Skip to content

v2.4.0

Choose a tag to compare

View all tags
@yuriizee yuriizee released this 16 Oct 12:51
· 4 commits to main since this release
v2.4.0
This tag was signed with the committer’s verified signature.
yuriizee yuriizee
SSH Key Fingerprint: rzDk0ZBmvh3XIVb7vyQBQINN9fC0AkowbJHcdpR3coU
Verified
Learn about vigilant mode.
0993f81
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • EncryptedCast(provider: ...) with the EncryptionKeyProvider contract loads the key from a KMS, Vault or HSM instead of the environment.
  • IsEloquentCastable accepts an output context (AccountData::class.':storage'), so #[Hidden(except: ['storage'])] fields are stored and survive the next load. Without a context nothing changes.

Security

  • Input is marked #[\SensitiveParameter] in every entry point, compiled hydrator, pipe, cast and Eloquent cast, so stack traces no longer carry card numbers when zend.exception_ignore_args is off.
  • The EncryptedCast derived key no longer shows up in var_export(), (array) casts or json_encode() of the cast or its metadata.
  • DateTimeCast and DateTimeImmutableCast without inputFormat mask card numbers in PHP's own DateMalformedStringException; the exception type is unchanged.

Fully backward compatible with 2.3.x.

Assets 4
Loading