Bump phalcon/phalcon from 6.0.0beta10 to 6.0.0beta11

[dependabot]

Bumps phalcon/phalcon from 6.0.0beta10 to 6.0.0beta11.

Release notes

Sourced from phalcon/phalcon's releases.

v6.0.0beta11

Changed

• ACL role, component and access names can no longer contain !, the internal key delimiter; Phalcon\Acl\Exceptions\ForbiddenDelimiter is thrown instead.
• Cache file names of Phalcon\Annotations\Adapter\Stream, Phalcon\Mvc\Model\MetaData\Stream and Phalcon\Storage\Adapter\Stream get a hash suffix when the key contains the character that the separator replacement produces (_ for class names; /, \, : for storage keys), so two different keys can no longer share one file. Names of all other keys are unchanged.
• Phalcon\Auth\Guard\Session sets the Secure flag of the remember-me cookie from the new rememberSecure option (default true) instead of the request scheme, so a TLS-terminating proxy that reports plain HTTP to the backend cannot downgrade it.
• Phalcon\Auth\Guard\Session validates the "remember me" token against the user agent of the current request instead of the one stored in the cookie; a browser user-agent change now ends a remembered session.
• Phalcon\Encryption\Security::CRYPT_MD5, CRYPT_SHA256 and CRYPT_SHA512 are documented as weak legacy algorithms to be removed in a future major version; use bcrypt or Argon2 and rehash on login.
• Phalcon\Storage\Adapter\Stream creates its shard directories with mode 0755 instead of 0777. Thanks to Ilia Alshanetsky

Added

• Optional fifth argument stopOnFalse on Phalcon\Events\Manager::fire() (not on the interface), a per-call override of setStopOnFalse(); EventsAwareTrait::fireManagerEvent() gained a matching fourth argument.
• Phalcon\Acl\Exceptions\ForbiddenDelimiter, thrown when an ACL role, component or access name contains !.
• Phalcon\Auth\Exceptions\InvalidCredentialKey, thrown when a credential key passed to Phalcon\Auth\Adapter\Model::retrieveByCredentials() is not a plain identifier.
• Phalcon\Http\Request\Bag\AbstractBag::clear(), removing all elements of a request bag.
• allowedClasses option for the Storage adapters (true, false or a list of class names), forwarded to the new Phalcon\Storage\Serializer\Php::setAllowedClasses(): restricts the classes unserialize() may instantiate for stored values, including the nested content of the Stream adapter. A class outside the list makes the read fail instead of building an object. Thanks to Ilia Alshanetsky
• rememberSecure option for the session guard (Phalcon\Auth\Guard\Config\SessionGuardConfig, Session::fromOptions()).

Fixed

• "Remember me" cookie of another account surviving Phalcon\Auth\Guard\Session::logout() when the current user does not implement AuthRemember.
• A false returned by a listener of acl:beforeCheckAccess, dispatch:beforeDispatch, dispatch:beforeExecuteRoute, micro:beforeHandleRoute or micro:beforeExecuteRoute being overwritten by a later listener that returned a non-null value; these boundaries now fire with stop-on-false, so a denial is final.
• Asset output following a symbolic link at the target file and writing outside the assets directory.
• Backslash path traversal in Phalcon\Mvc\View::partial() and Phalcon\Mvc\View\Simple::render() on Windows.
• Cached user surviving Phalcon\Auth\Guard\Token::setRequest(), so a replaced request inherited the previous authentication.
• Column comment concatenated unescaped into the CREATE TABLE / ALTER TABLE DDL of the MySQL dialect; it is now escaped like the DEFAULT clause. Thanks to Ilia Alshanetsky
• Credential keys interpolated unvalidated into the PHQL built by Phalcon\Auth\Adapter\Model::retrieveByCredentials().
• Distinct ACL tuples colliding on the same internal key when a role, component or access name contained !.
• JWT audience validated with a loose comparison, so a numeric or boolean aud claim satisfied a string audience.
• Length-dependent HMAC work on the CBC decrypt failure path of Phalcon\Encryption\Crypt, which could still tell a padding failure from a MAC mismatch by timing.
• Malformed ACL snapshot loaded by Phalcon\Acl\Adapter\Storage raising TypeError or leaving the adapter half loaded, and deep or cyclic object graphs recursing without limit; InvalidSnapshot is now thrown before any state changes.
• Namespace middleware bypass in the ADR Router through case-variant or separator-injected paths that PHP resolves to the canonical Action class; only the exact declared class name is a match.
• Non-string elements passed to Phalcon\Acl\Adapter\Memory::addInherit() raising a warning and a TypeError instead of InvalidRoleType.
• Request attributes of the previous route surviving on a reused request in Phalcon\ADR\Application::handle().
• Scheme allow-list bypass in the Filter url sanitizer through HTML-entity obfuscated schemes (java&[#115](https://github.com/phalcon/phalcon/issues/115);cript:) and URLs that parse_url() cannot parse; the sanitizer now fails closed. Thanks to Ilia Alshanetsky
• Validators Alpha, Alnum, Confirmation, CreditCard, Digit, Numericality, Regex, StringLength\Min and StringLength\Max cast an array value to the constant "Array", so field[]=x passed alphabetic, alphanumeric, length and confirmation checks; a value that cannot be a string is now rejected with the validator's message. Thanks to Ilia Alshanetsky
• View parameters named path or compiledTemplatePath replacing the file included by the Php and Volt view engines.
• Volt extends-mode cache unserialized without a class restriction.
• Phalcon\Tag::getEscaper() treated every value other than true as escaping disabled, so 1 or "1" silently switched escaping off; it now matches cphalcon (only a falsy value disables it).
• ReflectionException / TypeError from ACL rule callbacks with builtin-typed parameters, array callables or static-method strings.
• acl:afterCheckAccess reporting the static rule instead of the final isAllowed() decision (rule callback and default action were not applied).
• only() / except() action filters leaking between Phalcon\Auth\Manager::access() activations when the access gate was registered as a shared service in the legacy Di.

