Bump christian-riesen/base32 from 1.6.1 to 2.0.1 in /lam

[dependabot]

Bumps christian-riesen/base32 from 1.6.1 to 2.0.1.

Release notes

Sourced from christian-riesen/base32's releases.

2.0.1

Due to a mistake, needed to retag this release.

2.0.0 BC Break Stricter Checking

This release brings the library into the present with a 8.1 PHP requirement, some upgraded requirements in general and a stricter checking. Look at the changelog for more details.

Changelog

Sourced from christian-riesen/base32's changelog.

Changelog

2.0.0 (unreleased)

Backward-incompatible: PHP 8.1+ required

The minimum supported PHP version is now 8.1. If you need to run on PHP 7.2 – 8.0, stay on the 1.x release line.

Backward-incompatible: strict, RFC 4648-conformant decoding

Base32::decode() and Base32Hex::decode() now reject malformed input instead of silently sanitizing it. This resolves Trail of Bits finding TOB-WIKI2FA-5 (Wikimedia Foundation 2FA review).

Previously the decoder uppercased the input and stripped every character that was not in the alphabet — including padding — which violated RFC 4648 §3.3 ("Implementations MUST reject the encoded data if it contains characters outside the base alphabet") and allowed non-canonical values to decode.

decode() now throws \InvalidArgumentException when the input:

• has a length that is not a multiple of 8 (padding is required, RFC 4648 §3.2);
• contains any character outside the alphabet (RFC 4648 §3.3);
• contains misplaced or an invalid number of = padding characters;
• is not uppercase — decoding is now case-sensitive (RFC 4648 uses the uppercase alphabet). Lowercase input is no longer accepted.
• contains non-zero trailing bits, i.e. a non-canonical encoding (RFC 4648 §3.5).

An empty string still decodes to an empty string. encode() is unchanged; it was already conformant, so any string produced by encode() still round-trips.

Migration: if you pass user-supplied Base32 (for example TOTP secrets that may be lowercase or grouped with spaces), normalize it before decoding:

$secret = strtoupper(preg_replace('/\s+/', '', $userInput));
$bytes  = Base32::decode($secret); // throws on anything still invalid

Removed

• The BASE32HEX_PATTERN protected constant (was misnamed — it held the standard Base32 pattern, not the extended-hex one) and the '=' entry in the MAPPING constant. Both were implementation details of the old lenient decoder and are no longer used.

Commits

• be07b4a Upgrade github actions
• 81ac565 Full overhaul to 8.1 minimum
• 9646693 Add additional testing
• 357cc91 Stricter validations
• See full diff in compare view

[deepsource-io]

DeepSource Code Review

We reviewed changes in 75193e5...77d935a on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
PHP		Jul 27, 2026 6:30p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.