2.14.2

Security

Hardens cipher decoding: unserialize() is now called with ['allowed_classes' => false], so decoding a payload cannot instantiate classes from it. Upgrading is recommended for all consumers.

Backward compatible: the serialized format is unchanged, so existing secrets decrypt as before and no re-encryption is needed.

What's Changed

• PAT-1999 Forbid class instantiation when unserializing ciphers by @pepamartinec in #60

Full Changelog: 2.14.1...2.14.2

2.13.1

What's Changed

• change secret name to be more unique by @odinuv in #56

Full Changelog: 2.12.0...2.13.1

2.12.0

What's Changed

• PAT-82 Add support for Federated OIDC token auth on Azure by @pepamartinec in #55

Full Changelog: 2.11.1...2.12.0

2.11.1

What's Changed

• (csas-migration) PST-2411: Store in trans AKV during encrypt() by @romantmb in #54

Full Changelog: 2.11.0...2.11.1

2.11.0

What's Changed

(csas-migration)

• PST-2410: Backfill into new AKV during decrypt() by @romantmb in #52
• PST-2407: Add extra AKV client by @romantmb in #51

Full Changelog: 2.10.0...2.11.0

2.10.0

What's Changed

• PST-2436: Ignore secret version when retrieving secrets from AKV by @romantmb in #53

Full Changelog: 2.9.0...2.10.0

2.9.0

What's Changed

• PST-1842: Tolerate empty strings in decryption by @romantmb in #50

New Contributors

• @romantmb made their first contribution in #50

Full Changelog: 2.8.1...2.9.0

2.8.1

What's Changed

• cleanup garbage by @odinuv in #48
• GCP-490: feat (GkmsClientFactory): set Google client timeouts by @MiroCillik in #49

Full Changelog: 2.8.0...2.8.1

2.8.0

What's Changed

• Added support for Google cloud KMS.
• Dropped support for PHP 8.1

Full Changelog: 2.7.1...2.8.0

2.7.1

What's Changed

• SOX-154 Match variables patter using Regex from variables regex renderer by @pepamartinec in #40

Full Changelog: 2.7.0...2.7.1