Password Exposed Laravel Package

• Allow the current PSR-6 cache adapter on PHP 8 so applications can resolve PSR Cache 2 or 3.
• Preserve the compatible v3 cache adapter for PHP 7.1 users.
• Restore compatibility with current Symfony cache components without raising the minimum PHP version.
• Document the conditional dependency behavior.

• Updated maintained development tooling.
• Added PHP 8.5 coverage.
• Migrated the PHPUnit configuration to the supported PHPUnit 9 schema.
• Verified PHP 8.1 through PHP 8.5, lint, and Psalm checks.

Changes

• Remove StyleCI integration/badge.
• Remove Coveralls config and dev dependency.
• Update GitHub Actions workflows to use actions/checkout@v6.

Dependabot PRs

• Merged: #43
• Closed: #44, #45, #46, #48

Changes

• Fix parsing of the HaveIBeenPwned API response to avoid exceptions on blank/whitespace lines (issue #35).
• Add GitHub Actions CI (PHPUnit on PHP 8.1–8.4, Psalm, PHP syntax lint) and remove Travis (issues #41, #42).
• Relax Composer constraints to allow:
  • psr/cache v1/v2/v3, and
  • psr/http-message v1/v2
    (issue #34).
• Mitigate rare Certainty concurrent rename() warnings by using a writable runtime cache directory and a file lock (issue #31).
• Add .gitattributes export-ignore rules (#40).

Merged PRs

• #40
• #36
• #33

Full Changelog: https://github.com/Jord-JD/password_exposed/compare/v4.0.0...v5.0.0

What's Changed

• Renamed Composer package from divineomega/password_exposed to jord-jd/password_exposed
• Updated repository/docs references to the new username
• Updated the README image asset to reflect the new package name
• Added replace metadata for divineomega/password_exposed
• Updated branch alias to 4.0-dev
• Updated Psalm config syntax for current Psalm versions

• Added support for PHP 8. Thanks @jameswilddev.

• Update minimum version of symfony/cache (see CVE-2019-18889).

• Force use of Certainty v2.4.x (defaults to a 5 second HTTP timeout).
• Retrieval of the Certainty bundle will now make the first attempt against the replica Chronicle, not the primary.

• Fix Laravel 5.7 incompatibility (#25).

• Dropped support for PHP 5.6, 7.0 and HHVM. PHP 7.1 or above is now required.
• Added support for using a custom PSR-6 caching library and PSR-18 HTTP client.
• Added additional password_is_exposed and password_is_exposed_by_hash helper functions which return a boolean that represents if a password has been exposed in a data breach, or null in case of error.

Special thanks to @nicklog for his work on this major release.

• Add a password_exposed_by_hash($hash) helper function to check if a password is exposed based on its SHA1 hash.

• Allow Certainty v2+.

• Add passwordExposedByHash method to check for password exposure by SHA1 hash.

• Improvements to unit tests.

• Fix compatibility with Windows and platforms that do not have a native /tmp/ directory.

• Remove function_exists check to fix psalm issues.

• Update version constraints and dependencies.

• Fix Psalm checks of getBundleFromCertainty() method.

• Support dependency injection to allow specifying custom Guzzle Client, PSR-6 CacheItemPool and Certainty Bundle.
• Improved Certainty bundle retrieval to handle cases where verification checks would be very slow (32-bit systems without sodium extension installed) and/or the vendor directory is not writable.

• Upgrade minimum PHP version to 5.6.
• Integration with paragonie/certainty for validated SSL/TLS certificates.
• Make docblocks type-safe.

Thanks to @paragonie-scott for security improvements.

• Prevent full SHA1s being exposed in cache file names, by setting the cache key to the first 5 characters of the hash.
• Caching of the response body, rather than the exposed status.

Thanks to @symm for the original idea. :)

• Use hash_equals to compare partial hashes. This should help mitigate timing attacks.
  • Thanks to @paragonie-scott.

This release also contains:

• Minor documentation improvements.

• Handle additional connection issues and timeouts.
  • PasswordStatus::UNKNOWN will be returned.

• Improvements to cache storage.

This release also includes:

• Minor text changes to documentation and composer package description.

• Upgrade to use Pwned Passwords API v2. See https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/
  • No rate limited requests.
  • Improved privacy via 'k-anonymity'.

• Temporary changes to work around this Travis CI issue: https://github.com/travis-ci/travis-ci/issues/6339

• Improved rate limiting.

• Added PSR-6 compliant caching.
• password_protect method now returns enum values, rather than a boolean.

This release also includes:

• Full installation and usage documentation.
• Testing improvements.
• Code styling fixes.

• Add user agent to requests.

This release also includes:

• Minor documentation changes.
• Refactoring of request creation.

• Initial release.