2.8.0

Release Notes for 2.8.0

Feature release (minor)

In release 2.7.1, multiple users reported crashes due to the introduction of declare(strict_types=1); in our codebase:

• #20
• #21
• #22

These crashes were related to misuse of the library on the caller side, since this library always expected string values as inputs for most its methods.

This release replaces declared input type declarations with native type declarations provided by PHP.

The reason why this was done, is that:

• since PHP 7.2, and specifically the Parameter Type Widening RFC by @kelunik, it is safe to declare stricter types in parent interfaces/types, whereas subtypes can completely omit the parameter type. This library supports PHP 7.3 and newer, which means that existing subclass implementations of the Escaper that do not declare string parameters in their methods will continue to work as expected
• the new string type declaration will lead to more shallow stack traces in the case of invalid input, which will further help avoiding misunderstanding of the issue, like what happened in #20. Developers should be able to determine more clearly that a non-string was given as input
• in case of developers still passing invalid input to laminas/laminas-escaper, should they not use declare(strict_types=1) in their code, then there will be an implicit conversion performed by the engine, as specified by PHP 7.0 in the Scalar Type Hints v5 by @ircmaxell

This release therefore:

• increases strictness in this library
• increases compatibility with poorly written / reviewed code

2.8.0

• Total issues resolved: 0
• Total pull requests resolved: 1
• Total contributors: 1

Enhancement

• 23: Stricter input/output type declaration, matching original type signatures from 2.0.0-beta5 release thanks to @carnage