Bump pragmarx/google2fa from 8.0.3 to 9.0.0

[dependabot]

Bumps pragmarx/google2fa from 8.0.3 to 9.0.0.

Release notes

Sourced from pragmarx/google2fa's releases.

Version 9.0.0 Breaking Change

⚠️ Version 9.0.0 Breaking Change

Default Secret Key Length Increased

Version 9.0.0 introduces a breaking change: The default secret key length has been increased from 16 to 32 characters for enhanced security.

What Changed?

• generateSecretKey() now generates 32-character secrets by default (previously 16)
• This increases cryptographic entropy from 80 bits to 160 bits
• Maintains full compatibility with Google Authenticator and other TOTP apps

Migration Guide

If you want to keep the previous behavior (16-character secrets):

// Old default behavior (v8.x and below)
$secret = $google2fa->generateSecretKey();
// New way to get 16-character secrets (v9.0+)
$secret = $google2fa->generateSecretKey(16);
If you want to use the new default (32-character secrets):
// This now generates 32-character secrets by default
$secret = $google2fa->generateSecretKey();
Potential Impact Areas

Database schemas: Check if your google2fa_secret columns can handle 32 characters
Validation rules: Update any length validations that expect exactly 16 characters
Tests: Update test assertions expecting 16-character secrets
UI components: Ensure QR code displays and secret key fields accommodate longer secrets

Important: Existing 16-character secrets remain fully functional. Database updates are only needed if you want to use the new 32-character default behavior.
Why This Change?
While 16-character secrets meet RFC 6238 minimum requirements, 32-character secrets provide significantly better security:

16 chars: 80 bits of entropy (adequate but minimal)
32 chars: 160 bits of entropy (much stronger against brute force)

This change aligns with modern security best practices for cryptographic applications.

Changelog

Sourced from pragmarx/google2fa's changelog.

[9.0.0] - 202-09-18

⚠️ Breaking Change

Added

• Increased default secret key length from 16 to 32 characters for enhanced security
• Cryptographic entropy increased from 80 bits to 160 bits
• Maintains full compatibility with Google Authenticator and other TOTP apps

Changed

• generateSecretKey() now generates 32-character secrets by default
• To maintain previous behavior, use generateSecretKey(16)
• Updated tests to reflect new default behavior

Security

• This change significantly improves security against brute force attacks
• 32-character secrets provide stronger cryptographic protection while maintaining RFC 6238 compliance

[8.0.1] - 2020-05-05

Added

• Test using GitHub Actions

Fixed

• Improve PHP 8.1 compatibility

[8.0.0] - 2020-05-05

Added

• PHP 8 Support
• Tests
• Extract som test helpers
• PHPStan checks

Changed

• PHP required version bumped to >= 7.1
• Exception interfaces extending Throwable

[7.0.0] - 2019-09-21

Added

• PHPStan checks

Removed

• Constants::ARGUMENT_NOT_SET - This is a BC break

[6.1.3] - 2019-09-21

Drafted

• To fix inserted BC break

[6.1.2] - 2019-09-21

DELETED

• To fix inserted BC break

[6.1.1] - 2019-09-21

DELETED

• To fix inserted BC break

[6.0.0] - 2019-09-11

Added

... (truncated)

Commits

• e6bc62d Merge pull request #230 from antonioribeiro/fix-coverage
• 4397636 Fix coverage on codeconv
• 6916e30 Bump version to 9.x, while increasing the secret key length to 32
• 2d27271 Configure code coverage on Codecov
• 73e2532 Fix code quality errors
• 7f8e24b Fix prefer-lowest
• c37bf63 Update to allow 9.x branch on Actions
• 914ad32 Test unit and spec separately and increase the testing matrix, remove old PHP...
• 842a344 Update changelog
• 88c0771 Update readme about the breaking change on the new secret key size
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)