1.0.1

A security release. If you are on 1.0.0, upgrade.

composer require --dev monicahq/laradb:^1.0.1

Both issues were found in an audit of the package rather than reported from the field, and neither is known to have been exploited. Both are cases of a protection that looks present and is not, so neither would have been visible from the page.

An empty middleware config published the viewer unauthenticated

Laravel drops a route group's middleware key when it is not set. A published config with 'middleware' => null — a blank line, a commented-out array, a bad merge — therefore registered both routes with no middleware at all, making every row of every table readable by anyone who found the URL. The ['web', 'auth'] default in the service provider did not catch this, because Config::get() returns null for a key that exists holding null, not the default.

null and [] now fall back to ['web', 'auth']. If you genuinely want the viewer reachable without authentication, say so explicitly with ['web'].

Check your own config: if laradb.middleware is blank, null, or an empty array, your viewer has been unprotected wherever it was enabled. In local that is usually a machine only you can reach — but check anything you enabled with LARADB_ENABLED.

Query failures described the database to the visitor

QueryFailedException embedded the raw PDO message, which quotes the failing statement, the schema it ran against and, on PostgreSQL, the value that broke it. It reached the HTML page and the JSON endpoint alike, and it was reachable from the query string — a foreign key filter with a value of the wrong type is enough to provoke one on PostgreSQL.

The message is generic now. Every exception on its way to a visitor passes through a single method that sends the real cause to the application log, so sanitising is not something a future code path can forget to do.

Also in this release

Documentation only: the readme opens with the problem the package solves, and the foreign-key section was folded into the Routes table.

Verification

Both fixes are covered by tests that fail against 1.0.0's code. The suite — Pint, PHPStan level 8 with strict rules, and 129 tests — passes, and the integration matrix ran green on this commit across PHP 8.1–8.4 × Laravel 10/11/12 against real MySQL and PostgreSQL servers.

Full changelog: 1.0.0...1.0.1