Add Symfony 5 to the long list of supported versions

[damienalexandre]

This PR supersede #209 as the logic is different, here we keep support for all versions by using class_exists a lot.

Thanks to @lyrixx I discovered that the setUp() : void from PHPUnit issue is normally managed by the PHPUnit Bridge! 😍

[damienalexandre]

Tests are ok on PHP 7.1+, still need to figure out why SYMFONY_PHPUNIT_REMOVE_RETURN_TYPEHINT=1 does not work as expected.

[Seldaek]

Thanks for the work, let me know once you figure out the build failure and I happily merge..

[damienalexandre]

Would it be okay to drop PHP 5.4?

I cannot make it work with it:

• the phpunit bridge > 4.2 is PHP 5.5 only
• the methods replacing "expectedException" annotations are not poly-filled in phpunit bridge <= 4.2

This is the last and only blocker for this PR.

[damienalexandre]

Tests are now green but PHP 5.4 has been removed. It does not mean the bundle does not work anymore, it's just we can't run the tests on this version.

[stof]

this can be simplified. Namespaced class names exist in Twig 1.x and 2.x too (I don't remember which minor version, but Symfony requires such minor version in all maintained branches anyway as it uses namespaced classes everywhere)

[damienalexandre]

This bundle is tested against un-maintained versions of Symfony, when installing with composer update --prefer-lowest we get Twig version 1.24.0 where there is no class Twig\Environment:

https://github.com/twigphp/Twig/blob/v1.24.0/lib/Twig/Environment.php

Maybe we should bump Twig minimal version but that will be a BC Break.

This condition is only here to avoid a direct deprecation notices:

1x: Using the "Twig_Environment" class is deprecated since Twig version 2.7, use "Twig\Environment" instead.
1x in IntegrationTest::testItWorksDynamically from Nelmio\SecurityBundle\Tests\Twig

1x: Using the "Twig_Loader_Filesystem" class is deprecated since Twig version 2.7, use "Twig\Loader\FilesystemLoader" instead.
1x in IntegrationTest::testItWorksDynamically from Nelmio\SecurityBundle\Tests\Twig

[stof]

Maybe we should bump Twig minimal version but that will be a BC Break.

I would not consider it as a BC break, given that composer will take care of preventing to install these old unmaintained Twig releases alongside the new version of this bundle.

[stof]

this should be a throw new TypeError (or throw new InvalidArgumentException if PHP 5.x support is needed) rather than a silent failure. Otherwise, switching back to a typehint when dropping support for Symfony < 4.4 would be a BC break.

Btw, I suggest tagging all listener classes as @final, otherwise this typehint removal is a BC break.

[stof]

Dropping tests for PHP 5.4 without dropping support for it in composer.json is a bad idea IMO. Projects running on PHP 5.4 should rather get an old test release than an uptodate release for which no testing has been done (as it might be incompatible).

[damienalexandre]

Thanks for the review, I just switched all the return to a clear Exception message, added a test, added the final annotation and bumped PHP minimal version in composer.

[damienalexandre]

Twig is now bumped to 1.38, which is the minimal version we can use with support for the namespaced classes.

I also changed all Twig related code to use the namespaced classes to avoid some errors and make it "clean".

PHP Fatal error: Declaration of Nelmio\SecurityBundle\Twig\TokenParser\AbstractCSPParser::parse(Twig_Token $token) must be compatible with Twig\TokenParser\TokenParserInterface::parse(Twig\Token $token) in /**/NelmioSecurityBundle/Twig/TokenParser/AbstractCSPParser.php on line 57

[spackmat]

Please also include Twig ^3.0.

[damienalexandre]

Yes great idea, just did that 👍