Page MenuHomePhabricator
Create Task
Maniphest T410203

lcobucci/jwt 4.1.5 is not compatible with newer PHP versions
Closed, ResolvedPublicBUG REPORT
Actions

Description

The old version of lcobucci/jwt somehow depends on an outdated version of PHP, which blocks using MW on PHP 8.3/8.4:

#12 6.929   Problem 1
#12 6.929     - Root composer.json requires lcobucci/jwt 4.1.5 -> satisfiable by lcobucci/jwt[4.1.5].
#12 6.929     - lcobucci/clock 2.3.0 requires php ~8.1.0 || ~8.2.0 -> your php version (8.4.13) does not satisfy that requirement.
#12 6.929     - lcobucci/jwt 4.1.5 requires lcobucci/clock ^2.0 -> satisfiable by lcobucci/clock[2.3.0].

Although T261462 is stalled, it seems that wikimedia/oauth2-server has some new commits that are not included in the OAuth extension. Is it possible to include those commits and unpin lcobucci/jwt?

Details

Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
build: Switch clock to clock-lts for wider PHP compat and to match WMFReedymediawiki/extensions/OAuthREL1_43+2 -1
build: Switch clock to clock-lts for wider PHP compat and to match WMFReedymediawiki/extensions/WebAuthnREL1_43+3 -2
build: Switch clock to clock-lts for wider PHP compat and to match WMFReedymediawiki/extensions/OAuthREL1_45+2 -1
build: Switch clock to clock-lts for wider PHP compat and to match WMFReedymediawiki/extensions/OAuthREL1_44+2 -1
build: Switch clock to clock-lts for wider PHP compat and to match WMFReedymediawiki/extensions/WebAuthnREL1_45+3 -2
build: Switch clock to clock-lts for wider PHP compat and to match WMFReedymediawiki/extensions/WebAuthnREL1_44+3 -2
build: Switch clock to clock-lts for wider PHP compat and to match WMFKrinklemediawiki/extensions/OAuthmaster+2 -1
build: Switch clock to clock-lts for wider PHP compat and to match WMFKrinklemediawiki/extensions/WebAuthnmaster+3 -2
Customize query in gerrit

Related Objects

Event Timeline

XtexChooser created this task.Nov 15 2025, 4:12 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptNov 15 2025, 4:12 PM
Reedy added projects: PHP 8.3 support, PHP 8.4 support, PHP 8.5 support, MW-1.43-release, MW-1.44-release, MW-1.45-release.Nov 15 2025, 8:01 PM
Reedy subscribed.

See also: T321160: Lcobucci\JWT\Signer\InvalidKeyProvided: Key cannot be empty.

But it's not lcobucci/jwt that is the issue, as that has "php": "^7.4 || ^8.0", it's lcobucci/clock, which makes this actually T405031: lcobucci/clock needs upgrading for PHP 8.3. As the line says lcobucci/clock 2.3.0 requires php ~8.1.0 || ~8.2.0 -> your php version (8.4.13) does not satisfy that requirement.

Where we replaced lcobucci/clock with okvpn/clock-lts.

We presumably need to do something to the composer.json in OAuth, and backport as appropriate to release branches.

Reedy added a comment.Nov 15 2025, 8:05 PM

Though, on master, just running composer via PHP 8.3, results in https://packagist.org/packages/lcobucci/clock#2.2.0 being installed...

What command are you running... and where exactly?