Removed

Changelog

Sourced from phalcon/phalcon's changelog.

6.0.0 beta 11 (2026-xx-xx)

Changed

• ACL role, component and access names can no longer contain !, the internal key delimiter; Phalcon\Acl\Exceptions\ForbiddenDelimiter is thrown instead.
• Cache file names of Phalcon\Annotations\Adapter\Stream, Phalcon\Mvc\Model\MetaData\Stream and Phalcon\Storage\Adapter\Stream get a hash suffix when the key contains the character that the separator replacement produces (_ for class names; /, \, : for storage keys), so two different keys can no longer share one file. Names of all other keys are unchanged.
• Phalcon\Auth\Guard\Session sets the Secure flag of the remember-me cookie from the new rememberSecure option (default true) instead of the request scheme, so a TLS-terminating proxy that reports plain HTTP to the backend cannot downgrade it.
• Phalcon\Auth\Guard\Session validates the "remember me" token against the user agent of the current request instead of the one stored in the cookie; a browser user-agent change now ends a remembered session.
• Phalcon\Encryption\Security::CRYPT_MD5, CRYPT_SHA256 and CRYPT_SHA512 are documented as weak legacy algorithms to be removed in a future major version; use bcrypt or Argon2 and rehash on login.
• Phalcon\Storage\Adapter\Stream creates its shard directories with mode 0755 instead of 0777. Thanks to Ilia Alshanetsky

Added

• Optional fifth argument stopOnFalse on Phalcon\Events\Manager::fire() (not on the interface), a per-call override of setStopOnFalse(); EventsAwareTrait::fireManagerEvent() gained a matching fourth argument.
• Phalcon\Acl\Exceptions\ForbiddenDelimiter, thrown when an ACL role, component or access name contains !.
• Phalcon\Auth\Exceptions\InvalidCredentialKey, thrown when a credential key passed to Phalcon\Auth\Adapter\Model::retrieveByCredentials() is not a plain identifier.
• Phalcon\Http\Request\Bag\AbstractBag::clear(), removing all elements of a request bag.
• Phalcon\Mvc\Model::findFirst() now recognizes the eager parameter, so relations can be eagerly loaded. #17534 [doc]
• allowedClasses option for the Storage adapters (true, false or a list of class names), forwarded to the new Phalcon\Storage\Serializer\Php::setAllowedClasses(): restricts the classes unserialize() may instantiate for stored values, including the nested content of the Stream adapter. A class outside the list makes the read fail instead of building an object. Thanks to Ilia Alshanetsky
• rememberSecure option for the session guard (Phalcon\Auth\Guard\Config\SessionGuardConfig, Session::fromOptions()).

