🥀 Thistle

v5.0 - 12 Aug 2026

Added

• Added needsRehash() so hashes migrate forward automatically on login — your whole user base upgrades itself one sign-in at a time, no reset emails
• Added a Pest test suite, run through Alchemy

Changed

• spice() is now a true [pepper](https://en.wikipedia.org/wiki/Pepper_(cryptography)): passwords are keyed through HMAC-SHA256 with your spice before hashing. New hashes use the stronger scheme automatically, and hashes created on earlier versions still verify through a fallback
• Password::ARGON2 now maps to Argon2id
• Removed the Password::MD5 constant
• Password now requires PHP 8.2+ and jumps from v1.0 to v5.0 to version alongside the rest of Leaf 5