spomky-labs/otphp

Release Notes for 11.5.0

Feature release (minor)

11.5.0

• Total issues resolved: 0
• Total pull requests resolved: 2
• Total contributors: 2

enhancement

• 280: fix: enforce minimum digest length thanks to @Spomky

DX,UX

• 276: docs: replace deprecated Google Charts example with local BaconQrCode thanks to @guillaumedelre

🔒 Security release

This release fixes two medium-severity advisories affecting Factory::loadFromProvisioningUri() — the entry point used to load third-party otpauth:// provisioning URIs. All versions < 11.4.3 are affected; upgrade to 11.4.3.

• GHSA-g7m4-839x-ch6v — an unbounded digits value made 10 ** digits overflow, raising an uncatchable DivisionByZeroError in at()/now()/verify(). digits is now bounded to 1..10.
• GHSA-2jx3-65f3-xr8r — a hostile URI key could mass-assign internal properties (state corruption, TypeError, readonly Error). Only label/issuer are now written; any failure surfaces as the documented InvalidProvisioningUriException.

Release Notes for 11.4.3

11.4.x bugfix release (patch)

11.4.3

• Total issues resolved: 0
• Total pull requests resolved: 1
• Total contributors: 1

bug

• 277: style: coding standards & static analysis on 11.4.x thanks to @Spomky

Release Notes for 11.4.2

11.4.x bugfix release (patch)

11.4.2

• Total issues resolved: 1
• Total pull requests resolved: 2
• Total contributors: 1

bug

• 265: Use static return type in OTPHP\OTP thanks to @anthonyryan1

Release Notes for 11.4.1

11.4.x bugfix release (patch)

11.4.1

• Total issues resolved: 1

• Total pull requests resolved: 1

• Total contributors: 2

• 262: fix: remove mbstring dependency for better PHP compatibility thanks to @Spomky and @timsmid

Release Notes for 11.4.0

Feature release (minor)

11.4.0

• Total issues resolved: 1
• Total pull requests resolved: 10
• Total contributors: 7

enhancement

• 251: feat: add custom exception hierarchy for better error handling thanks to @Spomky
• 249: Allow passing a custom secret size when generating OTP thanks to @Spomky
• 247: Accept OTP URIs with different issuer in label and parameter thanks to @Spomky and @dapphp
• 244: Add migration API for readonly classes thanks to @Slamdunk
• 204: allow passing a $secretSize when generating a secret thanks to @browner12

bug

• 248: Fix label validation to comply with Google Authenticator spec thanks to @Spomky

• 240: Allow generateURI to better handle creation with missing label or issuer thanks to @pkly

• 243: Enhance project configuration and add new files for improved coding s… thanks to @Spomky

• 237: Fix totp expires in thanks to @tomme87

Release Notes for 11.3.0

Feature release (minor)

11.3.0

• Total issues resolved: 0
• Total pull requests resolved: 6
• Total contributors: 2

dependencies

• 222: Update infection/infection requirement from ^0.26|^0.27|^0.28 to ^0.26|^0.27|^0.28|^0.29 thanks to @dependabot[bot]

• 221: Update paragonie/constant_time_encoding requirement from ^2.0 to ^2.0 || ^3.0 thanks to @dependabot[bot]

• 220: Bump actions/checkout from 3 to 4 thanks to @dependabot[bot]

• 219: Bump ramsey/composer-install from 2 to 3 thanks to @dependabot[bot]

• 189: Rector updated thanks to @Spomky

• 187: Feature/psr 20 thanks to @Spomky

Release Notes for 11.2.2

11.2.x bugfix release (patch)

11.2.2

• Total issues resolved: 0
• Total pull requests resolved: 1
• Total contributors: 1

DX

• 215: Fix http_build_query in OTP class thanks to @Spomky

Release Notes for 11.2.1

11.2.x bugfix release (patch)

11.2.1

• Total issues resolved: 0

• Total pull requests resolved: 2

• Total contributors: 2

• 213: Refactor PHP codebase and update dependencies thanks to @Spomky

bug

• 210: Explicitly set arg_seperator thanks to @ziegenberg

Release Notes for 11.1.1

11.1.x bugfix release (patch)

11.1.1

• Total issues resolved: 0

• Total pull requests resolved: 1

• Total contributors: 1

• 211: Merge release 11.0.3 into 11.1.x thanks to @github-actions[bot]

Release Notes for 11.0.3

11.0.3

• Total issues resolved: 0
• Total pull requests resolved: 1
• Total contributors: 1

DX,documentation

• 201: leeway/window Migration path clarification thanks to @Spomky