Any breaking changes when going from v6.11.1 => v7.0.3?

[cnizzardini]

I am bumping the version constraint in a package I maintain here and am wondering if there are any breaking changes with this upgrade?

[cnizzardini]

Note, looking through my own code and the code changed in this library, it would seem I protected against this security vulnerability long before as my library enforced a minimum RSA key length of 2048. Is that the breaking change introduced in ^7.0?

• https://github.com/mixerapi/mixerapi-dev/blob/master/plugins/jwt-auth/src/Configuration/Configuration.php#L26
• https://github.com/mixerapi/mixerapi-dev/blob/master/plugins/jwt-auth/src/Configuration/Configuration.php#L98

Am I correct?

Also was there any security change for HMAC? It seems there was but I did already enforce a minimum character length of 32 for HMAC secrets...

[bshaffer]

Yes that's correct, the only breaking change is that minimum key lengths are now enforced