Page MenuHomePhabricator
Create Task
Maniphest T405344

Upgrade web-auth/webauthn-lib to >= 5.2.3
Closed, ResolvedPublic
Actions

Description

In T363639: web-auth/webauthn-lib must be upgraded to 4+ for PHP 8.2+ support, we upgraded to ^4.9.2, but that still puts us a major version behind.

https://packagist.org/packages/web-auth/webauthn-lib

https://webauthn-doc.spomky-labs.com/v4.9/migration/from-v3.x-to-v4.0-1

Details

Related Changes in Gerrit:
Show related patches Customize query in gerrit

Related Objects
Search...

StatusSubtypeAssignedTask
 DeclinedNoneT405346 Remove okvpn/clock-lts post WMF PHP 8.3 upgrade
 OpenNoneT317255 PHP's getElementsByTagName is slow prior to PHP 8.3
 OpenNoneT358667 Drop PHP 8.2 support from MediaWiki
 OpenNoneT366644 Raise MediaWiki's MariaDB requirement to 10.6
 OpenNoneT366646 Raise Quibble jobs' tested version of MariaDB to 10.6
 ResolvedReedyT405344 Upgrade web-auth/webauthn-lib to >= 5.2.3
 ResolvedKrinkleT358666 Drop PHP 8.1 support from MediaWiki
 ResolvedKrinkleT360995 Migrate Wikimedia production from PHP 8.1 to PHP 8.3
 ResolvedJdforrester-WMFT353362 Make PHP 8.3 voting on development (master) branch of MW ecosystem (core, vendor, extensions, skins, libraries)
 ResolvedJdforrester-WMFT352085 Make PHP 8.2 voting on development (master) branch of MW ecosystem (core, vendor, extensions, skins, libraries)
 ResolvedJdforrester-WMFT360560 Make PHP 8.2 voting on development branch of Wikibase
 ResolvedLucas_Werkmeister_WMDET324202 Remove use of utf8_encode and utf8_decode in Wikibase
 ResolvedNoneT353161 [CLIENT] Creation of dynamic property MediaWiki\Title\Title::$wikibasePushedDeleteToRepo is deprecated
 ResolvedJdforrester-WMFT360709 Make PHP 8.2 voting on development (master) branch of Math extension
 ResolvedDaimonaT381728 Use PHP 8.3 in MediaWiki-Docker
 ResolvedJdforrester-WMFT398491 Move CI images to WMF PHP 8.3 packages
 DeclinedNoneT401255 Switch PHP 8.3 image of MediaWiki-Docker from Sury to WMF
 ResolvedScott_FrenchT401254 Upgrade mw-debug/next to PHP 8.3
 ResolvedScott_FrenchT401252 Configure title-case consistency mapping for PHP 8.1 -> 8.3 transition
 ResolvedScott_FrenchT399884 Configure production MediaWiki image builds for PHP 8.3
 ResolvedcscottT401855 ☂ PHP 8.3 issues found during WMF rollout
 ResolvedScott_FrenchT402424 PHP Deprecated: Using ${var} in strings is deprecated, use {$var} instead in /srv/monitoring/lib.php on line 99
 DuplicatePRODUCTION ERRORNoneT403514 Expectation (readQueryRows <= 10000) by MediaWiki\Actions\ActionEntryPoint::execute not met (actual: 12860)
 ResolvedPRODUCTION ERRORMichaelT407403 Error: Invalid serialization data for DatePeriod object
 ResolvedPRODUCTION ERRORMichaelT408852 PHP Deprecated: DateTime::__construct(): Passing null to parameter #1 ($datetime) of type string is deprecated
 ResolvedMichaelT401005 Investigate Production Errors from ComputedUserImpactLookup::getPageViewData
 DuplicatePRODUCTION ERRORNoneT409248 PHP Warning: Trying to access array offset on null
 Resolved• TgrT402597 Exploratory testing on PHP 8.3 for MediaWiki Platform Team components
 ResolvedNoneT402804 Exploratory testing on PHP 8.3 for MediaWiki authentication stack
 ResolvedDAlangi_WMFT403484 Exploratory testing on PHP 8.3 for MediaWiki authentication stack: Login
 Resolved• TgrT403485 Exploratory testing on PHP 8.3 for MediaWiki authentication stack: Central session
 ResolvedDAlangi_WMFT403486 Exploratory testing on PHP 8.3 for MediaWiki authentication stack: Signup
 Resolved• TgrT403487 Exploratory testing on PHP 8.3 for MediaWiki authentication stack: OAuth
 Resolved• TgrT403488 Exploratory testing on PHP 8.3 for MediaWiki authentication stack: 2FA
 ResolvedAtienoT402809 Exploratory testing on PHP 8.3 for MediaWiki Interfaces Team components
 OpenNoneT402810 Exploratory testing on PHP 8.3 for Content Transform Team components
 ResolvedbrouberolT403110 Prepare dumps-on-k8s (mediawiki-dumps-legacy) for migration to PHP 8.3
 ResolvedScott_FrenchT403655 Configure mw-next-routing for the PHP 8.3 migration
 ResolvedScott_FrenchT403657 Configure the WikimediaEvents extension for the PHP 8.3 migration
 ResolvedScott_FrenchT403284 Migrate production Shellbox services to PHP 8.3
 ResolvedScott_FrenchT403283 Prepare PHP 8.3 service images for Shellbox
 ResolvedScott_FrenchT398246 Prepare PHP 8.3 production images
 ResolvedScott_FrenchT398245 Prepare WMF PHP 8.3 packages for bullseye
 ResolvedKrinkleT400109 Ensure MediaWiki-Core-Profiler works with php-xhprof 2.x (PHP 8.3)
 ResolvedKrinkleT401152 Switch wmf-config/Profiler from Tideways to XHProf
 ResolvedScott_FrenchT403772 Migrate parsoidtest1001 to PHP 8.3
 ResolvedKrinkleT405031 lcobucci/clock needs upgrading for PHP 8.3
 Resolved• TgrT363639 web-auth/webauthn-lib must be upgraded to 4+ for PHP 8.2+ support
 ResolvedScott_FrenchT405955 MediaWiki on PHP 8.3 production workload migration
 ResolvedjnucheT411277 Patchdemo wiki creation fails due to PHP 8.1 not supported by MW
 ResolvedJdforrester-WMFT411372 wikilambda-catalyst-end-to-end broken due to new version of composer after PHP 8.1 -> 8.3 migration
 ResolvedBUG REPORTbd808T411235 Beta cluster scap using php8.1 container; php8.2 is now required

