OAuth did not get much update

$ git -C mediawiki/extensions/OAuth releasenotes origin/wmf/1.46.0-wmf.13..origin/wmf/1.46.0-wmf.14
[BOT] Translation updater bot (3):
      * [6adb9e8f] Localisation updates from https://translatewiki.net.
      * [00f9b57f] Localisation updates from https://translatewiki.net.
      * [9abf4346] Localisation updates from https://translatewiki.net.

[BOT] libraryupgrader (1):
      * [0e9fbc22] build: Updating lodash to 4.17.23

vendor

$ git -C mediawiki/vendor releasenotes origin/wmf/1.46.0-wmf.13..origin/wmf/1.46.0-wmf.14
Alexander Vorwerk (1):
      * [a873440de] Updated wikimedia/ip-utils from 6.0.0 to 6.0.1

C. Scott Ananian (2):
      * [10feea1d4] Bump wikimedia/parsoid to 0.23.0-a13.1
      * [ae85df514] Bump wikimedia/parsoid to 0.23.0-a14

Sam Reed (7):
      * [604513e51] Upgrade symfony/*
      * [1b9df20ea] Upgrading psy/psysh (v0.12.10 => v0.12.19)
      * [5e725644e] Upgrading web-auth/cose-lib (4.4.2 => 4.5.0)
      * [4ddd548ec] Upgrading brick/math (0.13.1 => 0.14.2)
      * [abedb5d13] Upgrading lcobucci/jwt (4.1.5 => 4.3.0)
      * [4acc02da3] Add webonyx/graphql-php (v15.30.0)
      * [15d8c7295] Upgrading webonyx/graphql-php (v15.30.0 => v15.30.1)

So that would be caused by abedb5d13 Upgrading lcobucci/jwt (4.1.5 => 4.3.0)? https://gerrit.wikimedia.org/r/c/mediawiki/vendor/+/1235417 / https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1235513 . Which seems to be part of a routine update of libraries.

https://github.com/lcobucci/jwt/releases/tag/4.3.0 states:

*Improvement*

938: Deprecate empty Signer, empty Key and empty Signature thanks to @Slamdunk

From the pull request:

This PR deprecates:

Lcobucci\JWT\Signer\None
\Lcobucci\JWT\Signer\Key\InMemory::empty
\Lcobucci\JWT\Token\Signature::fromEmptyData
and as a result, \Lcobucci\JWT\Configuration::forUnsecuredSigner

And surely the update did:

diff --git a/lcobucci/jwt/src/Signer/Key/InMemory.php b/lcobucci/jwt/src/Signer/Key/InMemory.php
index 1a4df0f58..1a12e01a3 100644
--- a/lcobucci/jwt/src/Signer/Key/InMemory.php
+++ b/lcobucci/jwt/src/Signer/Key/InMemory.php
@@ -3,6 +3,7 @@ declare(strict_types=1);
 
 namespace Lcobucci\JWT\Signer\Key;
 
+use Lcobucci\JWT\Signer\InvalidKeyProvided;
 use Lcobucci\JWT\Signer\Key;
 use Lcobucci\JWT\SodiumBase64Polyfill;
 use SplFileObject;
@@ -16,22 +17,35 @@ final class InMemory implements Key
     private string $contents;
     private string $passphrase;
 
+    /** @param non-empty-string $contents */
     private function __construct(string $contents, string $passphrase)
     {
+        // @phpstan-ignore-next-line
+        if ($contents === '') {
+            throw InvalidKeyProvided::cannotBeEmpty();
+        }
+

The upgrade of lcobucci/jwt (4.1.5 => 4.3.0) is a breaking change for OAuth. That was introduced by https://gerrit.wikimedia.org/r/c/mediawiki/vendor/+/1235417 / https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1235513 and I don't quite know anymore how to rollback changes to vendor / composer.json :-/

Change #1236691 had a related patch set uploaded (by Zabe; author: Zabe):

[mediawiki/core@master] Revert "Updated lcobucci/jwt from 4.1.5 to 4.3.0"

https://gerrit.wikimedia.org/r/1236691

Change #1236692 had a related patch set uploaded (by Zabe; author: Zabe):

[mediawiki/core@wmf/1.46.0-wmf.14] Revert "Updated lcobucci/jwt from 4.1.5 to 4.3.0"

https://gerrit.wikimedia.org/r/1236692

Change #1236693 had a related patch set uploaded (by Zabe; author: Zabe):

[mediawiki/vendor@wmf/1.46.0-wmf.14] Revert "Updated lcobucci/jwt from 4.1.5 to 4.3.0"

https://gerrit.wikimedia.org/r/1236693

In T416456#11582560, @hashar wrote:

The upgrade of lcobucci/jwt (4.1.5 => 4.3.0) is a breaking change for OAuth. That was introduced by https://gerrit.wikimedia.org/r/c/mediawiki/vendor/+/1235417 / https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1235513 and I don't quite know anymore how to rollback changes to vendor / composer.json :-/

I uploaded reverts for wmf.14 above, but I think we should OAuth passing an empty string on master instead.

