v0.4.1

Security

• Local login fails closed when a cached configuration disagrees with the running process. A configuration cache built under APP_ENV=local and served by a production process could previously offer and accept passwordless local login. Local login now requires both Laravel's environment and the process's own APP_ENV to be exactly local, and a missing value fails closed. Route registration, the login offer and a request-time check all use the same rule. A cached local development boot must supply APP_ENV=local through the runtime environment (#6, #7).

---

What's Changed

• Fail closed for local login when cached app.env disagrees with the process by @jaspertey in #7
• Changelog for 0.4.1 by @jaspertey in #8

Full Changelog: v0.4.0...v0.4.1