Release v1.18.0

Release v1.18.0

Changelog

Added

• Optional slide-to-confirm integration with nowo-tech/slide-to-confirm-bundle (suggest + require-dev only — no hard Composer dependency):
  • Profile keys slide_to_confirm.enabled (default false), registration_consent (default gate), qr_login_approve (default false).
  • Registration fields: slide_to_confirm (true or a profile name) and mapped (defaults to false when a slide is requested). UserRegistrar does not persist unmapped fields.
  • QR approve: QrLoginApproveType with Form CSRF + SwipeToSubmitType when enabled and the package is installed.
  • Twig partials _slide_to_confirm_assets.html.twig and _registration_submit.html.twig; global/function nowo_auth_kit_slide_to_confirm_assets.
  • Translations: register.field.terms, register.slide.*, qr_login.approve.slide / confirmed / slide_hint.

Changed

• Spec Kit baseline inventory 142/142 (116 PHP + 26 Resources), including LoginThrottleRequiredPass (shipped in 1.17.4) and slide-to-confirm units.

Security

• REQ-SEC-004 re-audit of the 1.18.0 HTTP surface: overall Pass (conditional) / Medium; this delta Low (no new Critical/High). QR approve with slide uses Form CSRF. The swipe is confirmation UX, not authorization. Login forms are unchanged.

Notes

• No application change unless you install the optional package and set slide_to_confirm.enabled: true.

Full Changelog: v1.17.5...v1.18.0