$ php8.3 `which composer` update --no-dev
Loading composer repositories with package information
Updating dependencies
Lock file operations: 50 installs, 0 updates, 0 removals
  - Locking composer/pcre (3.3.2)
  - Locking composer/semver (3.4.4)
  - Locking composer/spdx-licenses (1.5.9)
  - Locking composer/xdebug-handler (3.0.5)
  - Locking dealerdirect/phpcodesniffer-composer-installer (v1.2.0)
  - Locking defuse/php-encryption (v2.4.0)
  - Locking doctrine/deprecations (1.1.5)
  - Locking felixfbecker/advanced-json-rpc (v3.2.1)
  - Locking firebase/php-jwt (v6.11.1)
  - Locking lcobucci/clock (2.2.0)
  - Locking lcobucci/jwt (4.1.5)
  - Locking league/event (2.3.0)
  - Locking league/oauth2-server (dev-v9.0.0-alpha 61d770d)
  - Locking league/uri (6.8.0)
  - Locking league/uri-interfaces (2.3.0)
  - Locking mediawiki/mediawiki-codesniffer (v48.0.0)
  - Locking mediawiki/mediawiki-phan-config (0.17.0)
  - Locking mediawiki/minus-x (1.1.3)
  - Locking mediawiki/phan-taint-check-plugin (7.0.0)
  - Locking microsoft/tolerant-php-parser (v0.1.2)
  - Locking netresearch/jsonmapper (v4.5.0)
  - Locking paragonie/random_compat (v9.99.100)
  - Locking phan/phan (5.5.1)
  - Locking php-parallel-lint/php-console-color (v1.0.1)
  - Locking php-parallel-lint/php-console-highlighter (v1.0.0)
  - Locking php-parallel-lint/php-parallel-lint (v1.4.0)
  - Locking phpcsstandards/phpcsextra (1.4.0)
  - Locking phpcsstandards/phpcsutils (1.1.1)
  - Locking phpdocumentor/reflection-common (2.2.0)
  - Locking phpdocumentor/reflection-docblock (5.6.3)
  - Locking phpdocumentor/type-resolver (1.10.0)
  - Locking phpstan/phpdoc-parser (2.3.0)
  - Locking psr/clock (1.0.0)
  - Locking psr/container (2.0.2)
  - Locking psr/http-message (1.1)
  - Locking psr/log (3.0.2)
  - Locking sabre/event (5.1.7)
  - Locking squizlabs/php_codesniffer (3.13.2)
  - Locking stella-maris/clock (0.1.7)
  - Locking symfony/console (v7.3.6)
  - Locking symfony/deprecation-contracts (v3.6.0)
  - Locking symfony/polyfill-ctype (v1.33.0)
  - Locking symfony/polyfill-intl-grapheme (v1.33.0)
  - Locking symfony/polyfill-intl-normalizer (v1.33.0)
  - Locking symfony/polyfill-mbstring (v1.33.0)
  - Locking symfony/polyfill-php80 (v1.33.0)
  - Locking symfony/service-contracts (v3.6.1)
  - Locking symfony/string (v7.3.4)
  - Locking tysonandre/var_representation_polyfill (0.1.3)
  - Locking webmozart/assert (1.12.1)
Writing lock file
Installing dependencies from lock file
Package operations: 12 installs, 0 updates, 0 removals
  - Downloading psr/clock (1.0.0)
  - Downloading stella-maris/clock (0.1.7)
  - Downloading league/event (2.3.0)
  - Downloading lcobucci/jwt (4.1.5)
  - Downloading paragonie/random_compat (v9.99.100)
  - Downloading defuse/php-encryption (v2.4.0)
  - Syncing league/oauth2-server (dev-v9.0.0-alpha 61d770d) into cache
  - Installing firebase/php-jwt (v6.11.1): Extracting archive
  - Installing psr/clock (1.0.0): Extracting archive
  - Installing stella-maris/clock (0.1.7): Extracting archive
  - Installing lcobucci/clock (2.2.0): Extracting archive
  - Installing psr/http-message (1.1): Extracting archive
  - Installing league/uri-interfaces (2.3.0): Extracting archive
  - Installing league/uri (6.8.0): Extracting archive
  - Installing league/event (2.3.0): Extracting archive
  - Installing lcobucci/jwt (4.1.5): Extracting archive
  - Installing paragonie/random_compat (v9.99.100): Extracting archive
  - Installing defuse/php-encryption (v2.4.0): Extracting archive
  - Installing league/oauth2-server (dev-v9.0.0-alpha 61d770d): Cloning 61d770dc28 from cache
9 package suggestions were added by new dependencies, use `composer suggest` to see details.
Generating autoload files
4 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
No security vulnerability advisories found.
$ php8.4 `which composer` update --no-dev
Loading composer repositories with package information
Updating dependencies
Nothing to modify in lock file
Installing dependencies from lock file
Nothing to install, update or remove
Generating autoload files
4 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
No security vulnerability advisories found.
Alex44019 subscribed.Nov 16 2025, 7:21 PM
Tgr subscribed.Nov 17 2025, 10:58 AM

