shopperlabs/shopper v2.6.4

v2.6.4: 2FA Column Safety Fix

on GitHub

Highlights

Renamed 2FA columns to avoid conflicts with Laravel Fortify

When Shopper is installed alongside a Laravel application that uses Laravel Fortify (or a starter kit that bundles it, such as Breeze with 2FA or Jetstream), both systems write 2FA data to the users table using the same column names: two_factor_secret and two_factor_recovery_codes. This caused silent data corruption or broken authentication whichever package last wrote to those columns would overwrite the other's encrypted values.

Starting in v2.6.4, Shopper's own columns are prefixed with store_ to make their ownership unambiguous:

All internal references have been updated: the TwoFactorAuthenticatable trait, the InteractsWithShopper trait, the Login page component, and the EnableTwoFactorAuthentication, DisableTwoFactorAuthentication, and GenerateNewRecoveryCodes actions.

Migration for existing installations. A new migration is included and will run automatically via php artisan migrate. No manual changes are required in your application unless you reference these column names directly in custom queries or seeders.

// 2026_03_10_000000_rename_two_factor_columns_on_users_table.php

Schema::table('users', static function (Blueprint $table): void {
    $table->renameColumn('two_factor_secret', 'store_two_factor_secret');
    $table->renameColumn('two_factor_recovery_codes', 'store_two_factor_recovery_codes');
});

Bug Fixes

• fix: rename 2FA columns to avoid collision with Laravel Fortify by @mckenziearts in #448