symfony/mercure

• Add support for the Mercure protocol 1.0, alongside the existing 0.x protocol (Symfony\Component\Mercure\ProtocolVersion, opt-in per hub, 0.x stays the default until Mercure hub 1.0 is tagged stable)
• Add HubInterface::getProtocolVersion() and HubInterface::getCookieName()
• Add Hub/FrankenPhpHub/MockHub constructor parameters $cookieName and $protocolVersion
• Change the default subscriber authorization cookie name to __Secure-mercure_access_token when a hub is configured for protocol 1.0 (mercureAuthorization stays the default for 0.x); the __Secure-/__Host- prefix contract itself is enforced by Symfony\Component\HttpFoundation\Cookie (symfony/symfony#65162); Authorization additionally fails early, with a hint to configure a prefix-less cookie name, when a prefixed name meets a plain-HTTP hub URL (where browsers would silently drop the cookie)
• Add Mercure protocol 1.0 support (the authorization_details claim, an RFC 9068 access token, at+jwt) to Symfony\Component\Mercure\Jwt\LcobucciFactory, selected via its new $protocolVersion constructor parameter
• Add Symfony\Component\Mercure\Jwt\WebTokenFactory, a web-token/jwt-library-based alternative TokenFactoryInterface implementation for the Mercure protocol 1.0. It names algorithms by their JWA name (HS256, ES256, EdDSA, …), unlike LcobucciFactory's hmac.sha256 style, and supports RSA-PSS (PS256/PS384/PS512) and Ed25519 (EdDSA) on top of the HMAC/ECDSA/RSA algorithms both factories share
• Its constructor takes a Jose\Component\Signature\JWSBuilder and a Jose\Component\Core\JWK, so web-token/jwt-bundle's jose.jws_builder.* and jose.key.* services can be wired in directly; WebTokenFactory::fromSecret() and fromJwksUri() build both from a secret instead
• Add WebTokenFactory::fromJwksUri(), fetching the signing key from a JSON Web Key Set (JWKS) endpoint instead of a static secret, useful when key material is rotated by an external key server; the selected key is not refreshed for the lifetime of the factory instance, see the method's docblock for the tradeoff under persistent-worker deployments
• Allow TokenFactoryInterface::create()'s $subscribe/$publish parameters, and the Twig mercure() function's $topics parameter and subscribe/publish options, to be an associative array mapping a topic matcher type (exact, urlpattern, or a registered extension type) to a list of patterns, in addition to the existing flat topic list
• Replace FactoryTokenProvider's $subscribe/$publish constructor parameters with $grants (a Grant[] list) and a new $additionalClaims parameter, both forwarded to the wrapped factory
• Symfony\Component\Mercure\Jwt\LcobucciFactory::create() now throws an InvalidArgumentException describing the 0.8 signature change when called with the pre-0.8 convention (non-Grant elements in $grants, or an integer-keyed $additionalClaims), instead of silently minting a token with dropped grants or a lost exp
• Add Symfony\Component\Mercure\Jwt\DefaultClaimsTokenFactory, a TokenFactoryInterface decorator merging in a fixed set of claims (e.g. a hub's iss/aud/sub/client_id) so Authorization and the Twig mercure() function, which call HubInterface::getFactory() directly, get them without repeating them on every call
• Add Symfony\Component\Mercure\Jwt\Grant (actions/topics/payload), replacing TokenFactoryInterface::create()'s $subscribe/$publish parameters and the additionalClaims['mercure']['payload'] bag key; a single Grant can now carry both subscribe and publish actions over the same topics, producing one authorization_details entry instead of two, and a payload is validated (requires a topic, only meaningful with the subscribe action) instead of silently colliding with the legacy mercure claim's own use of the same key
• Model Authorization::createCookie()/setCookie() directly on Grant: $subscribe is renamed $grants and now also accepts a Grant[] list or a bare topic string, in addition to its previous flat-topic-list/matcher-map shapes ($payload folds into Grant's own constructor and is dropped as a separate parameter); $publish is deprecated in favor of adding a Grant::ACTION_PUBLISH Grant to $grants, and passing null for $grants is deprecated in favor of []. The $subscribe → $grants rename breaks named-argument calls using subscribe: specifically — positional calls and publish:/additionalClaims:/hub: named args are unaffected. The Twig mercure() function gains a matching grants option; its existing subscribe/publish/payload options are unaffected (translated internally the same way)
• Add MatcherInput::normalizeGrants(), the shared logic now backing both Authorization::$grants and the Twig grants option; besides Grant[] and the topic shorthands, it also accepts a list of Grant-shaped associative arrays (actions/topics/payload), letting contexts that can't construct a Grant object directly (e.g. a Twig template) still express multi-action or payload-bearing grants
• Symfony\Component\Mercure\Jwt\LcobucciFactory no longer forces integer exp/iat/nbf under protocol 1.0; a resource server is expected to accept RFC 9068's NumericDate as either an integer or a float carrying sub-second precision, lcobucci/jwt's own default
• Require PHP 8.2, up from 8.1: web-token/jwt-library, needed by WebTokenFactory, requires it

