Releases: paragonie/certainty
Version 2.9.0
paragonie-security
P.I.E. Security Team
The primary signing key was rotated!
The device that contained the signing key has been destroyed, so we have promoted our backup key to the primary one and generated a new backup keypair.
Version 2.8.3
paragonie-security
P.I.E. Security Team
Version 2.8.2
paragonie-security
P.I.E. Security Team
- No code changes, just includes the latest CACert bundles, including the bundle after LetsEncrypt's intermediate certificate expired.
- Although Certainty will, by design, try to keep the bundles up-to-date, if you're in a Composer-based deployment situation where the Certainty update process isn't being used, pulling the latest version in a staging environment will tell you if the LetsEncrypt intermediate expiration breaks your app.
- If necessary, rollback to 2.8.1 in your composer.json file until you've resolved the network issue.
Version 2.8.1
paragonie-security
P.I.E. Security Team
- Block vulnerable versions of Composer.
Version 2.8.0
paragonie-security
P.I.E. Security Team
Version 2.7.0
paragonie-security
P.I.E. Security Team
- Fix compatibility with PHP 7.4
- Updated Psalm in require-dev from ^1|^2 to ^1|^3.
Version 2.6.1
paragonie-security
P.I.E. Security Team
- Expand unit testing coverage to PHP 7.4
- Updated composer.json to allow installing on PHP 8
Version 2.6.0
paragonie-security
P.I.E. Security Team
We had to reinstall the server. Bgcc1QfkP0UNgMZuHzi0hC1hA1SoVAyUrskmSkzRw3E= is the public key of the new default Chronicle server.
Version 2.5.0
paragonie-security
P.I.E. Security Team
Previously, the default behavior of RemoteFetch was to check a Chronicle instance (i.e. the one at php-chronicle.pie-hosted.com), regardless of whether or not the bundle was already fetched and verified.
This was wasteful, and led to an accidental stress test of the Chronicle instance for the PHP community.
Now, the default behavior of RemoteFetch is to only query Chronicle instances on freshly-downloaded bundles, rather than every time getLatestBundle() is invoked.
We've already done a lot of work to ensure our server is stable even under the tremendous load we were seeing previously, but we do ask everyone to update to the latest version to improve the performance of your code that uses Certainty.
Version 2.4.0
paragonie-security
P.I.E. Security Team
- You can now specify an HTTP connection timeout for Chronicle queries and Github fetches.