Event Timeline

Reedy created this task.Sep 23 2025, 11:49 AM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptSep 23 2025, 11:49 AM
Reedy added a subtask: T363639: web-auth/webauthn-lib must be upgraded to 4+ for PHP 8.2+ support.Sep 23 2025, 11:49 AM
Reedy closed subtask T363639: web-auth/webauthn-lib must be upgraded to 4+ for PHP 8.2+ support as Resolved.Sep 23 2025, 12:27 PM
Krinkle added a project: MediaWiki-Platform-Team.Sep 23 2025, 3:19 PM
• Tgr added a subtask: T360995: Migrate Wikimedia production from PHP 8.1 to PHP 8.3.Sep 23 2025, 6:37 PM
• Tgr subscribed.

Blocked on T360995: Migrate Wikimedia production from PHP 8.1 to PHP 8.3 as the 5.* branch of webauthn-lib requires PHP 8.2+.

Jdforrester-WMF subscribed.Sep 24 2025, 3:33 PM
In T405344#11207433, @Tgr wrote:

Blocked on T360995: Migrate Wikimedia production from PHP 8.1 to PHP 8.3 as the 5.* branch of webauthn-lib requires PHP 8.2+.

More specifically, it's blocked on dropping PHP 8.1 support from MediaWiki, which is T358666: Drop PHP 8.1 support from MediaWiki.

