Major upgrade

THis PR removes all deprecated features

.github/workflows/dependency-review.yml

@@ -1,9 +1,3 @@
-# Dependency Review Action
-#
-# This Action will scan dependency manifest files that change as part of a Pull Request, surfacing known-vulnerable versions of the packages declared or updated in the PR. Once installed, if the workflow run is marked as required, PRs introducing known-vulnerable packages will be blocked from merging.
-#
-# Source repository: https://github.com/actions/dependency-review-action
-# Public documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement
 name: 'Dependency Review'
 on: [pull_request]
 

.github/workflows/infection.yml

@@ -1,5 +1,3 @@
-# yaml-language-server: $schema=https://json.schemastore.org/github-workflow
-
 name: "Integrate"
 
 on:

.github/workflows/integrate.yml

@@ -1,5 +1,3 @@
-# yaml-language-server: $schema=https://json.schemastore.org/github-workflow
-
 name: "Integrate"
 
 on:
@@ -32,7 +30,7 @@ jobs:
       - name: "Set up PHP"
         uses: "shivammathur/setup-php@v2"
         with:
-          php-version: "8.2"
+          php-version: "8.3"
           coverage: "none"
 
       - name: "Checkout code"
@@ -56,7 +54,6 @@ jobs:
         operating-system:
           - "ubuntu-latest"
         php-version:
-          - "8.1"
           - "8.2"
           - "8.3"
         dependencies:
@@ -98,7 +95,7 @@ jobs:
         operating-system:
           - "ubuntu-latest"
         php-version:
-          - "8.2"
+          - "8.3"
     runs-on: ${{ matrix.operating-system }}
     steps:
       - name: "Set up PHP"
@@ -132,7 +129,7 @@ jobs:
       - name: "Set up PHP"
         uses: "shivammathur/setup-php@v2"
         with:
-          php-version: "8.2"
+          php-version: "8.3"
           extensions: "ctype, curl, dom, json, libxml, mbstring, openssl, phar, simplexml, sodium, tokenizer, xml, xmlwriter, zlib"
           coverage: "none"
 
@@ -164,13 +161,16 @@ jobs:
       - name: "Set up PHP"
         uses: "shivammathur/setup-php@v2"
         with:
-          php-version: "8.2"
+          php-version: "8.3"
           extensions: "ctype, curl, dom, json, libxml, mbstring, openssl, phar, simplexml, sodium, tokenizer, xml, xmlwriter, zlib"
           coverage: "none"
 
       - name: "Checkout code"
         uses: "actions/checkout@v4"
 
+      - name: "Get tags"
+        run: git fetch --tags origin
+
       - name: "Check adherence to EditorConfig"
         uses: "greut/eclint-action@v0"
 
@@ -197,7 +197,7 @@ jobs:
       - name: "Set up PHP"
         uses: "shivammathur/setup-php@v2"
         with:
-          php-version: "8.2"
+          php-version: "8.3"
           extensions: "ctype, curl, dom, json, libxml, mbstring, openssl, phar, simplexml, sodium, tokenizer, xml, xmlwriter, zlib"
           coverage: "xdebug"
 

.github/workflows/lock-closed-issues.yml

@@ -2,7 +2,7 @@ name: 'Lock Issues'
 
 on:
   schedule:
-    - cron: '0 0 * * *'
+    - cron: '12 6 * * *'
 
 jobs:
   lock:

.github/workflows/release-on-milestone-closed.yml

@@ -1,5 +1,3 @@
-# https://help.github.com/en/categories/automating-your-workflow-with-github-actions
-
 name: "Automatic Releases"
 
 on:

.github/workflows/scorecards.yml

@@ -1,12 +1,11 @@
 name: Scorecards supply-chain security
 
 on:
-  # Only the default branch is supported.
-  branch_protection_rule:
   schedule:
     - cron: '34 4 * * 6'
   push:
-    branches: [ "4.6.x", "4.7.x" ]
+    branches:
+      - "*.*.x"
 
 # Declare default permissions as read only.
 permissions: read-all

.gitsplit.yml

@@ -5,9 +5,7 @@ splits:
     target: "https://${GH_TOKEN}@github.com/web-auth/ux.git"
   - prefix: "src/symfony"
     target: "https://${GH_TOKEN}@github.com/web-auth/webauthn-symfony-bundle.git"
-  - prefix: "src/metadata-service"
-    target: "https://${GH_TOKEN}@github.com/web-auth/webauthn-metadata-service.git"
 
 origins:
-  - ^(1|2|3|4)\.\d+\.x$
-  - ^(1|2|3|4)\.\d+\.\d+$
+  - ^\d+\.\d+\.x$
+  - ^\d+\.\d+\.\d+$

composer.json

@@ -12,7 +12,6 @@
         "symfony-ux",
         "bundle"
     ],
-    "minimum-stability": "dev",
     "homepage": "https://github.com/web-auth/webauthn-framework",
     "authors": [
         {
@@ -28,8 +27,7 @@
         "psr-4": {
             "Webauthn\\": "src/webauthn/src/",
             "Webauthn\\Bundle\\": "src/symfony/src/",
-            "Webauthn\\Stimulus\\": "src/stimulus/src/",
-            "Webauthn\\MetadataService\\": "src/metadata-service/src/"
+            "Webauthn\\Stimulus\\": "src/stimulus/src/"
         }
     },
     "autoload-dev": {
@@ -43,37 +41,28 @@
         }
     },
     "require": {
-        "php": ">=8.1",
+        "php": ">=8.2",
         "ext-json": "*",
-        "ext-mbstring": "*",
         "ext-openssl": "*",
-        "lcobucci/clock": "^2.2|^3.0",
-        "nyholm/psr7": "^1.5",
         "paragonie/constant_time_encoding": "^2.6|^3.0",
-        "phpdocumentor/reflection-docblock": "^5.3",
         "psr/clock": "^1.0",
         "psr/event-dispatcher": "^1.0",
-        "psr/http-client": "^1.0",
-        "psr/http-factory": "^1.0",
         "psr/log": "^1.0|^2.0|^3.0",
         "spomky-labs/cbor-php": "^3.0",
         "spomky-labs/pki-framework": "^1.0",
-        "symfony/config": "^6.1|^7.0",
-        "symfony/dependency-injection": "^6.1|^7.0",
+        "symfony/config": "^6.4|^7.0",
+        "symfony/dependency-injection": "^6.4|^7.0",
         "symfony/deprecation-contracts": "^3.2",
-        "symfony/framework-bundle": "^6.1|^7.0",
-        "symfony/http-client": "^6.1|^7.0",
-        "symfony/psr-http-message-bridge": "^2.1|^6.1|^7.0",
-        "symfony/property-access": "^6.1|^7.0",
-        "symfony/property-info": "^6.1|^7.0",
-        "symfony/security-bundle": "^6.1|^7.0",
-        "symfony/security-core": "^6.1|^7.0",
-        "symfony/security-http": "^6.1|^7.0",
-        "symfony/serializer": "^6.1|^7.0",
-        "symfony/uid": "^6.1|^7.0",
-        "symfony/validator": "^6.1|^7.0",
-        "web-auth/cose-lib": "^4.2.3",
-        "web-token/jwt-library": "^3.3|^4.0"
+        "symfony/clock": "^6.4|^7.0",
+        "symfony/framework-bundle": "^6.4|^7.0",
+        "symfony/http-client": "^6.4|^7.0",
+        "symfony/security-bundle": "^6.4|^7.0",
+        "symfony/security-core": "^6.4|^7.0",
+        "symfony/security-http": "^6.4|^7.0",
+        "symfony/serializer": "^6.4|^7.0",
+        "symfony/uid": "^6.4|^7.0",
+        "symfony/validator": "^6.4|^7.0",
+        "web-auth/cose-lib": "^4.2.3"
     },
     "replace": {
         "web-auth/webauthn-lib": "self.version",
@@ -90,40 +79,44 @@
         }
     },
     "suggest": {
-        "psr/clock-implementation": "As of 4.5.x, the PSR Clock implementation will replace lcobucci/clock",
         "psr/log-implementation": "Recommended to receive logs from the library",
         "symfony/security-bundle": "Symfony firewall using a JSON API (perfect for script applications)"
     },
     "require-dev": {
         "doctrine/dbal": "^3.8|^4.0",
-        "doctrine/doctrine-bundle": "^2.11",
+        "doctrine/doctrine-bundle": "^2.12",
         "doctrine/orm": "^2.14|^3.0",
         "doctrine/persistence": "^3.1",
         "ekino/phpstan-banned-code": "^1.0",
-        "infection/infection": "^0.27 || ^0.29",
-        "matthiasnoback/symfony-dependency-injection-test": "^4.3|^5.0",
-        "php-http/curl-client": "^2.2",
-        "php-http/mock-client": "^1.5",
+        "infection/infection": "^0.29",
+        "matthiasnoback/symfony-dependency-injection-test": "^5.1",
         "php-parallel-lint/php-parallel-lint": "^1.3",
+        "phpdocumentor/reflection-docblock": "^5.3",
         "phpstan/extension-installer": "^1.3",
         "phpstan/phpstan": "^1.8",
         "phpstan/phpstan-deprecation-rules": "^1.0",
         "phpstan/phpstan-phpunit": "^1.1",
         "phpstan/phpstan-strict-rules": "^1.4",
-        "phpunit/phpunit": "^10.1",
-        "qossmic/deptrac-shim": "^1.0",
+        "phpunit/phpunit": "^10.1|^11.0",
+        "psr/http-client": "^1.0",
+        "psr/http-factory": "^1.1",
+        "psr/http-message": "^2.0",
+        "qossmic/deptrac": "^2.0",
         "rector/rector": "^1.0",
         "roave/security-advisories": "dev-latest",
+        "staabm/phpstan-todo-by": "^0.1.25",
         "symfony/asset": "^6.4|^7.0",
         "symfony/asset-mapper": "^6.4|^7.0",
         "symfony/browser-kit": "^6.4|^7.0",
         "symfony/filesystem": "^6.4|^7.0",
         "symfony/finder": "^6.4|^7.0",
         "symfony/monolog-bundle": "^3.8",
         "symfony/phpunit-bridge": "^6.4|^7.0",
+        "symfony/property-info": "^6.4|^7.0",
         "symfony/var-dumper": "^6.4|^7.0",
         "symfony/yaml": "^6.4|^7.0",
-        "symplify/easy-coding-standard": "^12.0"
+        "symplify/easy-coding-standard": "^12.0",
+        "web-token/jwt-library": "^3.4|^4.0"
     },
     "extra": {
         "thanks": {

