$ the-wire · showcase
FORTIFY PATCHES PASSKEY REGRESSION, MCP PREPS CLIENT LIBRARY
By RepoJournal · Filed · About Laravel · Composed from the cited sources · methodology
2 people shipped this
Fortify shipped a hotfix overnight for a passkey configuration bug that broke application overrides, while the MCP server team extracted protocol versions into a shared enum ahead of the incoming client library.
Fortify v1.37.2 landed this morning to fix a regression introduced just one release ago [1]. The bug prevented applications from overriding default passkey confirmation settings, a breaking change that would have forced teams to either revert or work around the constraint [2]. This is a patch you should pull immediately if you're running 1.37.1 and using passkeys in authentication flows.
On the MCP front, the team is laying groundwork for the client library [3]. Protocol version management was hardcoded into the server, but now both client and server need to speak the same language during the initialize handshake [4]. Extracting versions to a shared enum prevents duplication and ensures neither side drifts. This is infrastructure work that clears the path for client-side shipping.
Fortify also hardened its CI/CD pipeline by pinning GitHub Actions to commit SHAs and adding Dependabot config [5]. This is good security hygiene that more packages should adopt. Maestro continues steady work on branch main with no breaking changes or surprises.
Action items
- → Upgrade Fortify to v1.37.2 before next deploy if you're using passkeys laravel/fortify [immediate]
- → Monitor MCP client library for incoming releases laravel/mcp [monitor]
References
- [1] v1.37.2 ↗ laravel/fortify
- [2] [1.x] Fix passkey password confirmation defaults ↗ laravel/fortify
- [3] Extract protocol versions to shared enum for client reuse ↗ laravel/mcp
- [4] Extract protocol versions to shared enum for client reuse (#215) ↗ laravel/mcp
- [5] v1.37.1 ↗ laravel/fortify
