Revision history for Punk-TOTP

0.05    2026-08-25
        - SECURITY (CVE-2026-78619): totp_use_recovery compared the row's
          user_id with the challenged user's numerically, so identifiers with
          no leading digits all coerced to 0 and compared equal 
        - SECURITY (CVE-2026-78655): the challenge route counted failed
          attempts in the session, which without a session store is a signed
          cookie the client can replay from before its failures. The count
          moves to the user row, as totp_failed and totp_failed_at, and
          belongs to the account rather than the session.
        - ADDS: attempt_window (default 900), how long a failed attempt
          counts for.
        - The punk_totp Sqitch change adds the two columns.
        - ADDS: plugin 'TOTP' => { sqitch => 1 } ships the five columns as
          the Sqitch project punk_totp 

0.04    2026-08-23
        - Lower the min perl from 5.16 to 5.10, matching QR::Code and Punk.

0.03    2026-08-22
        - Define G_LIST as G_ARRAY on perls before 5.36, which only have the
          old name; 0.02 did not compile on 5.34 and earlier
        - Declare getentropy properly. macOS and glibc put it in
          <sys/random.h>, so the configure probe now tries that header
          first

0.02    2026-08-22
        - Strip the POD from the example application's modules

0.01    2026-08-22
        - First version
