Enterprise Security Bundle Laravel Package

What's Changed

• SLS-170: Upgrade to Symfony 8 by @FilipHoracek in https://github.com/3BRS/enterprise-security-bundle/pull/15

Full Changelog: https://github.com/3BRS/enterprise-security-bundle/compare/v2.4.0...v2.5.0

What's Changed

• 2.3.0: extract the passkey assertion and known-device abstracts by @ondrej-kuhnel in https://github.com/3BRS/enterprise-security-bundle/pull/13

Full Changelog: https://github.com/3BRS/enterprise-security-bundle/compare/v2.2.2...v2.3.0

What's Changed

• SLS-145: ES: Password login fixes by @FilipHoracek in https://github.com/3BRS/enterprise-security-bundle/pull/6

Full Changelog: https://github.com/3BRS/enterprise-security-bundle/compare/v2.0.0...v2.1.0

What's Changed

• SLS-141: OAuth: store Apple in a dedicated SameSite=None cookie (so … by @FilipHoracek in https://github.com/3BRS/enterprise-security-bundle/pull/5
• SLS-142: Change validation method of linking already existing account, change password login disabled to global settings by @FilipHoracek in https://github.com/3BRS/enterprise-security-bundle/pull/4

Full Changelog: https://github.com/3BRS/enterprise-security-bundle/compare/v1.1.0...v2.0.0

Password-expiration fix + magic-link/passkey now bypass 2FA.

• Fix: enabling password expiration no longer forces a reset on every existing user. Users without a recorded passwordChangedAt now fall back to the account creation date (getCreatedAt()), so only accounts older than the window are affected.
• Change: magic-link and passkey logins authenticate directly and bypass 2FA — the second factor guards plain password login only.

⚠️ Requires integration changes — see UPGRADE.md (new getCreatedAt() contract method, updated verify-controller constructors, removed skip_2fa_when_user_verified).