Fortify Laravel Package

• Migration from Mockery to Double by @jasonmccreary in https://github.com/laravel/fortify/pull/699
• TwoFactorEnabledResponse and TwoFactorDisabledResponse implement wrong interface by @SameOldNick in https://github.com/laravel/fortify/pull/701
• Apply fixes from StyleCI by @taylorotwell in https://github.com/laravel/fortify/pull/702
• Bump to Double v1 by @jasonmccreary in https://github.com/laravel/fortify/pull/703

• Introduction of Timebox to prevent Timing-based Username Enumeration by @bretto36 in https://github.com/laravel/fortify/pull/697

• Fix repeat 2FA enable deleting pending secret by @wakqasahmed in https://github.com/laravel/fortify/pull/696

• Bump actions/checkout from 7.0.0 to 7.0.1 in the github-actions group by @dependabot[bot] in https://github.com/laravel/fortify/pull/690
• [1.x] Supports PHPStan 2 by @crynobone in https://github.com/laravel/fortify/pull/691
• Add option to override RecoveryCode class by @TobiasNagel01 in https://github.com/laravel/fortify/pull/694

• Add Dependabot cooldown of 5 days by @nunomaduro in https://github.com/laravel/fortify/pull/679
• Enable Dependabot auto-merge by @nunomaduro in https://github.com/laravel/fortify/pull/680
• Bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions group by @dependabot[bot] in https://github.com/laravel/fortify/pull/681
• Bump shivammathur/setup-php from 2.37.1 to 2.37.2 in the github-actions group by @dependabot[bot] in https://github.com/laravel/fortify/pull/684
• Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group by @dependabot[bot] in https://github.com/laravel/fortify/pull/686
• [1.x] Use literal status code in LockoutResponse to fix PHPStan analysis by @jklejczyk in https://github.com/laravel/fortify/pull/688
• [1.x] Respect lowercase_usernames config when resetting password by @jklejczyk in https://github.com/laravel/fortify/pull/687

What's Changed

• [1.x] Fix passkey password confirmation defaults by @benbjurstrom in https://github.com/laravel/fortify/pull/678

Full Changelog: https://github.com/laravel/fortify/compare/v1.37.1...v1.37.2

What's Changed

• [1.x] Bump actions/checkout from v4 to v6 by @mon4ssi in https://github.com/laravel/fortify/pull/673
• Pin GitHub Actions to commit SHAs and add Dependabot config by @joetannenbaum in https://github.com/laravel/fortify/pull/674
• [1.x] update passkeys and set passkeys management middleware by @benbjurstrom in https://github.com/laravel/fortify/pull/676
• Bump shivammathur/setup-php from 2.37.0 to 2.37.1 in the github-actions group by @dependabot[bot] in https://github.com/laravel/fortify/pull/677

New Contributors

• @mon4ssi made their first contribution in https://github.com/laravel/fortify/pull/673
• @joetannenbaum made their first contribution in https://github.com/laravel/fortify/pull/674
• @dependabot[bot] made their first contribution in https://github.com/laravel/fortify/pull/677

Full Changelog: https://github.com/laravel/fortify/compare/v1.37.0...v1.37.1

• Drop support for PHP 8.1 and Laravel 10 by @benbjurstrom in https://github.com/laravel/fortify/pull/669
• Fix incompatibility between Laravel Fortify and FormRequest::failOnUnknownFields() by @crynobone in https://github.com/laravel/fortify/pull/670
• Feat/add passkeys by @benbjurstrom in https://github.com/laravel/fortify/pull/668

• Rewrite Fortify core guidelines and skill descriptions in imperative style by @pushpak1300 in https://github.com/laravel/fortify/pull/662
• Update reference from Jetstream to Starter Kits by @MrPunyapal in https://github.com/laravel/fortify/pull/663

• [1.x] Makes imports consistent by @nunomaduro in https://github.com/laravel/fortify/pull/659

• Rename Skill by @pushpak1300 in https://github.com/laravel/fortify/pull/657

• Add @throws annotation to create() docblock by @mohammadRezaei1380 in https://github.com/laravel/fortify/pull/634
• Add @throws annotation to function() docblock by @mohammadRezaei1380 in https://github.com/laravel/fortify/pull/635
• Use scoped bindings for Octane compatibility by @vrodriguero in https://github.com/laravel/fortify/pull/637
• Clarify Two-Factor Authentication database column requirements by @mohammadRezaei1380 in https://github.com/laravel/fortify/pull/638
• add @throws \Illuminate\Validation\ValidationException to functions() in Http\Responses by @mohammadRezaei1380 in https://github.com/laravel/fortify/pull/639
• Clarify Sanctum usage in SPA authentication setup by @mohammadRezaei1380 in https://github.com/laravel/fortify/pull/641
• Clarify Two-Factor Authentication JSON responses for SPA mode by @mohammadRezaei1380 in https://github.com/laravel/fortify/pull/640
• Clarify required guard for SPA authentication setup by @mohammadRezaei1380 in https://github.com/laravel/fortify/pull/643
• add @throws in function UpdateUserProfileInformation.php by @mohammadRezaei1380 in https://github.com/laravel/fortify/pull/644
• Update @return type of toResponse() to mixed for accuracy by @mohammadRezaei1380 in https://github.com/laravel/fortify/pull/645
• add @throws ValidationException function in AttemptToAuthenticate.php by @mohammadRezaei1380 in https://github.com/laravel/fortify/pull/646
• Fix docblock for index() to reflect array or JsonResponse return type by @mohammadRezaei1380 in https://github.com/laravel/fortify/pull/650
• add @throws ValidationException function in ConfirmTwoFactorAuthentication.php by @mohammadRezaei1380 in https://github.com/laravel/fortify/pull/649
• Fix two-factor QR code controller return type by @mohammadRezaei1380 in https://github.com/laravel/fortify/pull/652
• Update docblock return type for email verification store method by @mohammadRezaei1380 in https://github.com/laravel/fortify/pull/654

