[5.1] Mark authentication parameters sensitive (#366)

* Mark authentication parameters sensitive

* Move changelog entry to 5.1.1

* Require PHP 8.2 polyfill

Author: GrahamCampbell

CHANGELOG.md

@@ -2,6 +2,11 @@ CHANGE LOG
 ==========
 
 
+## 5.1.1 (UPCOMING)
+
+* Add sensitive parameter annotations for authentication tokens
+
+
 ## 5.1.0 (06/05/2026)
 
 * Add PHP 8.5 support

composer.json

@@ -28,7 +28,8 @@
         "php-http/httplug": "^2.4.1",
         "psr/http-client-implementation": "^1.0",
         "psr/http-factory-implementation": "^1.0",
-        "psr/http-message": "^1.1 || ^2.0"
+        "psr/http-message": "^1.1 || ^2.0",
+        "symfony/polyfill-php82": "^1.27"
     },
     "require-dev": {
         "bamarni/composer-bin-plugin": "^1.8.2",

src/Client.php

@@ -213,7 +213,7 @@ public function vpc(): Vpc
         return new Vpc($this);
     }
 
-    public function authenticate(string $token): void
+    public function authenticate(#[\SensitiveParameter] string $token): void
     {
         $this->getHttpClientBuilder()->addPlugin(new Authentication($token));
     }

src/HttpClient/Plugin/Authentication.php

@@ -34,7 +34,7 @@ final class Authentication implements Plugin
      */
     private readonly string $header;
 
-    public function __construct(string $token)
+    public function __construct(#[\SensitiveParameter] string $token)
     {
         $this->header = \sprintf('Bearer %s', $token);
     }