Increase user password column to VARCHAR(80) across install schemas and migrations

[Copilot]

The user table still defined password as CHAR(40), which is too small for current password hash formats. This updates fresh-install schemas and adds a migration path for existing databases.

• Schema updates

  • Changed user.password from fixed-length CHAR(40) to VARCHAR(80) in both MySQL and SQLite install schemas.
  • Advanced the schema version so new installs start at the current definition.

• Migration for existing installs

  • Added a dated SQL migration to widen the user.password column for deployed instances.
  • Updated config.version in the migration to keep the existing upgrade mechanism aligned.

• Coverage

  • No explicit test coverage is required

Example:

ALTER TABLE `user`
    MODIFY COLUMN `password` VARCHAR(80) NULL;

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/0ca86845ce43291e8f5692c7356fccf3bcf02bf4
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/dflydev/dflydev-dot-access-data/zipball/a23a2bf4f31d3518f3ecb38660c95715dfead60f
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/ZjuysD /usr/bin/composer install --no-interaction (http block)
• https://api.github.com/repos/f3-factory/fatfree-core/zipball/3ba261541e529d20b32615fe5f7b5740ea0951a3
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/ZjuysD /usr/bin/composer install --no-interaction (http block)
• https://api.github.com/repos/myclabs/DeepCopy/zipball/07d290f0c47959fd5eed98c95ee5602db07e0b6a
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/neos/diff/zipball/c4c28a815ffee57f81d1a6aff2927612d1874106
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/nette/schema/zipball/f0ab1a3cda782dbc5da270d28545236aa80c4002
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/ZjuysD /usr/bin/composer install --no-interaction (http block)
• https://api.github.com/repos/nette/utils/zipball/2778deb6aab136c8db4ed1f4d6e9f465ca2dbee3
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/ZjuysD /usr/bin/composer install --no-interaction (http block)
• https://api.github.com/repos/nikic/PHP-Parser/zipball/dca41cd15c2ac9d055ad70dbfd011130757d1f82
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/phar-io/manifest/zipball/54750ef60c58e43759730615a392c31c80e23176
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/phar-io/version/zipball/4f7fd7836c6f332bb2933569e566a0d6c4cbed74
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/php-fig/event-dispatcher/zipball/dbefd12671e8a14ec7f180cab83036ed26714bb0
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/ZjuysD /usr/bin/composer install --no-interaction (http block)
• https://api.github.com/repos/phpstan/phpstan/zipball/9b2c7aeb83a75d8680ea5e7c9b7fca88052b766b
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/rectorphp/rector/zipball/bbd37aedd8df749916cffa2a947cfc4714d1ba2c
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/sebastianbergmann/cli-parser/zipball/c34583b87e7b7a8055bf6c450c2c77ce32a24084
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/sebastianbergmann/code-unit-reverse-lookup/zipball/5e3a687f7d8ae33fb362c5c0743794bbb2420a1d
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/sebastianbergmann/code-unit/zipball/a81fee9eef0b7a76af11d121767abc44c104e503
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/sebastianbergmann/comparator/zipball/55dfef806eb7dfeb6e7a6935601fef866f8ca48d
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/sebastianbergmann/complexity/zipball/68ff824baeae169ec9f2137158ee529584553799
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/sebastianbergmann/diff/zipball/c41e007b4b62af48218231d6c2275e4c9b975b2e
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/sebastianbergmann/environment/zipball/8074dbcd93529b357029f5cc5058fd3e43666984
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/sebastianbergmann/exporter/zipball/0735b90f4da94969541dac1da743446e276defa6
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/sebastianbergmann/global-state/zipball/987bafff24ecc4c9ac418cab1145b96dd6e9cbd9
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/sebastianbergmann/lines-of-code/zipball/856e7f6a75a84e339195d48c556f23be2ebf75d0
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/sebastianbergmann/object-enumerator/zipball/202d0e344a580d7f7d04b3fafce6933e59dae906
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/sebastianbergmann/object-reflector/zipball/24ed13d98130f0e7122df55d06c5c4942a577957
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/sebastianbergmann/php-code-coverage/zipball/7e308268858ed6baedc8704a304727d20bc07c77
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/sebastianbergmann/php-file-iterator/zipball/a95037b6d9e608ba092da1b23931e537cadc3c3c
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/sebastianbergmann/php-invoker/zipball/f5e568ba02fa5ba0ddd0f618391d5a9ea50b06d7
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/sebastianbergmann/php-text-template/zipball/0c7b06ff49e3d5072f057eb1fa59258bf287a748
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/sebastianbergmann/php-timer/zipball/e2a2d67966e740530f4a3343fe2e030ffdc1161d
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/sebastianbergmann/phpunit/zipball/33198268dad71e926626b618f3ec3966661e4d90
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/sebastianbergmann/recursion-context/zipball/47e34210757a2f37a97dcd207d032e1b01e64c7a
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/sebastianbergmann/type/zipball/462699a16464c3944eefc02ebdd77882bd3925bf
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/sebastianbergmann/version/zipball/c51fa83a5d8f43f1402e3f32a005e6262244ef17
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/symfony/deprecation-contracts/zipball/63afe740e99a13ba87ec199bb07bbdee937a5b62
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/ZjuysD /usr/bin/composer install --no-interaction (http block)
• https://api.github.com/repos/symfony/polyfill-php80/zipball/0cc9dd0f17f61d8131e7df6b84bd344899fe2608
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/ZjuysD /usr/bin/composer install --no-interaction (http block)
• https://api.github.com/repos/textile/php-textile/zipball/53593a5a57b4c1db37d96237ab204b4d5548f19f
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/thephpleague/commonmark/zipball/4efa10c1e56488e658d10adf7b7b7dcd19940bfb
  • Triggering command: REDACTED, pid is -1 (http block)
• https://api.github.com/repos/thephpleague/config/zipball/754b3604fb2984c71f4af4a9cbe7b57f346ec1f3
  • Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/ZjuysD /usr/bin/composer install --no-interaction (http block)
• https://api.github.com/repos/theseer/tokenizer/zipball/b7489ce515e168639d17feec34b8847c326b0b3c
  • Triggering command: REDACTED, pid is -1 (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

This PR updates the user.password column definition to better accommodate modern password hash lengths by widening it in both fresh-install schemas and via a new DB migration.

Changes:

• Widen user.password from CHAR(40) to VARCHAR(80) in the MySQL and SQLite install schemas.
• Bump the install schema config.version to 26.05.13.
• Add a new migration (db/26.05.13.sql) intended to widen user.password for existing installs and update the stored DB version.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
db/database.sqlite.sql	Updates SQLite install schema user.password to VARCHAR(80) and bumps config.version.
db/database.sql	Updates MySQL install schema user.password to varchar(80) and bumps config.version.
db/26.05.13.sql	Adds a migration to widen user.password and update config.version.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.