• Supports Laravel 13 by @crynobone in https://github.com/laravel/fortify/pull/631

What's Changed

• [1.x] Add Skills support by @pushpak1300 in https://github.com/laravel/fortify/pull/630

Full Changelog: https://github.com/laravel/fortify/compare/v1.33.0...v1.34.0

• Added dedicated Request object to PasswordResetLinkController by @chrispage1 in https://github.com/laravel/fortify/pull/628
• Change callback parameter type to callable|string by @Propaganistas in https://github.com/laravel/fortify/pull/629

• [1.x] PHP 8.5 Compatibility by @crynobone in https://github.com/laravel/fortify/pull/621

• [1.x] Add Features::canUpdatePasswords() method by @jrd-lewis in https://github.com/laravel/fortify/pull/617
• [1.x] chore: bump to pragmarx/google2fa v9 by @joostdebruijn in https://github.com/laravel/fortify/pull/619

• Resolves issue #592 - RecoveryCodeReplaced event dispatched twice by @coolAlias in https://github.com/laravel/fortify/pull/616

• [1.x] Add Laravel Fortify guidelines for boost by @pushpak1300 in https://github.com/laravel/fortify/pull/614

• Breaking Change: Revert "Validate password is a string when confirming password" by @themsaid in https://github.com/laravel/fortify/pull/612

• [1.x] single indentation on multiline ternarys by @browner12 in https://github.com/laravel/fortify/pull/605
• Validate password is a string when confirming password by @devfrey in https://github.com/laravel/fortify/pull/606
• Fix conflicts with app factories, causing recursive definitions in IDE by @crynobone in https://github.com/laravel/fortify/pull/609
• Add Fortify::encryptUsing() to allow customising the default encryption by @crynobone in https://github.com/laravel/fortify/pull/611
• Regenerate session on register by @valorin in https://github.com/laravel/fortify/pull/610

• [1.x] Add InteractsWithTwoFactorState Trait to handle 2FA state between requests by @pushpak1300 in https://github.com/laravel/fortify/pull/604

• fix: add missing route name to /user/two-factor-recovery-codes by @Barbapapazes in https://github.com/laravel/fortify/pull/602

• feat() : make Fortify honour Model::encryptUsing to enable app key rotation by @sebestenyb in https://github.com/laravel/fortify/pull/601

• Allow RedirectIfTwoFactorAuthenticatable to be resolved via the Container by @Junveloper in https://github.com/laravel/fortify/pull/599

• Delete existing tokens when user updates password by @patrickomeara in https://github.com/laravel/fortify/pull/598

• Prevent empty username fields from being added to requests by @edvardsr in https://github.com/laravel/fortify/pull/590
• Supports Laravel 12 by @crynobone in https://github.com/laravel/fortify/pull/591

• DisableTwoFactorAuthentication should always set two_factor_confirmed_at to null when it has a value by @crynobone in https://github.com/laravel/fortify/pull/589

• [1.x] Use retrieveByCredentials() on the User Provider instead of a hardcoded Eloquent query by @pascalbaljet in https://github.com/laravel/fortify/pull/582
• Changed migration of users table by @aronbeurskens in https://github.com/laravel/fortify/pull/586

• Replace implicitly nullable parameters for PHP 8.4 by @JeppeKnockaert in https://github.com/laravel/fortify/pull/580

• Add Remember Me Functionality to Registered User Login by @cvairlis in https://github.com/laravel/fortify/pull/579

• [1.x] Supports PHP 8.4 by @crynobone in https://github.com/laravel/fortify/pull/576

• Rename POST routes to avoid regression bugs by @cima-alfa in https://github.com/laravel/fortify/pull/574

• Update logo to support dark/light theme by @milewski in https://github.com/laravel/fortify/pull/569
• Fix unnamed routes when views are disabled (with original code formatting) by @cima-alfa in https://github.com/laravel/fortify/pull/571

• Adding context length configuration for 2FA to ensure better security standards by @MattLoyeD in https://github.com/laravel/fortify/pull/568

• [1.x] Add X-Retry-After to /user/confirm-password/status response by @crynobone in https://github.com/laravel/fortify/pull/565

• [1.x] Support case insensitive password resets by @mattmcdonald-uk in https://github.com/laravel/fortify/pull/562
• Dispatch RecoveryCodeReplaced Event by @stephenjude in https://github.com/laravel/fortify/pull/564

• Fire ValidTwoFactorAuthenticationCodeProvided Event when 2FA session is authenticated by @stefanzweifel in https://github.com/laravel/fortify/pull/559

• [1.x] Rehash password if required when user uses two factor by @gdebrauwer in https://github.com/laravel/fortify/pull/557
• [1.x] Add TwoFactorAuthenticationFailed event by @antergos98 in https://github.com/laravel/fortify/pull/558

• [1.x] Allow redirect()->intended() responses to be resolved via the Container by @crynobone in https://github.com/laravel/fortify/pull/551

• [1.x] Use available $name property from SessionGuard if the value exists by @crynobone in https://github.com/laravel/fortify/pull/553