Jdforrester-WMF edited subtasks, added: T358666: Drop PHP 8.1 support from MediaWiki; removed: T360995: Migrate Wikimedia production from PHP 8.1 to PHP 8.3.Sep 24 2025, 3:33 PM
JTweed-WMF moved this task from Inbox, needs triage to Needs refinement on the MediaWiki-Platform-Team board.Sep 29 2025, 3:01 PM
Reedy moved this task from Backlog to Features/Improvements on the MediaWiki-extensions-OATHAuth board.Oct 3 2025, 11:32 AM
Reedy updated the task description. (Show Details)Nov 17 2025, 11:13 PM
Reedy mentioned this in T405346: Remove okvpn/clock-lts post WMF PHP 8.3 upgrade.
• Tgr updated the task description. (Show Details)Nov 18 2025, 9:23 AM
• Tgr updated the task description. (Show Details)Nov 18 2025, 9:25 AM
Krinkle closed subtask T358666: Drop PHP 8.1 support from MediaWiki as Resolved.Dec 18 2025, 3:05 PM
Reedy renamed this task from Upgrade web-auth/webauthn-lib to >= 5.2.2 to Upgrade web-auth/webauthn-lib to >= 5.2.3.Jan 6 2026, 9:44 PM
gerritbot added a comment.Jan 29 2026, 1:22 PM

Change #1235012 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/vendor@master] Upgrade web-auth/webauth-lib to 5.2.3

https://gerrit.wikimedia.org/r/1235012

gerritbot added a project: Patch-For-Review.Jan 29 2026, 1:22 PM
Reedy added a comment.Jan 29 2026, 1:23 PM

-6875 +52333 :|

This is ridiculous.

gerritbot added a comment.Jan 29 2026, 1:25 PM

Change #1235013 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OATHAuth@master] composer.json: Upgrade web-auth/webauthn-lib to ^5.2.3

https://gerrit.wikimedia.org/r/1235013

Reedy updated the task description. (Show Details)Jan 29 2026, 1:29 PM
Reedy updated the task description. (Show Details)Jan 29 2026, 1:32 PM
gerritbot added a comment.Jan 30 2026, 8:22 PM

Change #1235393 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OATHAuth@master] WebAuthn: Update some deprecated function calls

https://gerrit.wikimedia.org/r/1235393

gerritbot added a comment.Jan 30 2026, 10:00 PM

Change #1235408 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/vendor@master] Upgrading web-auth/cose-lib (4.4.2 => 4.5.0)

https://gerrit.wikimedia.org/r/1235408

gerritbot added a comment.Jan 31 2026, 9:58 PM

Change #1235408 merged by jenkins-bot:

[mediawiki/vendor@master] Upgrading web-auth/cose-lib (4.4.2 => 4.5.0)

https://gerrit.wikimedia.org/r/1235408

gerritbot added a comment.Feb 3 2026, 10:57 PM

Change #1235393 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] WebAuthn: Update some deprecated function calls

https://gerrit.wikimedia.org/r/1235393

ReleaseTaggerBot added a project: MW-1.46-notes (1.46.0-wmf.15; 2026-02-10).Feb 3 2026, 11:00 PM
gerritbot added a comment.Feb 4 2026, 2:24 AM

Change #1236392 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OATHAuth@master] WebAuthnKey: Update AuthenticatorAttestationResponseValidator constructor calls

https://gerrit.wikimedia.org/r/1236392

gerritbot added a comment.Feb 4 2026, 2:48 AM

Change #1236394 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OATHAuth@master] Remove WebAuthnCredentialRepository and inline only used function

https://gerrit.wikimedia.org/r/1236394

gerritbot added a comment.Feb 5 2026, 12:43 PM

Change #1236394 abandoned by Reedy:

[mediawiki/extensions/OATHAuth@master] Remove WebAuthnCredentialRepository and inline only used function

Reason:

I think the class needs simplifying, but maybe not deleting completely...

https://gerrit.wikimedia.org/r/1236394

gerritbot added a comment.Feb 5 2026, 1:50 PM

Change #1237224 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OATHAuth@master] WebAuthnKey: Replace deprecated PublicKeyCredentialLoader

https://gerrit.wikimedia.org/r/1237224

gerritbot added a comment.Feb 5 2026, 2:00 PM

Change #1237230 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/vendor@master] Installing symfony/serializer (v6.4.33)

https://gerrit.wikimedia.org/r/1237230

gerritbot added a comment.Feb 5 2026, 2:02 PM

Change #1237232 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OATHAuth@master] WebAuthnCredentialRepository: Remove deprecated PublicKeyCredentialSourceRepository implementation

