Repository navigation
2.0.5: Core JWT validation enforcement
PhalconKit App 2.0.5 updates the project skeleton to require Core ^3.10.6 and ships a lockfile selecting Core 3.10.6, so new projects receive the JWT validation-enforcement security fix.
Security update
The inherited identity flow rejects invalid JWT credentials with a generic HTTP 401 before trusting claims, accessing session identity, or issuing replacement tokens. Invalid credentials cannot fall back to an authenticated PHP session. The skeleton continues to use Core's identity handling and API error controller directly.
Existing projects
Update the Core dependency to ^3.10.6 through Composer and commit the resulting application lockfile. Existing applications do not need to be recreated from the skeleton.
Refresh requests should supply refreshToken and omit expired access credentials; login requests should also omit stale invalid JWTs. Review custom identity overrides and error handlers using the Core JWT upgrade guidance.
App and Core retain independent semantic versions: App versions describe the skeleton's compatibility, while Core versions describe the framework API. Composer constraints and the committed lockfile express their compatibility and tested pairing.
Validation
App's full Composer QA passes, including PHPUnit (7 tests, 30 assertions), PHPStan, PHPCS, dependency audit, and platform requirements. CLI entrypoints were checked from both the project directory and another working directory, and package archive contents were reviewed. Locked-dependency, lowest-dependency, PowerShell, and SonarCloud checks passed on the exact signed release commit before tagging.