What it says on the tin!
Main change is moving the code into namespaces, so will need to be updated for that
Description
Description
Details
Details
Related Changes in Gerrit:
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Update firebase/php-jwt to 3.0.0 | mediawiki/extensions/OAuth | master | +3 -2 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | Reedy | T119294 Update firebase/php-jwt to 3.0.0 in vendor repo | |||
| Resolved | Reedy | T119295 Update firebase/php-jwt to 3.0.0 in OAuth extension | |||
| Resolved | Reedy | T119194 Move lib/JWT.php to extension vendor |
Event Timeline
Comment Actions
Change 254642 had a related patch set uploaded (by Reedy):
Update firebase/php-jwt to 3.0.0
Comment Actions
Full changelog is https://github.com/firebase/php-jwt/compare/e0a75bfb6413f22092c99b70f310ccb2cca3efa5...fa8a06e96526eb7c0eeaa47e4f39be59d21f16e1, and it looks like the only actual code change is https://github.com/firebase/php-jwt/commit/49f7de66cfb3ae4867a0c95665102b2b0386c4a0 "require a non-empty key to decode a JWT"
@csteipp/security people, could you take a quick look and make sure the new version is ok? I can take care of coordinating the merges if it is.
Comment Actions
Did I never comment on this? Sorry about that..
Ex:OAuth should never call php-jwt with an empty key, but good to update the library to make it impossible.
Has vendor been updated too?
Comment Actions
Yup, see https://gerrit.wikimedia.org/r/#/c/254641/ and T119294... Which should've been closed already. Will do that now