https://gerrit.wikimedia.org/r/1237232

gerritbot added a comment.Feb 5 2026, 2:17 PM

Change #1237233 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OATHAuth@master] WebAuthnCredentialRepository: Replace deprecated PublicKeyCredentialSource::createFromArray

https://gerrit.wikimedia.org/r/1237233

gerritbot added a comment.Feb 5 2026, 2:28 PM

Change #1237235 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OATHAuth@master] WebAuthnAuthenticator: Replace deprecated ::createFromArray()

https://gerrit.wikimedia.org/r/1237235

gerritbot added a comment.Feb 5 2026, 5:15 PM

Change #1237274 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OATHAuth@master] WebAuthnAuthenticator: Manually serialize PublicKeyCredentialCreationOptions

https://gerrit.wikimedia.org/r/1237274

gerritbot added a comment.Feb 5 2026, 6:08 PM

Change #1236392 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] WebAuthnKey: Update AuthenticatorAttestationResponseValidator/AuthenticatorAssertionResponseValidator calls

https://gerrit.wikimedia.org/r/1236392

gerritbot added a comment.Feb 5 2026, 7:33 PM

Change #1237230 merged by jenkins-bot:

[mediawiki/vendor@master] Install more symfony/* packages for WebAuthn

https://gerrit.wikimedia.org/r/1237230

gerritbot added a comment.Feb 5 2026, 7:33 PM

Change #1237224 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] WebAuthnKey: Replace deprecated PublicKeyCredentialLoader

https://gerrit.wikimedia.org/r/1237224

gerritbot added a comment.Feb 5 2026, 7:33 PM

Change #1237232 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] WebAuthnCredentialRepository: Remove deprecated PublicKeyCredentialSourceRepository implementation

https://gerrit.wikimedia.org/r/1237232

gerritbot added a comment.Feb 5 2026, 7:33 PM

Change #1237233 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] WebAuthnCredentialRepository: Replace deprecated PublicKeyCredentialSource::createFromArray

https://gerrit.wikimedia.org/r/1237233

gerritbot added a comment.Feb 5 2026, 7:39 PM

Change #1237235 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] WebAuthnAuthenticator: Replace deprecated ::createFromArray()

https://gerrit.wikimedia.org/r/1237235

gerritbot added a comment.Feb 5 2026, 8:31 PM

Change #1237328 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OATHAuth@master] Remove WebAuthnRequest and replace usages

https://gerrit.wikimedia.org/r/1237328

gerritbot added a comment.Feb 5 2026, 9:25 PM

Change #1237328 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Remove WebAuthnRequest and replace usages

https://gerrit.wikimedia.org/r/1237328

gerritbot added a comment.Feb 5 2026, 11:38 PM

Change #1237361 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OATHAuth@master] Implement modified WebAuthnSerializerFactory

https://gerrit.wikimedia.org/r/1237361

gerritbot added a comment.Feb 9 2026, 9:03 PM

Change #1237274 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] WebAuthnAuthenticator: Manually serialize PublicKeyCredentialCreationOptions/PublicKeyCredentialRequestOptions

https://gerrit.wikimedia.org/r/1237274

gerritbot added a comment.Feb 10 2026, 8:34 PM

Change #1235012 merged by jenkins-bot:

[mediawiki/vendor@master] Upgrade web-auth/webauth-lib (4.9.3 => 5.2.3)

https://gerrit.wikimedia.org/r/1235012

gerritbot added a comment.Feb 10 2026, 8:34 PM

Change #1235013 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] composer.json: Upgrade web-auth/webauthn-lib to ^5.2.3

https://gerrit.wikimedia.org/r/1235013

gerritbot added a comment.Feb 10 2026, 8:34 PM

Change #1237361 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Implement modified WebAuthnSerializerFactory

https://gerrit.wikimedia.org/r/1237361

ReleaseTaggerBot edited projects, added MW-1.46-notes (1.46.0-wmf.16; 2026-02-17); removed MW-1.46-notes (1.46.0-wmf.15; 2026-02-10).Feb 10 2026, 9:00 PM
Maintenance_bot removed a project: Patch-For-Review.Feb 10 2026, 9:31 PM
Reedy closed this task as Resolved.Feb 11 2026, 3:03 AM
Reedy claimed this task.
• Tgr awarded a token.Feb 16 2026, 5:32 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits