Xon Password Tools 3.14.2

• Allow disabling the Pwned password cache
• Improve pruning of the cached pwned passwords hashes by using batched deletes instead of a single delete statement

• Require StandardLib v1.23.0+
• Add Custom 2fa device trust lifetime option (default disabled)
  • Phrase to customize: svPasswordTools_trust_device_desc_x / svPasswordTools_trust_this_device_for_30_days_x
    Only plural phrases, because why would you force 2fa to 1 day. That is horrible.

• Remove unused style properties

NA

• php 8.4+ compatibility fixes
• Rename option "Password check types" to "New password validation rules"
• Add "On login; consider known-bad passwords as compromised" option (default false)
• Add new password validation rule "Prevent passwords which contain the user's email or username, and the site's domain/name." (default false)

Fix javascript error when using XF2.3

• Require standardLib v1.20.0+
• Restore XF2.1 support, note front-end Zxcvbn requires XF2.2+
• Support XF2.3+
• php 8.4+ compatibility

• Add "Force password reset on compromised password" option
  • This option is likely overkill for most sites, and is not generally recommended

• Fix changing user entity while a write is pending in some cases
• Add "Use rejected password fragments in password meter" option (default disabled).
  Take rejected password fragments into consideration when showing the password strength meter to the user.
  Security note: this makes the full list of rejected password fragments visible to end users; ensure that there aren't any sensitive password fragments before enabling.

This add-on is now avaliable on atelieraphelion.com

• Require StandardLib v1.18.0+
• Add new "User-group for compromised passwords" option, which adds uses to the selected user-group when it is detected they have a compromised password on login.
  Defaults to disabled. Useful for targeting with notices