v1.2.1

Changed

• Environment-file discovery is now name-agnostic by default: every plaintext .env and .env.* file in Laravel's configured environment directory is scanned and compared by key inventory, so .env.example is no longer a required or implicit canonical reference file.
• Commented assignments in discovered non-active environment files count as documented key inventory, while commented assignments in Laravel's active environment file never satisfy active key presence.
• reference_files and compare_files remain available as explicit opt-in controls. A missing-reference-file warning is now emitted only for a reference file that the project explicitly configured.
• Renamed templates and .env.dist participate in automatic discovery; encrypted and common backup artifacts remain excluded from plaintext inspection.

v1.2.0

Changed

• Automatic full-project audits are console-first by default through console_only, avoiding a complete static scan on every normal HTTP request.
• Every audit now reads and analyzes the current source/environment state directly; the persistent laravel-env-guard.json findings cache, metadata invalidation machinery, and cache_path configuration have been removed.
• EnvGuard::inspect() retains the legacy fresh and fingerprint result fields for 1.x compatibility; fresh is always true and the fingerprint is an in-memory signature of the current sanitized findings only.
• Upgrades from cache-based releases automatically remove the legacy default result cache and any previously configured custom cache_path on the next audit.

v1.1.0

Added

• Fresh Laravel 12 and Laravel 13 end-to-end scenarios now verify package discovery, blocking env() misuse, secret-value non-disclosure, and configuration-cache transitions in real applications.
• Fresh-application E2E installs now use a deterministic copied Composer path repository instead of relying on VCS version inference or symlink behavior.
• CI now validates minimum dependency sets, Linux ARM64 portability, pull-request dependency changes, the full supported PHP/Laravel matrix, and an independent 80% coverage gate while skipping expensive jobs for documentation-only changes.
• CI portability now covers Windows-safe Composer version constraints and cross-platform environment-path assertions.
• Composer quality scripts now include strict manifest, security and optimized-autoload checks, with check:all providing the complete local quality plus Pest gate.
• Metadata cache invalidation now tracks Laravel configuration-cache state and cache path so configuration-cached diagnostics cannot become stale across config:cache and config:clear transitions.
• Filesystem regression coverage now verifies custom Laravel environment paths and filenames, configured maximum source size, and that symlinked source files are not followed.
• The exact Composer release archive is now validated for required runtime files, excluded development-only files, strict manifest validity, and installation into a fresh Laravel 13 application.
• Repository presentation now surfaces the existing Distribution workflow, a concise package tagline and the full scenario model near the top of the README.
• Guarded Artisan commands now render current warning/error findings to STDERR while retaining change-based Laravel logging and key-only secret-safe diagnostics.
• Laravel 12/13 optional framework keys now avoid used-but-undeclared noise while inactive and automatically re-enter normal auditing when declared or supplied at runtime.
• Fresh Laravel 12/13 E2E coverage now verifies optional-key suppression, activation, console visibility, Laravel logging, framework-owned keys, and value non-disclosure.

v1.0.0

Initial stable release of Laravel Env Guard.

Highlights:

• automatic development-time environment auditing
• Laravel 12 and Laravel 13 support
• .env, .env.example and .env.testing consistency checks
• env() outside config detection
• Vite, PHPUnit and Docker environment usage detection
• duplicate, casing and environment drift diagnostics
• no environment values stored in findings, logs or cache data