Skip to content

v9.1.0

v9.1.0: version 9.1.0
@antonioribeiro antonioribeiro tagged this 15 Aug 13:27 
PHP 8.6 (beta) support, Psalm static analysis, and CI/governance modernization.

Added
- PHP 8.6 (beta) added to the CI matrix, with automatic fallback while the
  toolchain catches up
- Psalm static analysis alongside PHPStan, including psalm/plugin-phpunit so
  the test suite resolves cleanly
- SECURITY.md, SUPPORT.md, and a Version Support policy documenting which
  branches receive fixes
- CONTRIBUTING.md, issue/PR templates, CODEOWNERS, and Dependabot
  (composer + github-actions)
- composer.json support block and expanded keywords

Changed
- Widened dev-tooling constraints: PHPUnit ~9-13, PHPStan ^1.0|^2.0
- Modernized CI: explicit PHP<->PHPUnit compatibility matrix, pcov coverage,
  updated action versions, added a legacy-stack verification job
- Simplified getTimestamp()'s division (credit: Michal Spacek, #232)

Fixed
- Codecov upload no longer hard-fails CI when the token is unavailable
  (e.g. fork pull requests)
- Removed the dead code-quality job and retired Scrutinizer (unused,
  pointed at a coverage file no longer produced)
- Three separate GitHub Actions were stuck on deprecated Node.js 20
  (actions/cache, codecov-action's internal pin, actions/setup-node)

No behavioral changes to secret generation, HMAC computation, or OTP
verification. See docs/audit/9.x-ci-and-governance/03-src-security-review.md
for the line-by-line review.
Assets 2
Loading