Version 0.8.0

• Add support for the Mercure protocol 1.0, alongside the existing 0.x protocol (Symfony\Component\Mercure\ProtocolVersion, opt-in per hub, 0.x stays the default until Mercure hub 1.0 is tagged stable)
• Add HubInterface::getProtocolVersion() and HubInterface::getCookieName()
• Add Hub/FrankenPhpHub/MockHub constructor parameters $cookieName and $protocolVersion
• Change the default subscriber authorization cookie name to __Secure-mercure_access_token when a hub is configured for protocol 1.0 (mercureAuthorization stays the default for 0.x); the __Secure-/__Host- prefix contract itself is enforced by Symfony\Component\HttpFoundation\Cookie (symfony/symfony#65162); Authorization additionally fails early, with a hint to configure a prefix-less cookie name, when a prefixed name meets a plain-HTTP hub URL (where browsers would silently drop the cookie)
• Add Mercure protocol 1.0 support (the authorization_details claim, an RFC 9068 access token, at+jwt) to Symfony\Component\Mercure\Jwt\LcobucciFactory, selected via its new $protocolVersion constructor parameter
• Add Symfony\Component\Mercure\Jwt\WebTokenFactory, a web-token/jwt-library-based alternative TokenFactoryInterface implementation for the Mercure protocol 1.0. It names algorithms by their JWA name (HS256, ES256, EdDSA, …), unlike LcobucciFactory's hmac.sha256 style, and supports RSA-PSS (PS256/PS384/PS512) and Ed25519 (EdDSA) on top of the HMAC/ECDSA/RSA algorithms both factories share
• Its constructor takes a Jose\Component\Signature\JWSBuilder and a Jose\Component\Core\JWK, so web-token/jwt-bundle's jose.jws_builder.* and jose.key.* services can be wired in directly; WebTokenFactory::fromSecret() and fromJwksUri() build both from a secret instead
• Add WebTokenFactory::fromJwksUri(), fetching the signing key from a JSON Web Key Set (JWKS) endpoint instead of a static secret, useful when key material is rotated by an external key server; the selected key is not refreshed for the lifetime of the factory instance, see the method's docblock for the tradeoff under persistent-worker deployments
• Allow TokenFactoryInterface::create()'s $subscribe/$publish parameters, and the Twig mercure() function's $topics parameter and subscribe/publish options, to be an associative array mapping a topic matcher type (exact, urlpattern, or a registered extension type) to a list of patterns, in addition to the existing flat topic list
• Replace FactoryTokenProvider's $subscribe/$publish constructor parameters with $grants (a Grant[] list) and a new $additionalClaims parameter, both forwarded to the wrapped factory
• Symfony\Component\Mercure\Jwt\LcobucciFactory::create() now throws an InvalidArgumentException describing the 0.8 signature change when called with the pre-0.8 convention (non-Grant elements in $grants, or an integer-keyed $additionalClaims), instead of silently minting a token with dropped grants or a lost exp
• Add Symfony\Component\Mercure\Jwt\DefaultClaimsTokenFactory, a TokenFactoryInterface decorator merging in a fixed set of claims (e.g. a hub's iss/aud/sub/client_id) so Authorization and the Twig mercure() function, which call HubInterface::getFactory() directly, get them without repeating them on every call
• Add Symfony\Component\Mercure\Jwt\Grant (actions/topics/payload), replacing TokenFactoryInterface::create()'s $subscribe/$publish parameters and the additionalClaims['mercure']['payload'] bag key; a single Grant can now carry both subscribe and publish actions over the same topics, producing one authorization_details entry instead of two, and a payload is validated (requires a topic, only meaningful with the subscribe action) instead of silently colliding with the legacy mercure claim's own use of the same key
• Model Authorization::createCookie()/setCookie() directly on Grant: $subscribe is renamed $grants and now also accepts a Grant[] list or a bare topic string, in addition to its previous flat-topic-list/matcher-map shapes ($payload folds into Grant's own constructor and is dropped as a separate parameter); $publish is deprecated in favor of adding a Grant::ACTION_PUBLISH Grant to $grants, and passing null for $grants is deprecated in favor of []. The $subscribe → $grants rename breaks named-argument calls using subscribe: specifically — positional calls and publish:/additionalClaims:/hub: named args are unaffected. The Twig mercure() function gains a matching grants option; its existing subscribe/publish/payload options are unaffected (translated internally the same way)
• Add MatcherInput::normalizeGrants(), the shared logic now backing both Authorization::$grants and the Twig grants option; besides Grant[] and the topic shorthands, it also accepts a list of Grant-shaped associative arrays (actions/topics/payload), letting contexts that can't construct a Grant object directly (e.g. a Twig template) still express multi-action or payload-bearing grants
• Symfony\Component\Mercure\Jwt\LcobucciFactory no longer forces integer exp/iat/nbf under protocol 1.0; a resource server is expected to accept RFC 9068's NumericDate as either an integer or a float carrying sub-second precision, lcobucci/jwt's own default
• Require PHP 8.2, up from 8.1: web-token/jwt-library, needed by WebTokenFactory, requires it