From 90fa675a5a7d225bb6e30528a6f630e9bc618f42 Mon Sep 17 00:00:00 2001 From: Gregory Oschwald Date: Tue, 21 Jul 2026 07:32:51 -0700 Subject: [PATCH 1/4] Set release date --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 88c1113..824a202 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,7 +1,7 @@ CHANGELOG ========= -3.7.0 +3.7.0 (2026-07-21) ------------------ * Added the `residential` property to the `anonymizer` object on From 31c8b3eed5ffd18fde4aab505a6eebdd385a4154 Mon Sep 17 00:00:00 2001 From: Gregory Oschwald Date: Tue, 21 Jul 2026 07:36:46 -0700 Subject: [PATCH 2/4] Note geoip2 3.4.0 requirement in 3.7.0 changelog entry Co-Authored-By: Claude Fable 5 --- CHANGELOG.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 824a202..465f25f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,7 +9,8 @@ CHANGELOG object providing residential proxy data for the network: `confidence`, `networkLastSeen`, and `providerName`. It may be populated even when no other anonymizer properties are set. This data is available from the - minFraud Insights and Factors web services. + minFraud Insights and Factors web services. `geoip2/geoip2` 3.4.0 is now + required for this data. * Added `tracking_token` to the `/device` request object. This is the token generated by the [Device Tracking Add-on](https://dev.maxmind.com/minfraud/track-devices) From 13e0e02583648e709ba1043d0fd57d35cfb2c3e8 Mon Sep 17 00:00:00 2001 From: Gregory Oschwald Date: Tue, 21 Jul 2026 07:49:25 -0700 Subject: [PATCH 3/4] Manage box, composer, and phpDocumentor via mise The release script previously downloaded box.phar 4.6.10 and phpDocumentor.phar 3.8.1 with wget, verifying hardcoded sha256 hashes, and used a local composer.phar kept current via self-update. Install all three via mise's github backend instead, upgrading to box 4.7.0 and phpDocumentor 3.10.0. Integrity pinning moves to mise.lock, which records per-platform checksums, and mise additionally verifies SLSA provenance or GitHub artifact attestations at install time. Box 4.7.0 and phpDocumentor 3.10.0 were verified against this project: box compiles a working minfraud.phar (phar-test passes) and phpDocumentor generates the API docs. Co-Authored-By: Claude Fable 5 --- .gitignore | 3 - dev-bin/release.sh | 33 ++++------- mise.lock | 138 +++++++++++++++++++++++++++++++++++++++++++++ mise.toml | 3 + 4 files changed, 151 insertions(+), 26 deletions(-) diff --git a/.gitignore b/.gitignore index 433fc72..498d2ec 100644 --- a/.gitignore +++ b/.gitignore @@ -7,12 +7,9 @@ docs/public/ .php-cs-fixer.cache .phpunit.cache/ .phpunit.result.cache -box.phar build composer.lock -composer.phar minfraud.phar -/phpDocumentor.phar phpunit.xml t.php vendor/ diff --git a/dev-bin/release.sh b/dev-bin/release.sh index 691aeac..89b1304 100755 --- a/dev-bin/release.sh +++ b/dev-bin/release.sh @@ -32,7 +32,12 @@ fi check_command perl check_command php -check_command wget + +# box.phar, composer.phar, and phpDocumentor.phar are managed by mise (see +# mise.toml) +check_command box.phar +check_command composer.phar +check_command phpDocumentor.phar # Check that we're not on the main branch current_branch=$(git branch --show-current) @@ -91,21 +96,12 @@ if [ -d vendor ]; then rm -fr vendor fi -php composer.phar self-update -php composer.phar update --no-dev +composer.phar update --no-dev perl -pi -e "s/(?<=const VERSION = ').+?(?=';)/$tag/g" src/MinFraud/ServiceClient.php perl -pi -e "s{(?<=php composer\.phar require maxmind\/minfraud:).