Skip to content

Conversation

@joostdebruijn
Copy link
Contributor

This PR updates the dependency pragmarx/google2fa to v9. This version contains a breaking change: the default secret key length has been increased from 16 to 32 characters for enhanced security. However, Laravel Fortify explicitly sets the default value for the generation of a secret key to 16:

public function generateSecretKey(int $secretLength = 16)
{
return $this->engine->generateSecretKey($secretLength);
}

Therefore, bumping to v9 is not a breaking change for Laravel Fortify.

In theory we could set the value to 32 as well, as in the migration the field two_factor_secret is of type TEXT so an increase in the length of the secret would not be an issue but there might be other side effects as well as mentioned in the release notes of pragmarx/google2fa. Such a change would be better for in a future 2.x-release.

@taylorotwell taylorotwell merged commit 6f2d630 into laravel:1.x Nov 16, 2025
13 checks passed
@joostdebruijn joostdebruijn deleted the google2fa-v9 branch November 16, 2025 16:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants