search

thephpleague / oauth2-server

A spec compliant, secure by default PHP OAuth 2.0 Server
https://oauth2.thephpleague.com
MIT License
6.51k stars 1.12k forks source link

Version conflict with lcobucci/jwt 4.1.4 #1235

Closed ghdi closed 3 years ago

ghdi commented 3 years ago

Hi,

Currently, I have installed league/oauth2-server 8.2.4 and lcobucci/jwt 4.1.4, which works like a charm.

When trying to upgrade to league/oauth2-server 8.3.1, I bump into a version conflict with lcobucci/jwt 4.1.4, requiring lcobucci/jwt ^3.4 || ~4.0.0 instead.

Is there something I might have missed in the release notes?

Thanks!

NicoHaase commented 3 years ago

This looks related to https://github.com/thephpleague/oauth2-server/commit/a60313319786ca17973791dab6cf99f13b43d976 - but I'm a bit surprised that there are no more details, like a pull request or a description of the problem that existed.

Sephster commented 3 years ago

Sorry folks I'm on holiday just now and can't remember off the top of my head. Basically the lib needs to support php 7.2 and there were some functions in jwt 4.1 that didn't support 7.2 so we had to downgrade

derrabus commented 3 years ago

On PHP 7.2, Composer should not install version 4.1 of the jwt library (and also not 4.0, fwiw). Is there something we can do to broaden the compatibility for the library, allowing applications to install 4.1 again? I don't feel comfortable pinning down a dependency that is critical to the authentication layer of my application to an outdated release.

Sephster commented 3 years ago

Sorry for the delay. I've looked into this now and remember why I made this change. Version 4.1 of the JWT library deprecated validAt in favour of the strictValidAt() check. However, the strictValidAt() method is not in version 3.4 which we support for PHP version 7.2.

I raised an issue https://github.com/lcobucci/jwt/issues/722 to see if we could backport strictValidAt() to version 3.4 but was told this wouldn't happen because the 3.4x branch will only accept security fixes now.

We originally were going to ditch PHP version 7.2 but after discussions with Dries Vints, decided to keep it for one release longer so Passport could move on to the latest version of the server without having to wait for their own upgrade cycle.

I will likely ditch PHP 7.2 on the next release and we can upgrade the version of the JWT library then.

@derrabus I understand your concerns with us pinning to the 4.0 version at the moment but this version is still supported by Luis so there is no security concerns at present. We just won't have access to some of the nice new features in the 4.1x versions until we upgrade.

Hope that answers everyone's questions and concerns.

derrabus commented 3 years ago

Thank you for the explanation, @Sephster. Would #1236 be an acceptable solution?

ghdi commented 3 years ago

All,

Thanks a million for looking into this, very much appreciated!

Oauth2-server plays a critical role in our systems and I sleep better when the latest version is installed.

Regards,

Edwin

Sephster commented 3 years ago

Merged in fix. Thanks to @derrabus for the PR.

ghdi commented 3 years ago

Thanks for following up on this, much appreciated!