Security Fix

Read: A vulnerability in libsodium

This fixes a congruent issue in the main branch of the PHP implementation.

For older PHP versions, see v1.24.0 instead.

Security Fix

Read: A vulnerability in libsodium

This fixes a congruent issue in the v1.x branch of the PHP implementation.

The biggest change (besides unit testing) in this release is the optimization of Curve25519 field arithmetic by using object properties instead of an internal array. This skips some internal overhead in PHP (i.e., hash tables and memory allocation) that we ultimately never needed.

Beyond that, we mostly expanded our unit test coverage. We're running Infection to identify code that can be mutated without the test suite failing, and it's identified a lot of false positives but also some useful information. The end result? We've fixed a few bugs.

What's Changed

• Optimize curve25519 field element by removing array by @paragonie-security in #198
• Remove dead or redundant code of Util::(strlen|substr) by @takaram in #201
• Improve Unit Testing Coverage by @paragonie-security in #200
• Bigfixes and Improved Test Coverage by @paragonie-security in #202

New Contributors

• @takaram made their first contribution in #201

Full Changelog: v2.3.1...v2.4.0

We backported some optimizations from #198 by replacing the array in the Curve25519 field element with 10 integer object properties instead. The result is a 7% to 12% speedup for the overall PHPUnit suite.

What's Changed

• Backport #198 to v1.x by @paragonie-security in #199
• Backport Fixes from v2 ro v1.x branch by @paragonie-security in #203

Full Changelog: v1.22.0...v1.23.0

Deletes the erroneous PSR-0 autoloader declaration from composer.json, fixing #196

Full Changelog: v2.3.0...v2.3.1

If you need the old behavior in the meantime, you can call ParagonIE_Core_Base64_Original::decode() or ParagonIE_Core_Base64_UrlSafe:decode() to get lax padding enabled.

Aside from this fix, most of the changes were to the unit test suite in order to improve our mutation testing metrics.

What's Changed

• Fix CI for Fuzz/Mutation Tests by @paragonie-security in #190
• Update .gitattributes for psalm files by @erikn69 in #192
• Fix flaky test for PHP 8.1+ by @paragonie-security in #193
• Test enhancements + base64 no-padding fix by @paragonie-security in #194

New Contributors

• @erikn69 made their first contribution in #192

Full Changelog: v2.2.0...v2.3.0

If you need the old behavior in the meantime, you can call ParagonIE_Core_Base64_Original::decode() or ParagonIE_Core_Base64_UrlSafe:decode() to get lax padding enabled.

What's Changed

• Backport fixes from v2.x by @paragonie-security in #195

Full Changelog: v1.21.2...v1.22.0

Version 2.2.0 of Sodium_Compat is mostly a maintenance release. Some dev-dependencies were changed in order to facilitate mutation and fuzz testing in CI. No significant changes to the src directory were required as a result of this additional testing.

What's Changed

• Move namespaced part to composer autoloader by @ywisax in #185
• Test PHP 8.5 in CI on v2.x by @paragonie-security in #188
• Improve Assurance of Sodium_Compat by @paragonie-security in #189

New Contributors

• @ywisax made their first contribution in #185

Full Changelog: v2.1.0...v2.2.0

What's Changed

• GH Actions: update the action runners by @jrfnl in #183
• Test PHP 8.5 in CI on v1.x by @paragonie-security in #187

Full Changelog: v1.21.1...v1.21.2

What's Changed

• explicitly mark argument $alg as nullable by @xabbuh in #178
• define 2.0.x-dev as an alias for the master branch by @xabbuh in #179
• Optimize Curve25519 code by @paragonie-security in #181
• PHP 8.4 compat nits by @paragonie-security in #182

New Contributors

• @xabbuh made their first contribution in #178

Full Changelog: v2.0.1...v2.1.0