@hashar do you have a plan on how to tackle this? just a quick rollback of the version or do you prefer to fix the code ASAP? Definitely we should fix and update the lib, I'm just not sure about timing.

Ok, to follow-up - this looks like a simple fix without having to revert the library - this was introduced in https://gerrit.wikimedia.org/r/c/mediawiki/extensions/OAuth/+/1198714/7/src/Entity/AccessTokenEntity.php - and are directly passing an empty string as the key. It seems like we could just change that line and get it working but I'm not sure what would be the outcome of such change.

@Tgr can you explain why are we passing an empty string there? Can we change it to for example OAuthExtension ?

Never mind, I was looking at the wrong place. Not a security issue.

https://gerrit.wikimedia.org/r/c/mediawiki/extensions/OAuth/+/1236697

Change #1236697 abandoned by Gergő Tisza:

[mediawiki/extensions/OAuth@master] Do not use an empty key

Reason:

doesn't help, some of the empty key usage is in the oauth2-server library

https://gerrit.wikimedia.org/r/1236697

BearerTokenValidator::initJwtConfiguration() in the league/oauth2-server library also calls InMemory::plainText('').

We'll need to revert the lcobucci/jwt version bump and coordinate the upgrades of the two libraries.

I am going to try to revert the vendor patch, and that reminds me I should probably finally test core/vendor/CentralAuth together (T333541).

Change #1236715 had a related patch set uploaded (by Hashar; author: Hashar):

[mediawiki/vendor@master] Revert "Upgrading lcobucci/jwt (4.1.5 => 4.3.0)"

https://gerrit.wikimedia.org/r/1236715

Change #1236727 had a related patch set uploaded (by Hashar; author: Hashar):

[mediawiki/core@master] Revert "Updated lcobucci/jwt from 4.1.5 to 4.3.0"

https://gerrit.wikimedia.org/r/1236727

I have created the revert for the master branch:

For the backports to wmf/1.46.0-wmf.14 branch we gotta hold for the changes to be merged in master. The reason is the changes created by the cherry-pick in Gerrit would have the same Change-Id header. There will be thus two vendor patches depended on by the mediawiki/core patch and CI will never process it. That is merely paper work :]

@Zabe has sent the backports with different Change-Id:

https://gerrit.wikimedia.org/r/c/mediawiki/vendor/+/1236693
https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1236692

Follow-up: T416529: Document the process of merging / deploying changes to mediawiki/vendor

Change #1236693 merged by jenkins-bot:

[mediawiki/vendor@wmf/1.46.0-wmf.14] Revert "Updated lcobucci/jwt from 4.1.5 to 4.3.0"

https://gerrit.wikimedia.org/r/1236693

Change #1236692 merged by jenkins-bot:

[mediawiki/core@wmf/1.46.0-wmf.14] Revert "Updated lcobucci/jwt from 4.1.5 to 4.3.0"

https://gerrit.wikimedia.org/r/1236692

Mentioned in SAL (#wikimedia-operations) [2026-02-05T00:30:02Z] <reedy@deploy2002> Started scap sync-world: Backport for [[gerrit:1236692|Revert "Updated lcobucci/jwt from 4.1.5 to 4.3.0" (T416456)]], [[gerrit:1236693|Revert "Updated lcobucci/jwt from 4.1.5 to 4.3.0" (T416456)]]

Mentioned in SAL (#wikimedia-operations) [2026-02-05T00:32:16Z] <reedy@deploy2002> reedy, zabe: Backport for [[gerrit:1236692|Revert "Updated lcobucci/jwt from 4.1.5 to 4.3.0" (T416456)]], [[gerrit:1236693|Revert "Updated lcobucci/jwt from 4.1.5 to 4.3.0" (T416456)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2026-02-05T00:36:52Z] <reedy@deploy2002> Finished scap sync-world: Backport for [[gerrit:1236692|Revert "Updated lcobucci/jwt from 4.1.5 to 4.3.0" (T416456)]], [[gerrit:1236693|Revert "Updated lcobucci/jwt from 4.1.5 to 4.3.0" (T416456)]] (duration: 06m 50s)

Change #1236715 merged by jenkins-bot:

[mediawiki/vendor@master] Revert "Upgrading lcobucci/jwt (4.1.5 => 4.3.0)"

https://gerrit.wikimedia.org/r/1236715

Change #1236727 merged by jenkins-bot:

[mediawiki/core@master] Revert "Updated lcobucci/jwt from 4.1.5 to 4.3.0"

https://gerrit.wikimedia.org/r/1236727