+}{^$version}g" README.md -box_phar_hash='f98cf885a7c07c84df66e33888f1d93f063298598e0a5f41ca322aeb9683179b box.phar' - -if ! echo "$box_phar_hash" | sha256sum -c; then - wget -O box.phar "https://github.com/box-project/box/releases/download/4.6.10/box.phar" -fi - -echo "$box_phar_hash" | sha256sum -c - -php box.phar compile +box.phar compile phar_test=$(./dev-bin/phar-test.php) if [[ -n $phar_test ]]; then @@ -114,7 +110,7 @@ if [[ -n $phar_test ]]; then fi # Download test deps -php composer.phar update +composer.phar update ./vendor/bin/phpunit @@ -143,20 +139,11 @@ if [ -n "$(git status --porcelain)" ]; then exit 1 fi -# Using Composer is possible, but they don't recommend it. -phpdocumentor_phar_hash='aa00973d88b278fe59fd8dce826d8d5419df589cb7563ac379856ec305d6b938 phpDocumentor.phar' - -if ! echo "$phpdocumentor_phar_hash" | sha256sum -c; then - wget -O phpDocumentor.phar https://github.com/phpDocumentor/phpDocumentor/releases/download/v3.8.1/phpDocumentor.phar -fi - -echo "$phpdocumentor_phar_hash" | sha256sum -c - # Use cache dir in /tmp as otherwise cache files get into the output directory. cachedir="/tmp/phpdoc-$$-$RANDOM" rm -rf "$cachedir" -php phpDocumentor.phar \ +phpDocumentor.phar \ --visibility=public \ --cache-folder="$cachedir" \ --title="minFraud PHP API $tag" \ diff --git a/mise.lock b/mise.lock index 66b9559..bffaa38 100644 --- a/mise.lock +++ b/mise.lock @@ -1,5 +1,129 @@ # @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html +[[tools."github:box-project/box"]] +version = "4.7.0" +backend = "github:box-project/box" + +[tools."github:box-project/box"."platforms.linux-arm64"] +checksum = "sha256:3d390eeaec33288098fe83f8a54c60cc575cb6be295f38ff4482b4b4f26f8d52" +url = "https://github.com/box-project/box/releases/download/4.7.0/box.phar" +url_api = "https://api.github.com/repos/box-project/box/releases/assets/376333812" + +[tools."github:box-project/box"."platforms.linux-arm64-musl"] +checksum = "sha256:3d390eeaec33288098fe83f8a54c60cc575cb6be295f38ff4482b4b4f26f8d52" +url = "https://github.com/box-project/box/releases/download/4.7.0/box.phar" +url_api = "https://api.github.com/repos/box-project/box/releases/assets/376333812" + +[tools."github:box-project/box"."platforms.linux-x64"] +checksum = "sha256:3d390eeaec33288098fe83f8a54c60cc575cb6be295f38ff4482b4b4f26f8d52" +url = "https://github.com/box-project/box/releases/download/4.7.0/box.phar" +url_api = "https://api.github.com/repos/box-project/box/releases/assets/376333812" + +[tools."github:box-project/box"."platforms.linux-x64-musl"] +checksum = "sha256:3d390eeaec33288098fe83f8a54c60cc575cb6be295f38ff4482b4b4f26f8d52" +url = "https://github.com/box-project/box/releases/download/4.7.0/box.phar" +url_api = "https://api.github.com/repos/box-project/box/releases/assets/376333812" + +[tools."github:box-project/box"."platforms.macos-arm64"] +checksum = "sha256:3d390eeaec33288098fe83f8a54c60cc575cb6be295f38ff4482b4b4f26f8d52" +url = "https://github.com/box-project/box/releases/download/4.7.0/box.phar" +url_api = "https://api.github.com/repos/box-project/box/releases/assets/376333812" + +[tools."github:box-project/box"."platforms.macos-x64"] +checksum = "sha256:3d390eeaec33288098fe83f8a54c60cc575cb6be295f38ff4482b4b4f26f8d52" +url = "https://github.com/box-project/box/releases/download/4.7.0/box.phar" +url_api = "https://api.github.com/repos/box-project/box/releases/assets/376333812" + +[tools."github:box-project/box"."platforms.windows-x64"] +checksum = "sha256:3d390eeaec33288098fe83f8a54c60cc575cb6be295f38ff4482b4b4f26f8d52" +url = "https://github.com/box-project/box/releases/download/4.7.0/box.phar" +url_api = "https://api.github.com/repos/box-project/box/releases/assets/376333812" + +[[tools."github:composer/composer"]] +version = "2.10.2" +backend = "github:composer/composer" + +[tools."github:composer/composer"."platforms.linux-arm64"] +checksum = "sha256:5ee7125f8a30a34d246cefdc0bc85b8a783b28f2aec968994118512350d28027" +url = "https://github.com/composer/composer/releases/download/2.10.2/composer.phar" +url_api = "https://api.github.com/repos/composer/composer/releases/assets/463051343" +provenance = "github-attestations" + +[tools."github:composer/composer"."platforms.linux-arm64-musl"] +checksum = "sha256:5ee7125f8a30a34d246cefdc0bc85b8a783b28f2aec968994118512350d28027" +url = "https://github.com/composer/composer/releases/download/2.10.2/composer.phar" +url_api = "https://api.github.com/repos/composer/composer/releases/assets/463051343" +provenance = "github-attestations" + +[tools."github:composer/composer"."platforms.linux-x64"] +checksum = "sha256:5ee7125f8a30a34d246cefdc0bc85b8a783b28f2aec968994118512350d28027" +url = "https://github.com/composer/composer/releases/download/2.10.2/composer.phar" +url_api = "https://api.github.com/repos/composer/composer/releases/assets/463051343" +provenance = "github-attestations" + +[tools."github:composer/composer"."platforms.linux-x64-musl"] +checksum = "sha256:5ee7125f8a30a34d246cefdc0bc85b8a783b28f2aec968994118512350d28027" +url = "https://github.com/composer/composer/releases/download/2.10.2/composer.phar" +url_api = "https://api.github.com/repos/composer/composer/releases/assets/463051343" +provenance = "github-attestations" + +[tools."github:composer/composer"."platforms.macos-arm64"] +checksum = "sha256:5ee7125f8a30a34d246cefdc0bc85b8a783b28f2aec968994118512350d28027" +url = "https://github.com/composer/composer/releases/download/2.10.2/composer.phar" +url_api = "https://api.github.com/repos/composer/composer/releases/assets/463051343" +provenance = "github-attestations" + +[tools."github:composer/composer"."platforms.macos-x64"] +checksum = "sha256:5ee7125f8a30a34d246cefdc0bc85b8a783b28f2aec968994118512350d28027" +url = "https://github.com/composer/composer/releases/download/2.10.2/composer.phar" +url_api = "https://api.github.com/repos/composer/composer/releases/assets/463051343" +provenance = "github-attestations" + +[tools."github:composer/composer"."platforms.windows-x64"] +checksum = "sha256:5ee7125f8a30a34d246cefdc0bc85b8a783b28f2aec968994118512350d28027" +url = "https://github.com/composer/composer/releases/download/2.10.2/composer.phar" +url_api = "https://api.github.com/repos/composer/composer/releases/assets/463051343" +provenance = "github-attestations" + +[[tools."github:phpDocumentor/phpDocumentor"]] +version = "3.10.0" +backend = "github:phpDocumentor/phpDocumentor" + +[tools."github:phpDocumentor/phpDocumentor"."platforms.linux-arm64"] +checksum = "sha256:fe1e7c23ba3329aa6f19ac3c807446159a431a195ec5d9163b0c281a15105207" +url = "https://github.com/phpDocumentor/phpDocumentor/releases/download/v3.10.0/phpDocumentor.phar" +url_api = "https://api.github.com/repos/phpDocumentor/phpDocumentor/releases/assets/419563924" + +[tools."github:phpDocumentor/phpDocumentor"."platforms.linux-arm64-musl"] +checksum = "sha256:fe1e7c23ba3329aa6f19ac3c807446159a431a195ec5d9163b0c281a15105207" +url = "https://github.com/phpDocumentor/phpDocumentor/releases/download/v3.10.0/phpDocumentor.phar" +url_api = "https://api.github.com/repos/phpDocumentor/phpDocumentor/releases/assets/419563924" + +[tools."github:phpDocumentor/phpDocumentor"."platforms.linux-x64"] +checksum = "sha256:fe1e7c23ba3329aa6f19ac3c807446159a431a195ec5d9163b0c281a15105207" +url = "https://github.com/phpDocumentor/phpDocumentor/releases/download/v3.10.0/phpDocumentor.phar" +url_api = "https://api.github.com/repos/phpDocumentor/phpDocumentor/releases/assets/419563924" + +[tools."github:phpDocumentor/phpDocumentor"."platforms.linux-x64-musl"] +checksum = "sha256:fe1e7c23ba3329aa6f19ac3c807446159a431a195ec5d9163b0c281a15105207" +url = "https://github.com/phpDocumentor/phpDocumentor/releases/download/v3.10.0/phpDocumentor.phar" +url_api = "https://api.github.com/repos/phpDocumentor/phpDocumentor/releases/assets/419563924" + +[tools."github:phpDocumentor/phpDocumentor"."platforms.macos-arm64"] +checksum = "sha256:fe1e7c23ba3329aa6f19ac3c807446159a431a195ec5d9163b0c281a15105207" +url = "https://github.com/phpDocumentor/phpDocumentor/releases/download/v3.10.0/phpDocumentor.phar" +url_api = "https://api.github.com/repos/phpDocumentor/phpDocumentor/releases/assets/419563924" + +[tools."github:phpDocumentor/phpDocumentor"."platforms.macos-x64"] +checksum = "sha256:fe1e7c23ba3329aa6f19ac3c807446159a431a195ec5d9163b0c281a15105207" +url = "https://github.com/phpDocumentor/phpDocumentor/releases/download/v3.10.0/phpDocumentor.phar" +url_api = "https://api.github.com/repos/phpDocumentor/phpDocumentor/releases/assets/419563924" + +[tools."github:phpDocumentor/phpDocumentor"."platforms.windows-x64"] +checksum = "sha256:fe1e7c23ba3329aa6f19ac3c807446159a431a195ec5d9163b0c281a15105207" +url = "https://github.com/phpDocumentor/phpDocumentor/releases/download/v3.10.0/phpDocumentor.phar" +url_api = "https://api.github.com/repos/phpDocumentor/phpDocumentor/releases/assets/419563924" + [[tools.hugo]] version = "0.164.0" backend = "aqua:gohugoio/hugo" @@ -77,3 +201,17 @@ url_api = "https://api.github.com/repos/lycheeverse/lychee/releases/assets/40995 checksum = "sha256:32975d1493ee1a975d6bb41e4fb56fe419cb442ded628bb772ba2e614acfacad" url = "https://github.com/lycheeverse/lychee/releases/download/lychee-v0.24.2/lychee-x86_64-pc-windows-msvc.zip" url_api = "https://api.github.com/repos/lycheeverse/lychee/releases/assets/409959491" + +[[tools."ubi:box-project/box"]] +version = "4.7.0" +backend = "ubi:box-project/box" + +[tools."ubi:box-project/box".options] +exe = "box.phar" + +[[tools."ubi:phpDocumentor/phpDocumentor"]] +version = "3.10.0" +backend = "ubi:phpDocumentor/phpDocumentor" + +[tools."ubi:phpDocumentor/phpDocumentor".options] +exe = "phpDocumentor.phar" diff --git a/mise.toml b/mise.toml index 8a94486..4f44b33 100644 --- a/mise.toml +++ b/mise.toml @@ -8,6 +8,9 @@ disable_backends = [ [tools] hugo = "latest" lychee = "latest" +"github:box-project/box" = "latest" +"github:composer/composer" = "latest" +"github:phpDocumentor/phpDocumentor" = "latest" [hooks] enter = "mise install --quiet" From 89bb16b8f8c9331c7e59b2abe213dda661bb35bf Mon Sep 17 00:00:00 2001 From: Gregory Oschwald Date: Tue, 21 Jul 2026 08:05:06 -0700 Subject: [PATCH 4/4] Update for v3.7.0 --- README.md | 2 +- src/MinFraud/ServiceClient.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index add514b..15a1ed8 100644 --- a/README.md +++ b/README.md @@ -25,7 +25,7 @@ You should now have the file `composer.phar` in your project directory. Run in your project root: ``` -php composer.phar require maxmind/minfraud:^3.6.0 +php composer.phar require maxmind/minfraud:^3.7.0 ``` You should now have the files `composer.json` and `composer.lock` as well as diff --git a/src/MinFraud/ServiceClient.php b/src/MinFraud/ServiceClient.php index f1e2ce0..b1b6e51 100644 --- a/src/MinFraud/ServiceClient.php +++ b/src/MinFraud/ServiceClient.php @@ -9,7 +9,7 @@ abstract class ServiceClient { - public const VERSION = 'v3.6.0'; + public const VERSION = 'v3.7.0'; /** * @var Client