v1.17.0

Maintenance and dependency release. Note: the minimum PHP version was raised, which is a breaking change for consumers still on PHP 8.1.

⚠️ Breaking

• Raised the minimum PHP version to 8.2 (PHP 8.1 is no longer supported).

Dependencies

• web-token/jwt-library: ^3.3 → ^4.0
• predis/predis (dev): ^1.1 → ^3.0
• phpunit/phpunit (dev): ^9 → ^11, yoast/phpunit-polyfills: ^1 → ^4
• firebase/php-jwt: ^7.0
• Replaced rector/rector with phpstan/phpstan in dev dependencies

Improvements

• Enabled PHPStan level 5 (with a baseline for legacy code) and corrected numerous PHPDoc/type annotations across storage interfaces and controllers
• Typed IdToken::decodeToken() correctly (array<string, mixed>|false) and hardened the aud claim access in LogoutController
• Dropped the dead mcrypt fallback in the token generators
• Ensured $clientId is always defined in TokenController::grantAccessToken()
• Added test coverage for JWKSetController

CI / Tooling

• Migrated CI to GitHub Actions with a PHP 8.2–8.5 test matrix
• Fixed the redis connection fallback in the test bootstrap for predis 3.x

Full changelog: v1.16.14...v1.17.0

v1.16.14

Add correct handling (correct decoding of username and password) of basic auth for client credentials grant type.

v1.16.13

Fix handling of missing client in SLO controller

v1.16.12

Minor fix

v1.16.11

Add ability to exclude clients from backchannel logout.

v1.16.10

Fix handling of refresh tokens in logout

v1.16.9

Fix minor serialization in logout token

v1.16.8

Fix JWKS Endpoint serialization

v1.16.7

Fix minor guzzle issue with timeouts

v1.16.6

Fix double JSON-Encoding in JWKs endpoint