deptrac.yaml

@@ -1,35 +1,35 @@
-parameters:
+deptrac:
   paths:
     - './src'
   layers:
     - name: 'Webauthn'
       collectors:
         - type: 'directory'
-          regex: 'src/webauthn/.*'
+          value: 'src/webauthn/.*'
     - name: 'UX'
       collectors:
         - type: 'directory'
-          regex: 'src/stimulus/.*'
+          value: 'src/stimulus/.*'
     - name: 'SymfonyBundle'
       collectors:
         - type: 'directory'
-          regex: 'src/symfony/.*'
+          value: 'src/symfony/.*'
     - name: 'MetadataService'
       collectors:
         - type: 'directory'
-          regex: 'src/metadata-service/.*'
+          value: 'src/metadata-service/.*'
     - name: 'Vendors'
       collectors:
-        - { type: className, regex: '^Cose\\' }
-        - { type: className, regex: '^Symfony\\' }
-        - { type: className, regex: '^Jose\\' }
-        - { type: className, regex: '^Psr\\' }
-        - { type: className, regex: '^SpomkyLabs\\Pki\\' }
-        - { type: className, regex: '^CBOR\\' }
-        - { type: className, regex: '^Lcobucci\\' }
-        - { type: className, regex: '^ParagonIE\\' }
-        - { type: className, regex: '^Safe\\' }
-        - { type: className, regex: '^Doctrine\\' }
+        - { type: classLike, value: '^Cose\\' }
+        - { type: classLike, value: '^Symfony\\' }
+        - { type: classLike, value: '^Jose\\' }
+        - { type: classLike, value: '^Psr\\' }
+        - { type: classLike, value: '^SpomkyLabs\\Pki\\' }
+        - { type: classLike, value: '^CBOR\\' }
+        - { type: classLike, value: '^Lcobucci\\' }
+        - { type: classLike, value: '^ParagonIE\\' }
+        - { type: classLike, value: '^Safe\\' }
+        - { type: classLike, value: '^Doctrine\\' }
   ruleset:
     MetadataService:
       - 'Vendors'

ecs.php

@@ -2,7 +2,6 @@
 
 declare(strict_types=1);
 
-use PhpCsFixer\Fixer\Alias\MbStrFunctionsFixer;
 use PhpCsFixer\Fixer\ArrayNotation\ArraySyntaxFixer;
 use PhpCsFixer\Fixer\ClassNotation\ProtectedToPrivateFixer;
 use PhpCsFixer\Fixer\Comment\HeaderCommentFixer;
@@ -53,7 +52,6 @@
     $config->rule(ProtectedToPrivateFixer::class);
     $config->rule(DeclareStrictTypesFixer::class);
     $config->rule(NativeConstantInvocationFixer::class);
-    $config->rule(MbStrFunctionsFixer::class);
     $config->rule(LinebreakAfterOpeningTagFixer::class);
     $config->rule(CombineConsecutiveIssetsFixer::class);
     $config->rule(CombineConsecutiveUnsetsFixer::class);