Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 16, 2025

Bumps altcha-org/altcha from 0.1.4 to 1.3.1.

Release notes

Sourced from altcha-org/altcha's releases.

v1.3.1

Changes:

  • fix: replace ; with & in salt delimiter for compatibility (this allows for backward-compatible extraction of salt parameters with previous versions of the libraries while still preventing the salt parameter splicing attack)

v1.3.0

Changes:

  • Fixed parameter splicing vulnerability in salt handling that enabled replay attacks.

v1.2.0

Changes:

  • Obfuscation class #16

v1.1.2

Changes:

  • Fix compose.json required PHP version (8.2)

v1.1.0

Breaking change:

  • Fixed casing of the maxNumber parameter in the Challenge

This version v.1.1.0 is compatible only with the ALTCHA widget >= v1.4.0 which supports camelCased maxNumber. For older versions of the widget, use version v1.0.0 of this library.

v1.0.0

Breaking changes:

  • Codebase migrated to OOP and PHP 8.1 #10

See the updated README file for guidance with migration. Users requiring older versions of PHP can use the version v0.1.4.

Commits
  • 9e9e70c fix: replace ; with & in salt delimiter for compatibility
  • da08c7d fix: code formatting
  • 4738de2 fix: salt parameter splicing
  • 725e604 Merge pull request #17 from yassinedoghri/feat/obfuscator
  • d94f232 feat(obfuscator): add class to generate payload for altcha-widget obfuscation
  • 293eb64 fix: composer php 8.2
  • e5fcea2 Merge pull request #13 from EvilKarter/typos
  • 67546db fix false example
  • 96d539f Remove wrong closing bracket "]" in README
  • 97085fa fix: camelCased maxNumber in the Challenge
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [altcha-org/altcha](https://github.com/altcha-org/altcha-lib-php) from 0.1.4 to 1.3.1.
- [Release notes](https://github.com/altcha-org/altcha-lib-php/releases)
- [Commits](altcha-org/altcha-lib-php@v0.1.4...v1.3.1)

---
updated-dependencies:
- dependency-name: altcha-org/altcha
  dependency-version: 1.3.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Automated pull requests that update a dependency file. php Pull requests that update php code labels Dec 16, 2025
@CLAassistant
Copy link

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@asmecher
Copy link
Member

@Godoy0722, if it's a quick thing to do, would you mind checking compatibility of the latest Altcha with our implementation?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Automated pull requests that update a dependency file. php Pull requests that update php code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants