Skip to content

chore(deps): upgrade itk-dev/openid-connect-bundle to 5.0 #474

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tuj merged 2 commits into from
Jun 3, 2026
Merged

chore(deps): upgrade itk-dev/openid-connect-bundle to 5.0 #474

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6dbfc2f
chore(deps): upgrade itk-dev/openid-connect-bundle to 5.0
turegjorup Jun 2, 2026
73cee14
feat(oidc): bound provider HTTP calls with an explicit timeout
turegjorup Jun 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .env
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,6 +146,11 @@ RELATIONS_CHECKSUM_ENABLED=true

###> itk-dev/openid-connect-bundle ###
# See docs/feed/openid-connect.md for variable explanations.
# Total HTTP request timeout (seconds) for calls to the OIDC providers
# (discovery, JWKS, token exchange). Bounds a hung/slow IdP so it cannot
# tie up a php-fpm worker indefinitely. Applies to both providers.
OIDC_HTTP_TIMEOUT=5

# internal provider (admin login)
# URL to OIDC provider's metadata/discovery endpoint.
INTERNAL_OIDC_METADATA_URL=INTERNAL_OIDC_METADATA_URL
Expand Down
9 changes: 9 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,15 @@ All notable changes to this project will be documented in this file.

## [Unreleased]

- Upgraded `itk-dev/openid-connect-bundle` to 5.0 (and `itk-dev/openid-connect` to 5.0). Migrated the
OIDC exception catches in `AuthOidcController` and `AzureOidcAuthenticator` to the new
`OpenIdConnectExceptionInterface` marker, since concrete exceptions no longer extend the deprecated
`ItkOpenIdConnectException`. Added regression tests covering the exception-mapping branches and the
authenticator's claim-to-tenant-role provisioning and de-provisioning logic.
- Bounded OIDC provider HTTP calls (discovery, JWKS, token exchange) with an explicit
`http_client_options.timeout` on both providers, configurable via the new `OIDC_HTTP_TIMEOUT` env var
(default 5s). Previously no timeout was set anywhere in the chain, so Guzzle waited indefinitely and a
hung/slow IdP could tie up a php-fpm worker.
- Removed the deprecated feed types `SparkleIOFeedType`, `EventDatabaseApiFeedType` and `KobaFeedType`.
Made the unknown-feed-type handling consistent: **reads degrade, writes are rejected.** Feed sources
(and feeds) that reference a removed type keep loading — item and collection reads return them with no
Expand Down
2 changes: 1 addition & 1 deletion composer.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@
"doctrine/doctrine-migrations-bundle": "^3.1",
"doctrine/orm": "^2.9",
"gesdinet/jwt-refresh-token-bundle": "^1.0",
"itk-dev/openid-connect-bundle": "^4.1",
"itk-dev/openid-connect-bundle": "^5.0",
"justinrainbow/json-schema": "^5.2",
"kubawerlos/php-cs-fixer-custom-fixers": "^3.11",
"lexik/jwt-authentication-bundle": "^2.14",
Expand Down
Loading
Loading