2.1.2 - opt-in Cyrillic requirement for names

PHP Form Spam Checker 2.1.2 adds an opt-in locale check for Russian-language forms: a configured name field must contain Cyrillic, a Latin-only name adds missing_score points, and e-mail, company and free-text fields are never checked. language.enabled and language.require_cyrillic default to false and the shipped example configs keep them off; enable the rule in a site's own configuration.

Added

• Cyrillic requirement for names (language.require_cyrillic): an opt-in
  rule for Russian-language forms. The configured name-like fields (name,
  fio, first_name, last_name, surname, …, case/separator-insensitive)
  must contain at least one Cyrillic letter; a value with letters but no
  Cyrillic adds language.missing_score points. E-mail, company and free-text
  fields are never checked, and language.fields, min_letters and max_score
  tune the rule.
• The rule is disabled by default (language.enabled and
  require_cyrillic are false) and is enabled per site only where it is
  wanted: 'missing_score' => 60 makes a Latin-only name alone reach the spam
  threshold, 40 keeps the verdict at "suspicious".

Release correction (documented, not silent). This release replaces the 2.1.2 assets published earlier on 2026-11-04 from commit aea672a. That archive already shipped the rule disabled by default, but its release notes and README described it as enabled in the reference deployment configs; the wording is corrected and the archive is rebuilt from commit 6a38c45 (which also fixes a flaky process test whose cache cleanup could delete its own config file). Superseded asset: php-form-spam-checker-2.1.2.tar.gz sha256 dce99231edcbc5a00c2cd78a99d720089f27ea2ecc1f58b0b99adcaebb351d25.

Verification. CI (PHP 8.5.12 and 8.5) and the repository gates are green on the tagged commit; the suite runs 560 tests and asserts the default-off behaviour. The source archive is produced by git archive; its SHA-256 is in SHA256SUMS.txt and was re-verified after upload.

2.1.0 - Fail2Ban bridge, auto-ban, PHP 8.5 fix

PHP Form Spam Checker 2.1 adds the firewall bridge and deployment hardening on
top of 2.0: a Fail2Ban bridge fed by every hard-spam verdict and every hard WAF
block, application-level auto-ban, AbuseIPDB threshold-100 deployment guidance,
and the PHP 8.5 curl_close() deprecation fix.

Added

• Application-level auto-ban (autoban): after N hard-spam events inside a
  time window the client IP is banned in shared storage for a TTL; the new
  autoban pipeline check rejects it before any other check runs. Fail-open,
  configurable per site (enabled, threshold, window, ttl).
• Fail2Ban bridge (FormSpamChecker\Security\Fail2Ban): every hard-spam
  verdict (form pipeline) and every hard WAF block appends a single sanitized
  line PHPFSC BAN ip=… site=… form=… score=… reason=… to a configured log
  file, ready for a Fail2Ban filter/jail. emit_on selects spam, waf or
  both; min_score filters low-confidence events.
• Deployment guidance: Fail2Ban filter/jail, firewall ban limited to
  http/https, ignoreip for admin hosts, plus AbuseIPDB threshold = 100
  guidance (deployments use 100; library default stays 90).

Security

• Fail2Ban log lines are LF-only, fields are token-sanitized (no whitespace or
  newline injection) and appended with LOCK_EX; reporting errors never change
  a verdict. Lines start with an ISO-8601 timestamp so the jail needs no
  "match without timestamp" fallback (the filter and jail are in
  docs/WAF.md#fail2ban).
• CurlClient no longer calls the deprecated curl_close() (PHP 8.5).

Verification. CI (PHP 8.5.12 and 8.5 legs: CS Fixer, PHPStan max, Psalm
taint, strict PHPUnit, coverage gate, php -l) is green on commit 8ca0605.
The source archive is produced by git archive from the tag; its SHA-256 is in
SHA256SUMS.txt and was re-checked after upload.

Upgrade. composer require paulmann/php-form-spam-checker:2.1.0, or replace
the copied tree. No runtime dependency changed and every 2.0 configuration keeps
working; the new autoban and fail2ban sections are disabled by default, so
rollback is a configuration change.