6.0.0-beta1

What's Changed

6.0.0

Breaking Changes

• PHP 8.4+ is now required (up from PHP 5.4+ in 2.x).
• License changed from BSD to MIT.
• Removed Aura.Di integration (config/Common.php and autoload.php).
• Removed tests/ContainerTest.php and config/Common.php; the library is now DI-container-agnostic.
• SubjectFilter::__invoke() no longer mutates the passed subject directly; use apply() to receive a FilterResultInterface with the sanitized copy and failures.
• SubjectFilter::assert() now accepts array|object and throws FilterFailed on failure (unchanged signature, but now typed).
• Failure now implements Aura\Filter_Interface\FailureInterface instead of JsonSerializable directly (it still serializes to JSON via the interface).
• SubjectFilter now implements Aura\Filter_Interface\SubjectFilterInterface.
• FilterFactory::newSubjectFilter() now returns SubjectFilterInterface instead of the concrete class.
• All classes now use declare(strict_types=1) and full PHP 8+ type declarations throughout.
• Removed libxml dependency (was not used internally).
• CI moved from Travis CI to GitHub Actions.

New Features

• ADD: SubjectFilter::apply() — immutable filter application that returns a FilterResultInterface containing the sanitized subject copy and any FailureCollection, without mutating the original subject.
• ADD: SubjectFilter::subfilter(string $field, string $subClass = '') — compose nested SubjectFilter instances for validating and sanitizing sub-objects and sub-arrays (multidimensional support). Sub-filter values that are objects (DTOs) are correctly preserved; arrays are round-tripped through stdClass so only stdClass nodes are converted, not plain array fields.
• ADD: Spec\SubSpec and Spec\SubSpecFactory — internal classes supporting nested sub-filter specifications.
• ADD: SanitizeSpec::useBlankField(string $field_name) — when the target field is blank, use the value from a different field as the replacement value.
• ADD: Rule\Validate\UploadedFile — validates a PSR-7 UploadedFileInterface value with configurable rules: required, fileExtension, fileMedia, sizeMax, sizeMin.
• ADD: Rule\Sanitize\UploadedFileOrNull — sanitizes a value to null if it is not a valid PSR-7 uploaded file (i.e. not an UploadedFileInterface or upload error is not UPLOAD_ERR_OK).
• ADD: SubjectFilter::useFieldMessage(string $field, string $message) — set a custom failure message for a specific field, overriding all per-rule messages.
• ADD: PHP 8.4, 8.5 support added to CI test matrix.
• ADD: aura/filter-interface package dependency introducing SubjectFilterInterface, FilterResultInterface, FilterResult, and FailureInterface.

Fixes

• FIX: PHP 8.4 deprecation — explicit nullable type added to substr $length parameter in AbstractStrlen.
• FIX: PHP 8.1 deprecation — replaced deprecated utf8_decode() with mb_convert_encoding().
• FIX: idn_to_ascii() deprecation — updated email validator to stop using INTL_IDNA_VARIANT_2003.
• FIX: Email validation now gracefully handles missing domain parts instead of raising errors.
• FIX: Type declarations and formatting corrected in AbstractStrlen.
• FIX: Missing property declarations added throughout rule classes to fix PHP 8.2 dynamic-property deprecation warnings.
• FIX: Array-type checks added where subjects could be passed as arrays to rule __invoke() methods.
• FIX: Shallow-cast bug in multidimensional filter support — only stdClass nodes are converted, preserving plain array fields passed to validators and sanitizers.

Changes

• CHG: Failure::jsonSerialize() return type is now array (typed).
• CHG: All rule __invoke() signatures updated to use typed parameters and return types.
• CHG: FailureCollection refactored for PHP 8+ typed properties and method signatures.
• CHG: FilterFactory simplified — constructor now takes only $validate_factories and $sanitize_factories arrays, typed throughout.
• CHG: PHPDoc types corrected and expanded across all classes (via @koriym).
• CHG: Various documentation and README fixes.

Full Changelog: 2.3.1...6.0.0-beta1

2.3.1

• (DOC) Update the documentation 128, 129
• (FIX) PHP Notice when trying to sanitize a string to integer 132
• (ADD) 'phpunit/phpunit' as require-dev dependency in composer.json .
• (ADD) Added CHANGELOG.md file.
• (REMOVE) Removed CHANGES.md file.

2.3.0

• (ADD) Implement JsonSerializable in the Failure class
• (DOC) Update the documentation
• (FIX) Removed undefined but registered sanitizers from SanitizerLocator

2.2.0

This release adds new validation and sanitizing rules:

• lowerCase for all-lower-case values
• upperCase for all-upper-case values
• titleCase for title-cased values
• lowerCaseFirst for values where the first character is lower-case
• upperCaseFirst for values where the first character is upper-case

2.1.0

This release adds an isNotBlank() validation specifier, and fixes a bug where sanitizing to() a rule on a missing field raised a notice.

2.0.0

First stable release.

• (FIX) The Spec class now reports failures better when closures are used in HHVM.
• (TST) Improved testing.

2.0.0-beta3

Third beta release.

• (BRK) Due to new blank-checking in ValidateSpec::applyRule(), remove 'blank' validation rule, and add 'isBlank()' validation spec method.
• (FIX) Filter arguments using arrays, resources, and objects (including closures) no longer cause errors when creating the default filter message.
• (ADD) Validation now fails on missing (unset or null) fields.
• (DOC) Update documentation.

2.0.0-beta2

Second beta release.

• (ADD) Add UTF-8 support in Alpha, Alnum, Strlen*, and Word filters with help from @mivanov93.
  • All string-length filters are now multi-byte aware using either mbstring or iconv extensions.
  • In alnum and alpha rules, use unicode letters and digits instead of ctype.
  • In word rules, use unicode letters and digits instead of \w and \W.
• (ADD) More robust email validation based on is_email() from @dominicsayers, plus IDN support as suggested by @dg via the intl extension.
• (TEST) Update Travis-CI config to use containers.
• (DOCS) Update relevant documentation.

2.0.0-beta1

First 2.0 beta release.

• BREAK: Renamed class Filter to SubjectFilter.
• BREAK: Removed method SubjectFilter::strict() and all "strict" behavior, as get_object_vars() is not guaranteed in some objects (e.g. magic get/set vs public properties)
• BREAK: Replaced method SubjectFilter::getMessages() et al with getFailures(); failures are now reported as a FailureCollection instead of as an array of text messages.
• BREAK: Removed classes Rule\Validate\Ipv4 and Ipv6 in favor of allowing flags on
  Rule\Validate\Ip.
• BREAK: Removed class Rule\Validate\InTableColumn entirely, as it requires a PDO connection. This is better implemented as part of a group of database-related filters, rather than as a special case herein.
• BREAK: Moved namespace Rule\Locator to Locator.
• BREAK: Renamed class Spec\AbstractSpec to Spec\Spec.
• BREAK: Removed method Spec\Spec::getFailureMode().
• BREAK: Moved constants from SubjectFilter to Spec\Spec.
• BREAK: Removed methods ValueFilter::assert() and setExceptionClass().
• ADD: Class FilterFactory now takes two constructor params, $validate_factories and $sanitize_factories, to allow injection of rule factories at construction time.
• ADD: Class AbstractStaticFilter to allow users to create static value filters.

2.0.0-alpha1

First 2.0 dev release; breaking changes are coming.