fix(deps): update dependency altcha-org/altcha to v2.3.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
altcha-org/altcha	2.2.0 → 2.3.0

---

Release Notes

altcha-org/altcha-lib-php (altcha-org/altcha)

v2.3.0

Compare Source

Fixed

• verifySolution rejects every challenge with invalidSignature when no hmacSignatureSecret is configured (null or ''). It used to skip the signature check, so unsigned or tampered challenges verified. '' now also counts as unset when creating challenges.
• expiresAt matches altcha-lib (JS): 0 means no expiry, fractional timestamps (e.g. Date.now() / 1000 + 600) are accepted and signed as-is, and expiry is checked to the sub-second (no more up to 1 s of grace).
• The canonical JSON used for challenge signatures matches altcha-lib (JS) byte-for-byte, so challenges signed by one library verify in the other: JS number formatting, JS key order (array-index keys first, UTF-16 order, objects inside lists left unsorted), empty or list-shaped data encoded as an object, U+2028/U+2029 left unescaped.

Changed

• BREAKING: verifySolution without a signature secret now always fails.
• BREAKING: ChallengeParameters::$expiresAt and CreateChallengeOptions::$expiresAt are int|float|null.
• BREAKING: ChallengeParameters::toArray()['data'] is a stdClass when data is empty or list-shaped.
• BREAKING: createChallenge() and ChallengeParameters::toCanonicalJson() throw JsonException on invalid UTF-8 in data, instead of signing an empty string.
• BREAKING: challenges with float values in data that PHP used to format differently from JS are signed differently; such challenges issued before upgrading fail verification.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.