Warden 2.2.0

Warden 2.2.0

Warden 2.2 preserves scan integrity across source analysis, suppressions, notifications, and CI reports. This minor release adds multi-report output and improves scanner accuracy while keeping the supported PHP 8.3–8.5 and Laravel 12–13 matrix.

One scan, multiple reports

Repeat --report=format:path to generate additional reports from the same scan, timestamp, suppressions, and gate:

php artisan warden:audit --fail-on=high --format=github \
  --report=json-v2.1:warden.json --report=sarif:warden.sarif --report=junit:warden.xml

JUnit failures and GitHub annotations follow --fail-on. Explicit json-v2.1 and SARIF expose the selected gate; default JSON retains its existing strict contract. Equivalent output destinations, including symlinks and existing hard links, are rejected before scanning or writing any report.

Generated GitHub workflows retain reports, summarize scan results, and offer opt-in SARIF upload. Generated GitLab includes preserve existing stages, retain artifacts, and install npm when an npm lockfile is present. npm-shrinkwrap.json takes precedence over package-lock.json, and report locations identify the selected lockfile.

Scan integrity and compatibility

• Suppressions: Supplied fingerprints must be lowercase SHA-256 hashes, and expiry dates must be real calendar dates. Malformed suppressions return exit 2 before scanning. Omit the fingerprint key for an intentional rule-wide suppression.
• Source analysis: Sanitizers apply only to the corresponding sink. Imported class aliases, typed Laravel Request parameters, and named arguments are recognized. Existing fingerprints and baselines keep matching unchanged source after name resolution.
• File discovery: Supported hidden files, including .env.example and .github files, participate in credential scanning. Every credential match on a line is examined. .env contents remain excluded. Equivalent relative PHP and Blade paths such as ./app and app/. select the same files as app.
• Coverage: Unreadable directories make scans incomplete. Console and json-v2.1 reports expose scanned, skipped, and error counts; unreadable trees can contain an unknown number of files, so incomplete coverage counts are lower bounds.
• Custom audits: Registered inactive custom audits remain valid --only and --skip IDs and report skipped coverage.

Notifications

Existing notification preferences are preserved. Incomplete scans with no active findings stay silent in finding-only mode unless users explicitly set warden.notifications.on_errors=true. Missing or null uses existing filters; false silences entire incomplete reports, including those with findings. Delivery always requires a notification flag and configured channel, and never changes the audit exit code. Delivered incomplete reports describe the error instead of claiming all-clear. See the delivery table and 2.1 → 2.2 upgrade guidance.

Teams payloads are capped at 28,000 encoded JSON bytes while retaining scan status and counts. Truncated messages point to the full report for remaining details. Built-in channels use report-aware dispatch; legacy findings-only channel methods remain available. Completed emails preserve existing template overrides and sender/recipient settings; incomplete emails use explicit plain text so findings-only templates cannot falsely claim success.

Upgrade

Once this release is published:

composer require --dev 'dgtlss/warden:^2.2' --with-all-dependencies

Review UPGRADE.md for the intentional validation and notification changes. Stricter detection may expose findings previously hidden by cross-context sanitizers. Default JSON, including public object serialization and new JsonReporter(), remains compatible with the unchanged strict 2.0.0 schema. Choose --format=json-v2.1, --report=json-v2.1:path, or new JsonReporter(extended: true) for gate and coverage fields under the separate 2.1.0 schema. Generated CI explicitly opts into this format and its GitHub summary tolerates legacy reports without gate data. The default Warden JSON schema remains 2.0.0, the baseline schema 1.0.0, SARIF 2.1.0, and GitLab dependency-scanning schema 15.2.4; these versions are independent of the package version.

Composer continues to derive the package version from Git tags. These notes prepare the release; merging, tagging, and publication are separate steps.

Implemented in PR #35.