Merge pull request #44 from iazaran/Dependabort-alerts-fixed

Dependabort alerts fixed

Author: iazaran

CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to the `iazaran/smart-cache` package will be documented in t
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.12.1] - 2026-05-29
+### Security
+- Upgraded `symfony/mime` from `v8.0.8` to `v8.1.0` (>= patched line `8.0.12`) to address GHSA Email Header / SMTP Command Injection via CRLF in `Symfony\Component\Mime\Address` and Email Header Injection via Non-Token Characters in Mime Parameter Names. Transitive bumps: `symfony/deprecation-contracts` `v3.6.0` → `v3.7.0`, `symfony/polyfill-intl-idn` `v1.36.0` → `v1.38.1`, `symfony/polyfill-intl-normalizer` `v1.36.0` → `v1.38.0`, `symfony/polyfill-mbstring` `v1.36.0` → `v1.38.1`. No package API change.
+### Changed
+- `SmartCache::contentHash()` (Cache DNA write-deduplication hot path) now uses `xxh128` (PHP 8.1+, already a hard requirement) instead of `md5`. Output is still 32 lowercase hex characters, so the `_sc_dna:{key}` storage format is unchanged. Significantly faster on every `put()` when deduplication is enabled (default `true`). Existing `_sc_dna:*` entries from prior releases will mismatch once after upgrade and be transparently overwritten on the next `put()`; no errors, no data corruption.
+### Added
+- `tests/Unit/SmartCacheTest.php::test_cache_dna_hash_format_is_stable` locks the stored DNA hash contract (32 lowercase hex characters, deterministic for identical inputs, sensitive to value changes) so a future algorithm swap that breaks the key-length assumption is caught immediately.
+
 ## [1.12.0] - 2026-05-21
 ### Fixed
 - `CompressionStrategy::restore()` now explicitly validates the `data` field, the base64 decode step, the `gzdecode()` decompression step, and the `unserialize()` step, throwing `RuntimeException` on any failure. Previously a corrupted compressed payload could surface as a silent PHP warning followed by a `false`/garbage return value, which the cache layer would then re-cache. The `unserialize()` call is now wrapped with a temporary error handler so corrupted payloads no longer leak `E_NOTICE` warnings into application logs (round-tripping the value `false` still works).

README.md

@@ -383,7 +383,7 @@ $users = SmartCache::get('users');
 ## Testing
 
 ```bash
-composer test            # 470 tests, 1,931 assertions
+composer test            # 471 tests, 1,936 assertions
 composer test-coverage   # with code coverage
 ```
 

composer.lock

@@ -2903,7 +2903,7 @@ <h2>Package Test Suite</h2>
                     <p>SmartCache ships with automated coverage for the Laravel-compatible API surface, optimization strategies, SWR patterns, invalidation, memoization, dashboard command execution, and large-data recovery behavior.</p>
 
                     <pre><code class="language-bash">composer test
-# 470 tests, 1,931 assertions
+# 471 tests, 1,936 assertions
 
 vendor/bin/phpunit tests/Unit/Strategies/ChunkingStrategyTest.php --testdox
 vendor/bin/phpunit tests/Unit/SmartCacheTest.php --filter "missing_chunk|self_healing" --testdox</code></pre>

docs/index.html

@@ -957,12 +957,19 @@ public function persistCostMetadata(): void
     /**
      * Compute a fast content hash for write deduplication (Cache DNA).
      *
+     * Uses `xxh128` (PHP 8.1+, guaranteed by the package's PHP requirement) which is
+     * significantly faster than `md5` on typical payloads while producing the same
+     * 32-character hex output. This is a non-cryptographic dedup check; collision
+     * resistance is sufficient for distinguishing payload identity, and timing
+     * comparisons here are not security-relevant because the hash is never an
+     * authentication token.
+     *
      * @param mixed $value
      * @return string
      */
     protected function contentHash(mixed $value): string
     {
-        return \md5(\serialize($value));
+        return \hash('xxh128', \serialize($value));
     }
 
     /**

src/SmartCache.php

@@ -1209,6 +1209,38 @@ public function test_cache_dna_disabled_always_writes()
         $this->assertNull($this->getCacheStore()->get("_sc_dna:{$key}"));
     }
 
+    public function test_cache_dna_hash_format_is_stable()
+    {
+        // Locks the contract for the stored `_sc_dna:{key}` value:
+        //   - 32 lowercase hex characters (same width as md5, drop-in compatible
+        //     with any operator tooling that expects a fixed-width hash)
+        //   - deterministic for identical inputs
+        //   - sensitive to value changes (otherwise dedup would skip legitimate writes)
+        // Catches accidental algorithm swaps to a wider/narrower hash (e.g. sha256, crc32).
+        $this->app['config']->set('smart-cache.deduplication.enabled', true);
+
+        $smartCache = new SmartCache(
+            $this->getCacheStore(),
+            $this->getCacheManager(),
+            $this->app['config'],
+        );
+
+        $key = 'dna-format-key';
+        $smartCache->put($key, 'payload-A', 3600);
+        $hashA = $this->getCacheStore()->get("_sc_dna:{$key}");
+
+        $this->assertIsString($hashA);
+        $this->assertSame(32, \strlen($hashA));
+        $this->assertMatchesRegularExpression('/^[0-9a-f]{32}$/', $hashA);
+
+        $smartCache->forget($key);
+        $smartCache->put($key, 'payload-A', 3600);
+        $this->assertSame($hashA, $this->getCacheStore()->get("_sc_dna:{$key}"));
+
+        $smartCache->put($key, 'payload-B', 3600);
+        $this->assertNotSame($hashA, $this->getCacheStore()->get("_sc_dna:{$key}"));
+    }
+
     // ---------------------------------------------------------------
     // rememberIf (Conditional Caching) tests
     // ---------------------------------------------------------------