WordPress/two-factor 0.17.0-rc on GitHub

Ensure that regular passwords can't bypass the two-factor requirement for REST API and XML-RPC requests by @faisalahammad in #989. Thanks mqrble for responsibly reporting the issue.
Add diagnostics for failed login nonce verification by @georgestephanis in #973. Thanks Ananda Dhakal (Patchstack) for responsibly reporting the issue.

Add WP-CLI support with wp two-factor commands by @masteradhoc in #905
Respect intentional bypass via the two_factor_is_required_for_user filter by @masteradhoc in #882
Add a two_factor_fallback_provider_for_user filter for when a user's stored providers are no longer registered by @masteradhoc in #882
Add early notice for soon exhausting recovery codes by @masteradhoc in #907
Add privacy policy content registration by @masteradhoc in #869

Fail closed when CSPRNG is unavailable during nonce generation by @dknauss in #877
Only clear the login nonce once it has expired by @georgestephanis in #980
Fix unslashed REMOTE_ADDR warning in email provider by @masteradhoc in #975
Fix TOTP verify button after resetting authenticator app by @lakrisgubben in #979
Remove two_factor_enabled_providers option on uninstall by @faisalahammad in #903
Fix misleading notice by @masteradhoc in #858
Reword mixed-audience login failure notice to be informational by @dknauss in #922
Rework fail-safe by @masteradhoc in #927
Add coverage for provider-specific fallback notices by @dknauss in #923
Fix HTML5 validation issues by @masteradhoc in #910
Fix users list table fatals (wp_die) when a user's 2FA provider is deregistered by @masteradhoc in #933

Prepare for the WordPress 7.0 release by @masteradhoc in #834
Prepare for the WordPress 7.1 release by @masteradhoc in #900
Sync login_header() and login_footer() with WP 7.1 by @masteradhoc in #963
Update PHPStan to 2.x and exclude includes/ from analysis by @masteradhoc in #972
Validate against PHPStan version 3, 4 and 5 by @masteradhoc in #948
Update wp-coding-standards/wpcs to 3.4.1 by @obenland in #947
Fix PHPCS and PHPStan issues across multiple files by @aslamdoctor in #818
Remove ReflectionProperty::setAccessible() and ReflectionMethod::setAccessible() calls in the test suite by @masteradhoc in #942
Fix Codecov badge by adding OIDC permission for tokenless upload by @nimesh-xecurify in #856
Update GitHub Actions workflows by @johnbillion in #892
Update Playground PR preview action to v4 by @obenland in #985
Add FAQ entries for Multisite, locked-out users, and role enforcement by @masteradhoc in #881
Update .md files with the latest two-factor changes and requirements by @masteradhoc in #929
Update PR template by @masteradhoc in #870
Unbreak CI: PHPStan false positive and matrix fail-fast by @georgestephanis in #974

WordPress/two-factor 0.17.0-rc Version 0.17.0-rc on GitHub