• php 8.4+ compatibility fixes
• Rename option "Password check types" to "New password validation rules"
• Add "On login; consider known-bad passwords as compromised" option (default false)
• Add new password validation rule "Prevent passwords which contain the user's email or username, and the site's domain/name." (default false)

• Fix javascript error for XF2.2

• Update compromised password alert text to be less awkward
• On updating passwords, remove any compromised password alerts to avoid user confusion
• Add "Force email two factor authentication on compromised password" option (default disabled)
• Add "Pwned password minimum count (soft)" option.
  This allows a user to change a password to a known compromised value which is under a given number of known hits. This still generates compromised password alerts

• Force global namespace for functions which are known to be optimizable to bytecode in php, or known global functions to avoid a current namespace lookup for the function.
• Add "On login; alert the user if they have a known compromised password" option (default enabled)
• Add "Minimum time between triggering compromised password alerts on login" option (default 24 hours)

• Require php 7.2+
• Fix php 8 compatibility