Validator::isBoolean() accepts a whitespace-only value as valid, while an empty string is correctly rejected. filter_var() with FILTER_VALIDATE_BOOLEAN trims its input before matching, so a value that is only spaces or tabs carries no boolean but still passes.
// FLAG=" " in the environment
$dotenv->required('FLAG')->isBoolean(); // passes, but should not
// FLAG= (empty) correctly failsOnly whitespace-only values slip through; ' on ' still validates via the filter's own trimming, and a genuinely empty value already fails. The fix is to reject a value that is empty after trimming in isBoolean(), mirroring the existing empty-string guard.
This is a behaviour change, since whitespace-only values pass validation today and would start failing at boot. It belongs in the next major rather than a 5.x release.
Validator::isBoolean()accepts a whitespace-only value as valid, while an empty string is correctly rejected.filter_var()withFILTER_VALIDATE_BOOLEANtrims its input before matching, so a value that is only spaces or tabs carries no boolean but still passes.Only whitespace-only values slip through;
' on 'still validates via the filter's own trimming, and a genuinely empty value already fails. The fix is to reject a value that is empty after trimming inisBoolean(), mirroring the existing empty-string guard.This is a behaviour change, since whitespace-only values pass validation today and would start failing at boot. It belongs in the next major rather than a 5.x release.