2.0.1

Declares PHP 8.6 support. The php constraint gains ~8.6.0; the floor is unchanged. CI now runs 8.6 with PHP platform requirements ignored there, because upstream laminas packages still cap PHP at ~8.5.0.

No src/ changes. Under 8.6.0RC2 no deprecation originates in this package.

2.0.0

First major of this fork line. BC breaks relative to 1.10.1.

api-tools-oauth2 and bshaffer/oauth2-server-php are no longer required — both moved to require-dev with suggest entries. The OAuth2 adapter is one of several this package offers, and a consumer using HTTP basic/digest or a custom adapter should not be made to install an OAuth2 server. A consumer relying on this package to pull OAuth2 in transitively must now require it directly.

Verified by removing both packages outright: 157 of 186 tests pass and all 29 failures are OAuth2 paths, with no bootstrap fatal. Nothing about the coupling is structural — no extends/implements, Module::onMergeConfig touches the factory only as ::class (a compile-time string, no autoload), and both new sites sit behind config guards.

Removed the OAuth2 Mongo storage adapter — the 'mongo' case, createMongoAdapter(), createMongoDatabase() and the config/README examples. 'mongo' is now rejected as an invalid storage adapter type.

Removed the ServiceManager v2 back-compat shims across 9 classes.

Constraints on sibling forks widened to accept their new majors.

1.10.1

Retired phpunit 10 and added a monthly dependabot configuration. Removed the tracked .coveralls.yml.

ModuleTest::expectedListeners() is now static — non-static data providers are removed in phpunit 12, and this one blocked the bump. 36 will($this->returnValue(...)) and one will($this->returnCallback(...)) converted.

Thirty doubles became stubs, and four property declarations moved from MockObject to Stub: phpunit 12 stopped making stubs MockObject instances, which is a TypeError on 12+ and silent on 11. Three dead getTypeFromRequest expectations were relaxed — those tests set an explicit auth map, so the adapter is never asked.

Development tooling now at phpunit ^11.0 || ^12.0 || ^13.0, psalm ^6.14, laminas-coding-standard ^3.1.

No runtime behaviour changes. The only src/ edits are #[Override] attributes and their imports, so this is a patch release.

1.10.0

Supported PHP

~8.2.0 || ~8.3.0 || ~8.4.0 || ~8.5.0 — adds 8.5, drops 8.1.

Dependency declarations fixed

Four production dependencies were undeclared, all reachable only transitively:

dependency	evidence
psr/container ^1.1 || ^2.0	Psr\Container imported by 14 src/ classes
laminas/laminas-router ^3.16	Laminas\Router imported by 3
laminas/laminas-modulemanager ^2.19	Laminas\ModuleManager imported by 2
bshaffer/oauth2-server-php ^1.14.1	OAuth2\Server, GrantType, Request, Response, OpenID across src/, previously reaching this package only through api-tools-oauth2

Other changes

• Dependency floors raised to releases covering the whole supported range; api-tools-oauth2 → ^1.11, laminas-mvc → ^3.8 with a datasage/laminas-mvc VCS repository entry.
• src/Identity/IdentityInterface.php: getAuthenticationIdentity() gains a @return mixed annotation, required by the newer slevomat standard. Annotated rather than given a : mixed return type, which would break implementors.
• vimeo/psalm ^5 → ^6.14; baseline regenerated; one dead InternalMethod suppression removed.
• Removed 5 no-op setAccessible() calls from test/, deprecated in 8.5.
• config.platform.php 8.1.99 → 8.2.99.
• CI: .laminas-ci.json keeps its pdo / pdo-sqlite extensions and swaps the 8.4 platform-req ignore for doc-lint exclusions; removed release-on-milestone-closed.yml.

No functional src/ changes.

CI green on 8.2, 8.3, 8.4 and 8.5 across locked, lowest and latest. 188 tests, 500 assertions.

Known issues, unchanged here

• ModuleTest::expectedListeners() is a non-static data provider, which PHPUnit deprecates and PHPUnit 11 rejects. It reads $this in four places, so making it static is a restructure. This package does not depend on laminas-test, so phpunit stays at ^10 and it is not yet forced.
• src/Factory/OAuth2ServerFactory.php references MongoClient from the legacy mongo extension, removed in PHP 7. That path cannot execute on any supported PHP; it is dead code and a removal candidate.

1.9.1

What's Changed

• Fix issue with 8.4 constraint by @datasage in #2

Full Changelog: 1.9.0...1.9.1

1.9.0

What's Changed

• Enable php 8.3 and 8.4 by @datasage in #1

New Contributors

• @datasage made their first contribution in #1

Full Changelog: https://github.com/datasage/api-tools-mvc-auth/commits/1.9.0