7.0.0 — API authorization and authentication security mitigations

Security release with breaking changes

Version 7.0.0 contains high-priority route authorization and JWT authentication mitigations (API-01 through API-05).

Security fixes

• Resolve route permissions to one internal ACL resource per collection handler and make matching denies take precedence.
• Reject duplicate route registration and unknown route or role references.
• Reset the current session for each request and before login/token authentication.
• Remove the default JWT signing key and require explicit token parser configuration.
• Validate supported algorithms, key strength, issuer, audience and required claims.

Migration required

Configure an explicit signing key, issuer and audience. The new claim format uses iss for the configured issuer and account_type for the internal account type. Update token producers, invalidate legacy tokens and require users to authenticate again. Replace direct route-path/name ACL grants with collection permission declarations and rebuild ACL resources at application initialization.

Read the complete migration guide and changelog before updating. JWT remains optional; JWT consumers should install firebase/php-jwt ^7.2.1.

Validation

• 82 security regression checks passed with JWT 7.2.1, and 82 with JWT 6.8.1 as a historical regression comparison.
• Tested with PHP 8.4.26 and Phalcon 5.22.1.
• Syntax checks passed for all 36 source/test files.
• The freshly resolved JWT 7.2.1 lockfile passed composer audit --locked without vulnerability advisories.

Remaining work

URL-token handling (API-06), public exception messages (API-07) and application configuration risks remain follow-up work. Existing PHP 8.4 implicit-nullability deprecation notices remain in CorsMiddleware; keep diagnostic output out of public production responses.

phalcon-graphql 9.0.0 requires phalcon-api ^6.0.0 and cannot use this major release without a separately tested dependency update.