• Add support for the Mercure protocol 1.0, alongside the existing 0.x protocol (Symfony\Component\Mercure\ProtocolVersion, opt-in per hub, 0.x stays the default until Mercure hub 1.0 is tagged stable)
• Add HubInterface::getProtocolVersion() and HubInterface::getCookieName()
• Add Hub/FrankenPhpHub/MockHub constructor parameters $cookieName and $protocolVersion
• Change the default subscriber authorization cookie name to __Secure-mercure_access_token when a hub is configured for protocol 1.0 (mercureAuthorization stays the default for 0.x); the __Secure-/__Host- prefix contract itself is enforced by Symfony\Component\HttpFoundation\Cookie (symfony/symfony#65162); Authorization additionally fails early, with a hint to configure a prefix-less cookie name, when a prefixed name meets a plain-HTTP hub URL (where browsers would silently drop the cookie)
• Add Mercure protocol 1.0 support (the authorization_details claim, an RFC 9068 access token, at+jwt) to Symfony\Component\Mercure\Jwt\LcobucciFactory, selected via its new $protocolVersion constructor parameter
• Add Symfony\Component\Mercure\Jwt\WebTokenFactory, a web-token/jwt-library-based alternative TokenFactoryInterface implementation for the Mercure protocol 1.0. It names algorithms by their JWA name (HS256, ES256, EdDSA, …), unlike LcobucciFactory's hmac.sha256 style, and supports RSA-PSS (PS256/PS384/PS512) and Ed25519 (EdDSA) on top of the HMAC/ECDSA/RSA algorithms both factories share
• Its constructor takes a Jose\Component\Signature\JWSBuilder and a Jose\Component\Core\JWK, so web-token/jwt-bundle's jose.jws_builder.* and jose.key.* services can be wired in directly; WebTokenFactory::fromSecret() and fromJwksUri() build both from a secret instead
• Add WebTokenFactory::fromJwksUri(), fetching the signing key from a JSON Web Key Set (JWKS) endpoint instead of a static secret, useful when key material is rotated by an external key server; the selected key is not refreshed for the lifetime of the factory instance, see the method's docblock for the tradeoff under persistent-worker deployments
• Allow TokenFactoryInterface::create()'s $subscribe/$publish parameters, and the Twig mercure() function's $topics parameter and subscribe/publish options, to be an associative array mapping a topic matcher type (exact, urlpattern, or a registered extension type) to a list of patterns, in addition to the existing flat topic list
• Replace FactoryTokenProvider's $subscribe/$publish constructor parameters with $grants (a Grant[] list) and a new $additionalClaims parameter, both forwarded to the wrapped factory
• Symfony\Component\Mercure\Jwt\LcobucciFactory::create() now throws an InvalidArgumentException describing the 0.8 signature change when called with the pre-0.8 convention (non-Grant elements in $grants, or an integer-keyed $additionalClaims), instead of silently minting a token with dropped grants or a lost exp
• Add Symfony\Component\Mercure\Jwt\DefaultClaimsTokenFactory, a TokenFactoryInterface decorator merging in a fixed set of claims (e.g. a hub's iss/aud/sub/client_id) so Authorization and the Twig mercure() function, which call HubInterface::getFactory() directly, get them without repeating them on every call
• Add Symfony\Component\Mercure\Jwt\Grant (actions/topics/payload), replacing TokenFactoryInterface::create()'s $subscribe/$publish parameters and the additionalClaims['mercure']['payload'] bag key; a single Grant can now carry both subscribe and publish actions over the same topics, producing one authorization_details entry instead of two, and a payload is validated (requires a topic, only meaningful with the subscribe action) instead of silently colliding with the legacy mercure claim's own use of the same key
• Model Authorization::createCookie()/setCookie() directly on Grant: $subscribe is renamed $grants and now also accepts a Grant[] list or a bare topic string, in addition to its previous flat-topic-list/matcher-map shapes ($payload folds into Grant's own constructor and is dropped as a separate parameter); $publish is deprecated in favor of adding a Grant::ACTION_PUBLISH Grant to $grants, and passing null for $grants is deprecated in favor of []. The $subscribe → $grants rename breaks named-argument calls using subscribe: specifically — positional calls and publish:/additionalClaims:/hub: named args are unaffected. The Twig mercure() function gains a matching grants option; its existing subscribe/publish/payload options are unaffected (translated internally the same way)
• Add MatcherInput::normalizeGrants(), the shared logic now backing both Authorization::$grants and the Twig grants option; besides Grant[] and the topic shorthands, it also accepts a list of Grant-shaped associative arrays (actions/topics/payload), letting contexts that can't construct a Grant object directly (e.g. a Twig template) still express multi-action or payload-bearing grants
• Symfony\Component\Mercure\Jwt\LcobucciFactory no longer forces integer exp/iat/nbf under protocol 1.0; a resource server is expected to accept RFC 9068's NumericDate as either an integer or a float carrying sub-second precision, lcobucci/jwt's own default
• Require PHP 8.2, up from 8.1: web-token/jwt-library, needed by WebTokenFactory, requires it