In any case, the Composer dependencies of the extension and Wikimedia production should match, right? So if we don't switch back from clock-lts in mediawiki/vendor, we should switch to it in WebAuthn.

Krinkle subscribed.Nov 17 2025, 3:23 PM

I was about to submit a patch to do this but with both WebAuthn and OAuth I can run composer update locally on master on PHP 8.1, 8.3, and 8.4 without issue.

gerritbot added a comment.Nov 17 2025, 3:24 PM

Change #1206397 had a related patch set uploaded (by Krinkle; author: Krinkle):

[mediawiki/extensions/OAuth@master] build: Switch clock to clock-lts for wider PHP compat and to match WMF

https://gerrit.wikimedia.org/r/1206397

gerritbot added a project: Patch-For-Review.Nov 17 2025, 3:24 PM

Change #1206398 had a related patch set uploaded (by Krinkle; author: Krinkle):

[mediawiki/extensions/WebAuthn@master] build: Switch clock to clock-lts for wider PHP compat and to match WMF

https://gerrit.wikimedia.org/r/1206398

Krinkle claimed this task.Nov 17 2025, 3:26 PM
JTweed-WMF moved this task from Inbox, needs triage to Next (DO NOT USE) on the MediaWiki-Core-Platform-Team board.Nov 17 2025, 3:44 PM
gerritbot added a comment.Nov 17 2025, 5:34 PM

Change #1206398 merged by jenkins-bot:

[mediawiki/extensions/WebAuthn@master] build: Switch clock to clock-lts for wider PHP compat and to match WMF

https://gerrit.wikimedia.org/r/1206398

gerritbot added a comment.Nov 17 2025, 5:36 PM

Change #1206397 merged by jenkins-bot:

[mediawiki/extensions/OAuth@master] build: Switch clock to clock-lts for wider PHP compat and to match WMF

https://gerrit.wikimedia.org/r/1206397

ReleaseTaggerBot added a project: MW-1.46-notes (1.46.0-wmf.3; 2025-11-19).Nov 17 2025, 6:00 PM
Maintenance_bot removed a project: Patch-For-Review.Nov 17 2025, 6:30 PM
Reedy moved this task from Backlog to Wikimedia production on the PHP 8.3 support board.Nov 17 2025, 10:59 PM
gerritbot added a comment.Nov 17 2025, 11:04 PM

Change #1206477 had a related patch set uploaded (by Reedy; author: Krinkle):

[mediawiki/extensions/WebAuthn@REL1_45] build: Switch clock to clock-lts for wider PHP compat and to match WMF

https://gerrit.wikimedia.org/r/1206477

gerritbot added a project: Patch-For-Review.Nov 17 2025, 11:04 PM

Change #1206478 had a related patch set uploaded (by Reedy; author: Krinkle):

[mediawiki/extensions/OAuth@REL1_45] build: Switch clock to clock-lts for wider PHP compat and to match WMF

https://gerrit.wikimedia.org/r/1206478

gerritbot added a comment.Nov 17 2025, 11:04 PM

Change #1206479 had a related patch set uploaded (by Reedy; author: Krinkle):

