| security | by dg | IdentityHandler: make getGuestIdentity() a regular interface method (BC break) Promotes the optional @method to a required method, so User no longer needs method_exists() to call it. BC break: existing IdentityHandler implementations must now declare getGuestIdentity(). | | | |
| security | by dg | User: deprecated magic properties (BC break) | | | |
| security | by dg | SimpleIdentity: reading an undeclared property throws (BC break) Until now __get() returned null for an unknown key and, because it returns by reference, silently created that key in the data (and thus in the storage). It now throws MemberAccessException, like any other Nette object. This also ends the by-ref write pattern $identity->cart[] = $item on a key that has not been set yet. | | | |
| security | by dg | SimpleIdentity: uses __serialize & __unserialize | | | |
| security | by dg | Identity -> SimpleIdentity Identity class must exist as an alias in order to read it from session | | | |
| security | by dg | IIdentity: added return typehint (BC break) | | | |
| security | by dg | removed deprecated IAuthenticator (BC break) | | | |
| security | by dg | used PHP 8.2 features | | | |
| security | by dg | uses nette/http 4 | | | |
| security | by dg | requires PHP 8.3 | | | |
| security | by dg | opened 4.0-dev | | | |
| security | by dg | uses dresscode | | | |
| security | by dg | added upgrading.md | | | |
| security | by dg | added support for PHP 8.6 | | | |
| security | by dg | uses dresscode | | | |
| security | by dg | cs | | | |
| security | by dg | cs: grouped use statements | | | |
| security | by dg | cs: only compiler-optimized functions in use-function imports | | | |
| security | by dg | updated github actions | | | |
| security | by dg | composer.json: updated description, keywords and homepage | | | |
| schema | by dg | updated docs | | | |
| schema | by dg | removed support for key PreventMerging, removed Helpers::merge() (BC break) A default is no longer merged into the value, so a tuple can have one. | | | |
| schema | by dg | AnyOf::merge() merges layers according to the matched alternative instead of blindly (BC break) | | | |
| schema | by dg | Structure: an undescribed item colliding as arrays is a merge error (BC break) As with arrays, a key the shape does not describe that holds an array in both layers is a CannotMerge error instead of a silent guess, unless mergeMode() is set explicitly. A null layer keeps an array below it and overwrites a scalar, the same rule Type follows. | | | |
| schema | by dg | arrays merge only according to the schema (BC break) Deep merging follows the schema only: ArrayType recurses through its items schema, and a colliding key holding arrays on both sides with no schema guidance is a CannotMerge error instead of a silent guess; an explicit mergeMode() is the declared opt-out. The blind Helpers::merge() no longer backs Type::mergeValues(); a null layer still loses to an array and beats a scalar. | | | |
| schema | by dg | ArrayType: mergeDefaults() are disabled by default (BC break) [Closes #28, Closes #31] | | | |
| schema | by dg | Schema::merge() receives Context and reports merge errors through it (BC break) | | | |
| schema | by dg | the options moved to the kind subclasses (BC break) min(), max(), pattern(), items() and mergeDefaults() live on NumberType, StringType and ArrayType; on a plain Type they throw DeprecatedException saying who has them, closing the deprecations 1.4 opened. Type::complete() became a template the subclasses hook into (coerce, validate, mergeDefault, normalizeValue, mergeValues), the items completion moved to ArrayType::completeItems() and describe() reports the subclass options tightened by a deprecated range in the expression. TupleType keeps its own min() and max() and completes its positions in the same hooks. | | | |
| schema | by dg | Expect::type(): a union of different kinds is anyOf() (BC break) A union such as 'int|string' or 'scalar' has no options of its own (1.4 deprecated them), so Expect::type() now builds anyOf() of the variants via the new TypeExpression::format(), and error messages read "int|string" the way anyOf() reports alternatives. A union of a single kind ('int|float', 'int|null') keeps its subclass and its options, exactly as 1.4 promised. A directly constructed plain Type still accepts a union and keeps the 1.4 deprecation notice for its options. | | | |
| schema | by dg | Type validates by itself; Validators-coupled expressions are deprecated (BC break) Type checks the value against the parsed expression on its own: matches() is the one place that knows every Kind, and Validators is asked only about named string formats and the deprecated constructs. Those still work exactly as before but raise a notice and 2.1 refuses them: a range in the expression ('int:1..5', use min() and max()), a validator name that is not a type ('numeric' and friends, use assert()), and a directly constructed Type for a kind that has its own class (use Expect::type()). Helpers::validateType() and the deprecated helpers of Base are gone, getCastStrategy() no longer consults Validators for the builtin list. | | | |
| schema | by dg | used #Deprecated | | | |
| schema | by dg | Expect::from() works with class names | | | |