coverage file no longer produced; Codecov already covers this

Security

• No behavioral change to secret generation, HMAC computation, or OTP verification — see docs/audit/9.x-ci-and-governance/03-src-security-review.md for the line-by-line review

⚠️ Version 9.0.0 Breaking Change

Default Secret Key Length Increased

Version 9.0.0 introduces a breaking change: The default secret key length has been increased from 16 to 32 characters for enhanced security.

What Changed?

• generateSecretKey() now generates 32-character secrets by default (previously 16)
• This increases cryptographic entropy from 80 bits to 160 bits
• Maintains full compatibility with Google Authenticator and other TOTP apps

Migration Guide

If you want to keep the previous behavior (16-character secrets):

// Old default behavior (v8.x and below)
$secret = $google2fa->generateSecretKey();

// New way to get 16-character secrets (v9.0+)
$secret = $google2fa->generateSecretKey(16);

If you want to use the new default (32-character secrets):

// This now generates 32-character secrets by default
$secret = $google2fa->generateSecretKey();

Potential Impact Areas

- Database schemas: Check if your google2fa_secret columns can handle 32 characters
- Validation rules: Update any length validations that expect exactly 16 characters
- Tests: Update test assertions expecting 16-character secrets
- UI components: Ensure QR code displays and secret key fields accommodate longer secrets

Important: Existing 16-character secrets remain fully functional. Database updates are only needed if you want to use the new 32-character default behavior.

Why This Change?

While 16-character secrets meet RFC 6238 minimum requirements, 32-character secrets provide significantly better security:

- 16 chars: 80 bits of entropy (adequate but minimal)
- 32 chars: 160 bits of entropy (much stronger against brute force)

This change aligns with modern security best practices for cryptographic applications.

⚠️ Breaking Change

Added

• Increased default secret key length from 16 to 32 characters for enhanced security
• Cryptographic entropy increased from 80 bits to 160 bits
• Maintains full compatibility with Google Authenticator and other TOTP apps

Changed

• generateSecretKey() now generates 32-character secrets by default
• To maintain previous behavior, use generateSecretKey(16)
• Updated tests to reflect new default behavior

Security

• This change significantly improves security against brute force attacks
• 32-character secrets provide stronger cryptographic protection while maintaining RFC 6238 compliance

Added

• Test using GitHub Actions

Fixed

• Improve PHP 8.1 compatibility

Merge pull request #153 from antonioribeiro/analysis-YjDN3K

Apply fixes from StyleCI

[ci skip] [skip ci]

Added

• PHP 8 Support
• Tests
• Extract som test helpers
• PHPStan checks

Changed

• PHP required version bumped to >= 7.1
• Exception interfaces extending Throwable

Added

• PHPStan checks

Removed

• Constants::ARGUMENT_NOT_SET - This is a BC break

Drafted

• To fix inserted BC break

Added

• Base exception class and interfaces

Removed

• Support for PHP 5.4 to 7.0, will keep supporting PHP 7.1, 7.2, 7.3 & 7.4

Changed

• Remove dead Google Charts API

Changed

• Bacon QRCode package removed

Changed

• Relicensed to MIT

Changed

• It's now mandatory to enable Google Api secret key access by executing setAllowInsecureCallToGoogleApis(true);

Fixed

• Fix Base32 to keep supporting PHP 5.4 && 5.5.

Fixed

• Minor bugs

Changed

• Drop the Laravel support in favor of a bridge package (https://github.com/antonioribeiro/google2fa-laravel).
• Using a more secure Base 32 algorithm, to prevent cache-timing attacks.
• Added verifyKeyNewer() method to prevent reuse of keys.
• Refactored to remove complexity, by extracting support methods.
• Created a package playground page (https://pragmarx.com/google2fa)

Changed

• Drop support for PHP 5.3.7, require PHP 5.4+.
• Coding style is now PSR-2 automatically enforced by StyleCI.

Changed

• Package bacon/bacon-qr-code was moved to "suggest".

Fixed

• Allow paragonie/random_compat ~1.4|~2.0.

Changed

• Bumped christian-riesen/base32 to ~1.3
• Use paragonie/random_compat to generate cryptographically secure random secret keys
• Readme improvements
• Drop simple-qrcode in favor of bacon/bacon-qr-code
• Fix tavis setup for phpspec, PHP 7, hhvm and improve cache

Changed

• Fixed URL generation for QRCodes
• Avoid time attacks

Added

• First version.