I think it might be worth sticking to clock-lts. The author of clock has strongly decided that they do not maintain more than 1-2 versions of PHP support and will enforce this via composer.json at install time. This means we'll be here again.

If we install the clock package in mediawiki/vendor, the repo becomes un-installable in any local/third-party context with a PHP version other the one we run at WMF. It's quite inflexible.

Assuming WMF stays within the last 2 versions of PHP going forward, we will be able run the latest version of clock in production. But through vendor, it makes PHP upgrades hard even when upgrading from latest minus one to latest. The author basically requires intermediary packages to specify a range of versions, and then assumes that you run composer install in production.

There's also CI pipelines. We couldn't run mediawiki-vendor in CI on the master branch. After we drop PHP 8.1, we'll be down to supporting 3-4 versions only (PHP 8.2-8.4) which seems managable, yet is still incompatible with clock.

lcobucci/clock predates PSR-20, there is no reason for a modern PHP library to depend on it. So hopefully we can just upgrade everything to the point where it goes away as a dependency, and then use ConvertibleTimestamp's clock instead.

Sounds good to me, even better.

T405344: Upgrade web-auth/webauthn-lib to >= 5.2.3 itself will remove lcobucci/clock in WebAuthn as per https://webauthn-doc.spomky-labs.com/v4.9/migration/from-v3.x-to-v4.0-1#dependency-changes

Reedy renamed this task from Remove lcobucci/clock (or replacement) post WMF PHP 8.3 upgrade to Remove okvpn/clock-lts post WMF PHP 8.3 upgrade.

This is more, "when we drop PHP 8.1 support from OATHAuth" and is blocked by T405344, right?

            "name": "web-auth/webauthn-lib",
            "version": "4.9.2",
...
            "suggest": {
...
                "psr/clock-implementation": "As of 4.5.x, the PSR Clock implementation will replace lcobucci/clock",

^ It kinda looks like we could replace it away (now), if we have have something that satisfies https://packagist.org/providers/psr/clock-implementation, which wikimedia/timestamp does.. as per Gergo above. I haven't looked what extra wiring would be needed, if any.

OAuth however has dependancies on it too via lcobucci/jwt and then league/oauth2-server...

So that brings in T261462: Migrate OAuth extension back from wikimedia/oauth2-server fork to upstream to the tree

lcobucci/jwt also only depends on psr/clock (if we can get to a reasonably recent version of it). So yeah oauth2-server is the weak link.

Starting to poke at T405344: Upgrade web-auth/webauthn-lib to >= 5.2.3 - https://packagist.org/packages/web-auth/webauthn-lib#5.2.3

Requires https://packagist.org/packages/symfony/clock :/