Skip to content

v5.0.1 - Locale validation, Laravel 12+, real JavaScript coverage

Choose a tag to compare

View all tags
@PavlosIsaris PavlosIsaris released this 03 Sep 08:43
· 13 commits to main since this release
v5.0.1
1cfb0d0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

Maintenance release with one security hardening fix. No changes to the public API, Blade components, or configuration keys.

Security: locale input is validated

The locale value submitted to POST /guard-settings/save was passed unvalidated to the translator, which builds a translation file path from it (CWE-22, path traversal). The controller now accepts only a well-formed locale identifier such as en, pt-br or zh_Hant_TW, and falls back to the application locale otherwise. The GET /cookie-policy/{locale} route applies the same pattern and returns 404 for anything else instead of raising an exception. Reported by CodeRabbit on #117.

Laravel 11 support removed

illuminate/contracts is now ^12.0|^13.0. Laravel 11 reached end of life in March 2026 and was declared in v5.0.0 but never covered by the test matrix. If you are on Laravel 11, stay on v4.x or upgrade Laravel first.

JavaScript coverage is now reported for real

The JavaScript behaviour tests previously ran the compiled bundle with window.eval, which V8 cannot attribute to a file, so c8 reported 0% coverage with no files listed. The tests now compile the bundle once with vm.Script and execute it inside jsdom's VM context. c8 attributes the executed lines to public/scripts.js and remaps them through the Vite source map to resources/js/scripts.js.

First measured result: 62.7% line coverage of resources/js/scripts.js.

npm run test:coverage now runs both JavaScript test files and writes coverage/lcov.info. The CI coverage job uploads it to Codecov together with the PHP clover.xml report, so the Codecov badge reflects both languages.

Source map is published with the assets

The Vite build now emits public/scripts.js.map. The map is committed and published with the other built assets by php artisan vendor:publish --tag="cookies-consent-public", so the sourceMappingURL comment in scripts.js resolves in browser developer tools.

CI cleanup

  • Removed the phpunit-coverage-badge step and its artifact upload from the coverage job. The badge was never pushed or referenced; the README badge is served by Codecov.
  • The Codecov step uploads only the two listed report files instead of auto-discovering everything under coverage/.

Upgrading

Run composer update scify/laravel-cookie-guard on Laravel 12 or 13. If you publish the package assets, re-run php artisan vendor:publish --tag="cookies-consent-public" --force to receive the source map.

Assets 2
Loading