Version 1.2.3

It turns out that the hash directive just needs to be sha256-blah not hash-sha256-blah.

Version 1.2.2

Add preHash(), which allows users to precalculate a hash of a resource and store it directly in the CSP. (Mostly useful for locally caching the hashes of remote resources.)

Version 1.2.1

• Fix hash()
• Confirmed that CSP headers work as expected with report-uri.io

Version 1.2.0

• BC break: Adopted random_compat instead of openssl for generating a nonce
• BC break: Established PHP 5.5 as the minimum version. Previously, this was undefined.
• Added method for getting the headers as an array (see #5)
• Added method to inject headers into a PSR-7 message (see #5)
• Added support for the plugin-types directive (see #4)

Thanks @Ocramius and @Lewiscowles1986 for their feedback and assistance. (If it weren't for the possibly BC-breaking changes, this would have simply been 1.1.1.)

Version 1.1.0

General improvements, especially with older Webkit browsers.

Thanks to @timoh6 and @ScottHelme for their feedback.

Version 1.0.0

Initial release.