Refactor to Constraints when lcobucci/jwt 4.0 is released

[steverhoades]

Reference: #lcobucci/jwt#72

[lcobucci]

Don't forget that v4.0 will require php: >=7.0

[steverhoades]

@lcobucci this is a good point as PHP 5.6 is not EOL until Jan 2019.

[lcobucci]

@steverhoades indeed. I saw that you don't have this requirement in this package so was just wanted to remind you about this. v3 will still be maintained (without new features) to keep the compatibility with PHP 5 😉

[fanglingsu]

@steverhoades PHP 7.2 is already EOL and the lcobucci/jwt 4.2.x already available. Are there any plans to run this also under PHP8?

[steverhoades]

@fanglingsu Yes to the above. My time is the biggest limiting factor right now. PRs are much appreciated!

[Levivb]

I'm currently in the process of upgrading this package. Although I intend to keep the structure and interface as much intact as possible I do admit due to the upgrade to php 7.4 (because lcobucci/jwt requires php 7.4 as minimum) quite some code will change and will make use of type hinting and a bit more strict expectations.

See:
https://github.com/Levivb/oauth2-openid-connect-client/tree/feature/update-dependencies

Will submit a PR later

[Levivb]

Also note that I lack full comprehension of OpenID Connect. So I have to take a careful look at https://lcobucci-jwt.readthedocs.io/en/latest/upgrading/ to see what has to be changed all the while keeping the code working. At the moment implementing (almost?) full test coverage with lcobucci/jwt:3.4 to ease the upgrade to lcobucci/jwt:4.1

[lcobucci]

@Levivb that sounds great. Please let me know if there's anything I can do to help you!

[steverhoades]

It's hard to believe this issue is 5 years old now. I apologize it hasn't been upgraded already. @Levivb your contribution will be greatly appreciated!

[Levivb]

Good to hear 😄

Currently all classes are fully tested except for the behemoth OpenIDConnectProvider::getAccessToken test which is WIP. I will continue that test tomorrow or possibly next week (got several meetings and appointments tomorrow).

Will check code coverage as well to be sure nothing is accidentally untested.
After that, the lcobucci/jwtcan be updated to 4.1 and necessary code changes applied.

I also applied PSR12 through phpcs, added enlightn/security-checker, ergebnis/composer-normalize, insolita/unused-scanner, maglnet/composer-require-checker, php-parallel-lint/php-parallel-lint and roave/security-advisories to bring this package up to date with todays standards, quality and security.

[markwalet]

When can we expect support for lcobucci/jwt:^4.0? I'm working on upgrading the php version of one of my apps. And this package is the bottleneck right now.

The reason I'm asking is because the PR is already a few months in WIP :)

[JurRutten]

+1