Skip to content

[!!!][BUGFIX] Do not serialize stored value of PasswordHash by default - #166

Merged
kszymukowicz merged 2 commits into
release/5.0.0from
password-hash-serialization
Oct 4, 2026
Merged

kszymukowicz merged 2 commits into
release/5.0.0from
password-hash-serialization

Conversation

@kszymukowicz

Copy link
Copy Markdown
Collaborator

The PasswordHash type is meant for deserialization (hashing of password sent in payload). Return null on serialization instead of the stored value.

Breaking: to return the stored value as before, use @T3api\Serializer\Type\PasswordHash(serialize=true) or type "PasswordHash<'serialize'>" in YAML metadata.

…efault

The PasswordHash type is meant for deserialization (hashing of password sent in payload). Return null on serialization instead of the stored value.

Breaking: to return the stored value as before, use @T3api\Serializer\Type\PasswordHash(serialize=true) or type "PasswordHash<'serialize'>" in YAML metadata.
PHPUnit used with lowest dependencies can not double readonly classes.
Use real PasswordHashFactory with configured bcrypt hashing instead.
@kszymukowicz
kszymukowicz merged commit b08a512 into release/5.0.0 Oct 4, 2026
25 checks passed
@kszymukowicz
kszymukowicz deleted the password-hash-serialization branch October 4, 2026 17:28
@kszymukowicz kszymukowicz self-assigned this Oct 5, 2026
@kszymukowicz kszymukowicz added the breaking This introduces a breaking change label Oct 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

breaking This introduces a breaking change

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant