Package spomky-labs/jose is abandoned

[rlbaxter]

I get the following message when attempting to follow the documentation.

Package spomky-labs/jose is abandoned, you should avoid using it. Use web-token/jwt-framework instead.

The examples should probably be updated to recommend the firebase library, web-token library, or some other library that is not abandoned.

[munir131]

@bretterer Any plan for this? It is important.

[Vardkin]

@munir131 until they address this you can just use:

composer require firebase/php-jwt

and set this class as the adapter.

$jwtVerifier = (new \Okta\JwtVerifier\JwtVerifierBuilder())  
     ->setAdaptor(new \Okta\JwtVerifier\Adaptors\FirebasePhpJwt())
     ...

Unless you want to write a new adapter for the JWT framework and submit a PR 👍

[rlbaxter]

I created a pull request to update the documentation to show using the firebase library as the main example. I've never actually contributed on a project like this before, so please let me know if I did something wrong.

[munir131]

I think they should merge #22 It is a proper solution using jwt framework. Also fine to use Firebase too. Looks like they are not maintaining this package now, which is disappointed.

[robertjd]

Thanks everyone for the feedback. We'll take a look at this when we can. Since this is a dev dependency this is lower prio for us. Though I can certainly empathize with the warnings on dev dependencies, those are annoying 😭

[bretterer]

internal-ref: OKTA-258479

[bretterer]

Released this update in 0.3.0 release

spomky-labs/jose is remaining as a dependency for BC concerns until 1.0 release, but the default adaptor has been set to firebase and all references in readme have been removed