Fixed

• "Remember me" cookie of another account surviving Phalcon\Auth\Guard\Session::logout() when the current user does not implement AuthRemember.
• A false returned by a listener of acl:beforeCheckAccess, dispatch:beforeDispatch, dispatch:beforeExecuteRoute, micro:beforeHandleRoute or micro:beforeExecuteRoute being overwritten by a later listener that returned a non-null value; these boundaries now fire with stop-on-false, so a denial is final.
• Asset output following a symbolic link at the target file and writing outside the assets directory.
• Backslash path traversal in Phalcon\Mvc\View::partial() and Phalcon\Mvc\View\Simple::render() on Windows.
• Cached user surviving Phalcon\Auth\Guard\Token::setRequest(), so a replaced request inherited the previous authentication.
• Column comment concatenated unescaped into the CREATE TABLE / ALTER TABLE DDL of the MySQL dialect; it is now escaped like the DEFAULT clause. Thanks to Ilia Alshanetsky
• Credential keys interpolated unvalidated into the PHQL built by Phalcon\Auth\Adapter\Model::retrieveByCredentials().
• Distinct ACL tuples colliding on the same internal key when a role, component or access name contained !.
• JWT audience validated with a loose comparison, so a numeric or boolean aud claim satisfied a string audience.
• Length-dependent HMAC work on the CBC decrypt failure path of Phalcon\Encryption\Crypt, which could still tell a padding failure from a MAC mismatch by timing.
• Malformed ACL snapshot loaded by Phalcon\Acl\Adapter\Storage raising TypeError or leaving the adapter half loaded, and deep or cyclic object graphs recursing without limit; InvalidSnapshot is now thrown before any state changes.
• Namespace middleware bypass in the ADR Router through case-variant or separator-injected paths that PHP resolves to the canonical Action class; only the exact declared class name is a match.
• Non-string elements passed to Phalcon\Acl\Adapter\Memory::addInherit() raising a warning and a TypeError instead of InvalidRoleType.
• Phalcon\Filter\Validation\Validator\File\AbstractFile::checkUpload() reporting success when the field value is not an uploaded file array; a missing file or a plain string now fails validation. #17541 [doc]
• Phalcon\Filter\Validation\Validator\File\Resolution\Equal, Max, Min and AspectRatio not checking the false returned by getimagesize(); a file that is not a readable image is now rejected. #17542 [doc]
• Phalcon\Filter\Validation\Validator\Ip ignoring per-field allowPrivate and allowReserved arrays; the option is now resolved for the field before it becomes a filter flag. #17548 [doc]
• Phalcon\Forms\Element\CheckGroup and RadioGroup storing their choices in the property Phalcon\Forms\Element\AbstractElement uses for user options, so setUserOption() added a choice and setOptions() removed every user option. #17536 [doc]
• Phalcon\Forms\Element\Select::addOption() writing with an offset into an object or null options value; the write now happens only when the options value is an array (null becomes an empty array). #17536 [doc]
• PHQL WITH naming a model instead of a relation alias always throwing RelationshipNotFound; the fallback checked Phalcon\Mvc\Model\Manager::getRelationsBetween() for an object, but it returns an array. Ambiguous pairs now throw AmbiguousJoinRelation. #17554 [doc]
• Phalcon\Mvc\Model\Manager relation guards throwing TypeError on a string field list, and the second check in addHasManyToMany() / addHasOneThrough() comparing the same pair twice. #17556 [doc]
• Phalcon\Mvc\Model raising TypeError on a composite virtual foreign key violation, and when the case-insensitive column-map lookup ran without a column map. #17558 [doc]
• Phalcon\Mvc\Model\Manager::getRelationRecords() raising TypeError on a compound through-relation marked reusable, and reusing one key for every record. The key is now built from every field the relation covers. #17560 [doc]
• Phalcon\Mvc\Model::__construct() raising TypeError on a non-array data argument; it is ignored, as cphalcon does.
• Phalcon\Mvc\Router::loadFromConfig() silently configuring nothing when the config was neither an array nor a Phalcon\Config\ConfigInterface; InvalidConfigSource is thrown, as cphalcon does.
• Phalcon\Mvc\View\Engine\Volt::isIncluded() raising TypeError on a haystack that is neither an array nor a string; InvalidHaystack is thrown, as cphalcon does. A missing mb_strpos() falls back to strpos().
• Phalcon\Mvc\View\Engine\Volt\Compiler::$prefix and $extendedBlocks typed more narrowly than the cphalcon properties, so a closure prefix generator could not be stored and an extends-mode sub-compilation raised TypeError.
• Phalcon\Support\Traits\FilePathTrait::prepareVirtualPath() raising TypeError when realpath() returned false for a missing Volt template, before TemplateFileNotFound could be thrown.

... (truncated)

Commits

• 6deb1b3 phpcs
• 4cd0430 composer update
• bb8f326 cphalcon sync - security hardening and tests
• 955edb0 cphalcon sync - security hardening tests
• edac90e cphalcon sync - security hardening
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Code Metrics Report

	master (eb4b187)	#27 (c1c45ca)	+/-
Coverage	100.0%	100.0%	0.0%
Test Execution Time	1s	1s	0s

Details

  |                     | master (eb4b187) | #27 (c1c45ca) | +/-  |
  |---------------------|------------------|---------------|------|
  | Coverage            |           100.0% |        100.0% | 0.0% |
  |   Files             |               58 |            58 |    0 |
  |   Lines             |             1293 |          1293 |    0 |
  |   Covered           |             1293 |          1293 |    0 |
  | Test Execution Time |               1s |            1s |   0s |

---

Reported by octocov