[mediawiki/extensions/OAuth@REL1_44] build: Switch clock to clock-lts for wider PHP compat and to match WMF

https://gerrit.wikimedia.org/r/1206479

gerritbot added a comment.Nov 17 2025, 11:04 PM

Change #1206480 had a related patch set uploaded (by Reedy; author: Krinkle):

[mediawiki/extensions/OAuth@REL1_43] build: Switch clock to clock-lts for wider PHP compat and to match WMF

https://gerrit.wikimedia.org/r/1206480

gerritbot added a comment.Nov 17 2025, 11:04 PM

Change #1206481 had a related patch set uploaded (by Reedy; author: Krinkle):

[mediawiki/extensions/WebAuthn@REL1_44] build: Switch clock to clock-lts for wider PHP compat and to match WMF

https://gerrit.wikimedia.org/r/1206481

gerritbot added a comment.Nov 17 2025, 11:05 PM

Change #1206482 had a related patch set uploaded (by Reedy; author: Krinkle):

[mediawiki/extensions/WebAuthn@REL1_43] build: Switch clock to clock-lts for wider PHP compat and to match WMF

https://gerrit.wikimedia.org/r/1206482

gerritbot added a comment.Nov 17 2025, 11:41 PM

Change #1206481 merged by jenkins-bot:

[mediawiki/extensions/WebAuthn@REL1_44] build: Switch clock to clock-lts for wider PHP compat and to match WMF

https://gerrit.wikimedia.org/r/1206481

gerritbot added a comment.Nov 17 2025, 11:44 PM

Change #1206477 merged by jenkins-bot:

[mediawiki/extensions/WebAuthn@REL1_45] build: Switch clock to clock-lts for wider PHP compat and to match WMF

https://gerrit.wikimedia.org/r/1206477

gerritbot added a comment.Nov 17 2025, 11:47 PM

Change #1206479 merged by jenkins-bot:

[mediawiki/extensions/OAuth@REL1_44] build: Switch clock to clock-lts for wider PHP compat and to match WMF

https://gerrit.wikimedia.org/r/1206479

gerritbot added a comment.Nov 17 2025, 11:48 PM

Change #1206478 merged by jenkins-bot:

[mediawiki/extensions/OAuth@REL1_45] build: Switch clock to clock-lts for wider PHP compat and to match WMF

https://gerrit.wikimedia.org/r/1206478

gerritbot added a comment.Nov 17 2025, 11:49 PM

Change #1206482 merged by jenkins-bot:

[mediawiki/extensions/WebAuthn@REL1_43] build: Switch clock to clock-lts for wider PHP compat and to match WMF

https://gerrit.wikimedia.org/r/1206482

gerritbot added a comment.Nov 17 2025, 11:49 PM

Change #1206480 merged by jenkins-bot:

[mediawiki/extensions/OAuth@REL1_43] build: Switch clock to clock-lts for wider PHP compat and to match WMF

https://gerrit.wikimedia.org/r/1206480

Maintenance_bot removed a project: Patch-For-Review.Nov 18 2025, 12:31 AM
• DAlangi_WMF moved this task from Next (DO NOT USE) to In progress (DO NOT USE) on the MediaWiki-Core-Platform-Team board.Nov 18 2025, 6:36 AM
Reedy closed this task as Resolved.Nov 18 2025, 4:07 PM
XtexChooser added a comment.Nov 22 2025, 6:52 AM

Sorry for my late reply. I was running composer install --no-dev --ignore-platform-reqs from the root of MediaWiki, using the merge plugin to merge OAuth composer.json into the root. Previously, when the above error appears, the merge plugin fallbacks by removing merged contents, leaving extension dependencies uninstalled.
I tested again and it seems that only when --ignore-platform-reqs is used, the error appears. I apologize for my previous vague description. The patches fixed the issue! Thank you!

Reedy added a comment.Nov 22 2025, 1:44 PM

Just to point out that is --ignore-platform-reqs doing exactly what it is supposed to do...

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits