From 2cc6f5e5f0d43102001d65b60810423a35e83e1f Mon Sep 17 00:00:00 2001
From: Konstantinos Arvanitakis <arvanitakis@radical-elements.com>
Date: Wed, 16 Sep 2026 00:06:04 +0300
Subject: [PATCH] Bump Version to 0.18.0

---
 CHANGELOG.md  | 12 +++++++++++-
 composer.json |  2 +-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9cc4416..9e665f5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,7 +4,7 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
-## [Unreleased]
+## [0.18.0] - 2026-09-16
 
 ### Added
 
@@ -37,6 +37,16 @@ call now exist:
   client-supplied id alone (verified live: a second customer attempting to read/edit the first's
   address or order gets `AddressNotFoundException`/`OrderNotFoundException`, not the record).
 
+### Fixed
+- `Modules\Core\Auth\Services\UserOtpService::validate()`'s wrong-guess counter (`otp_attempts`)
+  was read-check-increment-saved with no locking — two guesses fired in parallel for the same
+  user could each read the same pre-increment value and both save past `max_attempts`, letting an
+  attacker exceed the 5-guess lockout by parallelizing requests instead of sending them serially.
+  Now wrapped in a `DB::transaction()` with `lockForUpdate()` on the user row, so concurrent
+  guesses serialize correctly against the shared counter.
+- The OTP code comparison used a plain `!=` rather than a timing-safe comparison. Now
+  `hash_equals()`.
+
 ## [0.17.5] - 2026-09-15
 
 ### Added
diff --git a/composer.json b/composer.json
index f4c2cf6..8f4c85f 100644
--- a/composer.json
+++ b/composer.json
@@ -2,7 +2,7 @@
   "name": "boboko/core",
   "description": "Core module — authentication and shared panel behaviour",
   "type": "library",
-  "version": "0.17.5",
+  "version": "0.18.0",
   "autoload": {
     "psr-4": {
       "Modules\\Core\\": "src/"