Security Laravel Package

Added

• Extension hooks powered by artisanpack-ui/hooks (^1.2):
  • ap.security.sanitizedInput filter — wraps every Security::sanitize* return with (mixed $value, string $type, mixed $original).
  • ap.security.escapedOutput filter — wraps every Security::esc* return with (string $value, string $context, string $original).
  • ap.security.ksesAllowedTags filter — receives (array $allowedTags) from Security::kses(); a non-empty return overrides htmLawed's element whitelist for the call.
  • ap.security.csp.directives filter — fires inside CspPolicyService::getPolicy() with (array $directives, Request $request), letting host apps mutate the directive array before it is serialized.
  • ap.security.csp.violationHandled action — fires at the end of CspViolationHandler::handle() on stored violations with (CspViolationReport $report).
  • See the README "Hooks" section for full payload details and examples.

Fixed

• Security::sanitizeFloat() was declared to return float but returned the raw number_format() string, which raised a TypeError under strict_types=1 any time the method was actually called. The result is now explicitly cast to float before return.

Added

• Laravel 13 support. Widened the illuminate/support constraint to ^10.0|^11.0|^12.0|^13.0. Existing Laravel 10/11/12 users are unaffected; Laravel 13 is only selectable on PHP 8.3+ per its own framework constraint.

Changed

• Widened orchestra/testbench dev requirement to ^10.2|^11.0 so package tests can install against Laravel 13.
• Swept the package through Laravel Pint to bring it back in line with the configured code style (no behavioral changes).

Fixed

• Restore the csp:test command (CspTest) to the distributed package. An over-broad export-ignore rule (/src/**/*Test.php) stripped it from the release tarball, so SecurityServiceProvider registered a class that wasn't shipped — causing Target class [ArtisanPackUI\Security\Console\Commands\CspTest] does not exist during package discovery for every consumer.

Changed

• Promotes the 2.0.0-alpha.1 feature surface to the stable 2.0.0 release. No code changes from the alpha — see the alpha entry below for the complete 2.0 changelog.

Changed

• BREAKING: Repackaged from monolithic security toolkit into a focused core package plus sibling packages. Authentication, 2FA, RBAC, secure uploads, security analytics, and compliance now live in their own packages. See UPGRADE.md for the full migration guide.

Added

• Content Security Policy subsystem: nonce generator, policy service, policy builder, three presets (Strict, Relaxed, Livewire), violation reporting endpoint, csp-dashboard Livewire component, and Artisan commands (csp:test, csp:stats, csp:prune, csp:generate).
• Security testing toolkit: OWASP / header / dependency / configuration scanners, penetration attack simulator (SQL, XSS, CSRF, path traversal, auth bypass, injection), report generators (JSON, HTML, JUnit, SARIF, Markdown), benchmark suite, security gate, and GitHub Actions integration.
• Security audit Artisan commands: security:audit, security:scan, security:baseline, security:benchmark, security:check-config, security:test-headers, security:scan-deps, security:clear-rate-limits.
• Csp Facade alongside the existing Security Facade.
• [@csp_nonce](https://github.com/csp_nonce) Blade directive and <x-csp-nonce> component.
• Named rate limiters driven from config (web, api, login, password_reset).

Removed

• Authentication, 2FA, password complexity, account lockout, advanced sessions → moved to artisanpack-ui/security-auth.
• WebAuthn / FIDO2, SSO, social auth, biometric, device fingerprinting → moved to artisanpack-ui/security-advanced-auth.
• Roles, permissions, Blade directives, Gate integration → moved to artisanpack-ui/rbac.
• Secure file uploads, validation, malware scanning → moved to artisanpack-ui/secure-uploads.
• Security event logging, anomaly detection, SIEM export, incident response → moved to artisanpack-ui/security-analytics.
• GDPR / CCPA / LGPD compliance toolkit → moved to artisanpack-ui/compliance.

Changed

• Renamed vendor to ArtisanPack UI.

Fixed

• Issue with the kses() function.

Added

• Tests and a GitLab pipeline.

Removed

• Unnecessary files from the published package.

Added

• Initial release.