v1.3.0 — InteractsWithSsrf, plus supply-chain and policy accuracy fixes

Added

• Cbox\Ssrf\Testing\InteractsWithSsrf — the test-side wiring the package was
  missing. Compose it into your base TestCase:

  use Cbox\Ssrf\Testing\InteractsWithSsrf;
  
  abstract class TestCase extends Orchestra\Testbench\TestCase
  {
      use InteractsWithSsrf;
  }

  $this->fakeSsrfDns(['evil.test' => ['169.254.169.254']]);
  
  expect(fn () => $this->ssrfGuard()->assertSafe('https://evil.test'))
      ->toThrow(Cbox\Ssrf\Exceptions\BlockedUrl::class);

  Method	Does
  fakeSsrfDns(array $dns)	Answers DNS from a fixed host => [addresses] table. Returns the FakeResolver.
  withSsrfConfig(array $overrides)	Sets config('ssrf.*') keys (given without the prefix) and reapplies them.
  ssrfGuard()	The UrlGuard as the application sees it, rebuilt from current config and DNS.
  refreshSsrfGuard()	Drops the memoised policy and guard. The others call it for you.

  It exists because the guard and its policy are container singletons built from
  config. If anything has already resolved the guard, a later
  config(['ssrf.enforce' => false]) silently changes nothing and the test asserts
  against the old policy — a green test proving the wrong thing. Every helper drops both
  singletons first. The package's own suite now goes through the trait rather than
  hand-rolling $this->app->instance(Resolver::class, ...), so it is exercised by every
  test rather than merely shipped.

Fixed

• SECURITY.md described the package as pre-1.0. It told researchers this was a
  "pre-1.0, best-effort" project and that only the latest 0.x tag received security
  fixes, while the package was at 1.2.0 — a supported-versions statement naming a
  version scheme the package had already left, which a reporter could read as putting
  their 1.x install out of scope. It now states the real policy: latest 1.x only, no
  LTS branch, no backports, and explicitly no response-time guarantee.

• branch-alias declared dev-main as 1.0.x-dev on a 1.2 package; it now tracks
  1.3.x-dev.

Changed

• pestphp/pest widened to ^4.0 || ^5.0 (was ^3.5 || ^4.0), so the dev toolchain
  covers the current major and the previous one. Pest tracks PHPUnit, not Laravel — v5
  requires phpunit ^13.2.6. Verified on both CI cells before widening: testbench ^11
  resolves Pest 5.0.3 / PHPUnit 13.2.6, testbench ^10 resolves Pest 4.7.7 / PHPUnit
  12.5.33, full suite green on each.

Upgrading

No changes required. Runtime behaviour and public API are unchanged; everything here
is additive or affects the dev toolchain and repository metadata only.

Full changelog: https://github.com/cboxdk/laravel-ssrf/blob/v1.3.0/CHANGELOG.md