GHSA-3j7m-5g4q-gfpc TinyEnv: Missing .env file not required — may cause unexpected behavior

• Packagist datahihi1/tiny-env: < 1.0.3 → fixed in 1.0.3 • Packagist datahihi1/tiny-env: >= 1.0.9, < 1.0.11 → fixed in 1.0.11

Impact TinyEnv did not require the `.env` file to exist when loading environment variables. This could lead to unexpected behavior where the application silently ignores missing configuration, potentially causing insecure defaults or deployment misconfigurations. Affected versions: • 1.0.1 → 1.0.2 • 1.0.9 → 1.0.10 Patches The issue has been fixed in version 1.0.11. All users should upgrade to `1.0.11` or later. Workarounds As a workaround, users can manually verify the existence of the `.env` file before initializing TinyEnv, for example: ```php if (!file_exists(__DIR__ . '/.env')) { throw new RuntimeException('.env file is missing!'); }