0.7.2

• Revert lazy-loading the Twig extension to fix compatibility with Symfony 6.4

• Revert lazy-loading the Twig extension to fix compatibility with Symfony 6.4

• Compatibility with PHP 8.5

• Compatibility with PHP 8.5

• Add support for FrankenPHP's mercure_publish() function
• Compatibility with Symfony 8
• Lazy-load the Twig extension
• Drop support for unmaintained PHP and Symfony versions

• Add support for FrankenPHP's mercure_publish() function
• Compatibility with Symfony 8
• Lazy-load the Twig extension
• Drop support for unmaintained PHP and Symfony versions

What's Changed

• Fix compatibility of last event ID with the latest version of the spec by @dunglas in #114
• Explicitly mark nullable parameters as nullable by @xabbuh in #113

New Contributors

• @xabbuh made their first contribution in #113

Full Changelog: v0.6.4...v0.6.5

• Allow symfony/deprecation-contracts v4

• Allow symfony/deprecation-contracts v4

• Compatibility with lcobucci/jwt 5.0

• Compatibility with lcobucci/jwt 5.0

• Always set the Content-Type HTTP header to application/x-www-form-urlencoded when sending an update to the hub
• Symfony\Component\Mercure\Messenger\UpdateHandler now returns the ID of the published update
• Allow passing null as $subscribe and $publish parameters in Symfony\Component\Mercure\Jwt\TokenFactoryInterface
• Add a new optional parameter in Symfony\Component\Mercure\Authorization::__construct() to set the SameSite cookie attribute

• Always set the Content-Type HTTP header to application/x-www-form-urlencoded when sending an update to the hub
• Symfony\Component\Mercure\Messenger\UpdateHandler now returns the ID of the published update
• Allow passing null as $subscribe and $publish parameters in Symfony\Component\Mercure\Jwt\TokenFactoryInterface
• Add a new optional parameter in Symfony\Component\Mercure\Authorization::__construct() to set the SameSite cookie attribute

• Allow passing additional data to the mercure JWT claim when using Symfony\Component\Mercure\Token\LcobucciFactory
• Add a new passphrase argument to Symfony\Component\Mercure\Token\LcobucciFactory allowing the use of encrypted keys
• Add a new lastEventId option to the mercure() Twig function to set the Last-Event-ID query parameter
• Fix a bug preventing setting cookies for legit subdomains when using Symfony\Component\Mercure\Authorization::createCookie()
• Fix bug in Symfony\Component\Mercure\Token\LcobucciFactory that results in a runtime error when using "ecdsa" algorithms, alongside "lcobucci/jwt:^4.0"

• Allow passing additional data to the mercure JWT claim when using Symfony\Component\Mercure\Token\LcobucciFactory
• Add a new passphrase argument to Symfony\Component\Mercure\Token\LcobucciFactory allowing the use of encrypted keys
• Add a new lastEventId option to the mercure() Twig function to set the Last-Event-ID query parameter
• Fix a bug preventing setting cookies for legit subdomains when using Symfony\Component\Mercure\Authorization::createCookie()
• Fix bug in Symfony\Component\Mercure\Token\LcobucciFactory that results in a runtime error when using "ecdsa" algorithms, alongside "lcobucci/jwt:^4.0"

• Add mercure() Twig function to generate URLs of the hubs and set the authorization cookies
• Add Authorization::setCookie() to ease setting authorization cookies
• Add Authorization::clearCookie() to remove the mercureAuthorization cookie from the browser
• Fix the domain check in Authorization::createCookie() to allow subdomains
• Compatibility with Symfony 6 and Symfony Contracts 3

• Add mercure() Twig function to generate URLs of the hubs and set the authorization cookies
• Add Authorization::setCookie() to ease setting authorization cookies
• Add Authorization::clearCookie() to remove the mercureAuthorization cookie from the browser
• Fix the domain check in Authorization::createCookie() to allow subdomains
• Compatibility with Symfony 6 and Symfony Contracts 3

• Full compatibility with PHP 7.1+

• Set a default expiration for the JWT and the cookie when using the Authorization class

• Fix MockHub::__construct() signature

• Added Symfony\Component\Mercure\Jwt\TokenProviderInterface
• Added Symfony\Component\Mercure\Jwt\TokenFactoryInterface
• Added Symfony\Component\Mercure\Jwt\StaticTokenProvider
• Added Symfony\Component\Mercure\Jwt\CallabkeTokenProvider
• Added Symfony\Component\Mercure\Jwt\LcobucciTokenFactory
• Added Symfony\Component\Mercure\Jwt\FactoryTokenProvider
• Added Symfony\Component\Mercure\Messenger\UpdateHandler
• Added Symfony\Component\Mercure\Hub
• Added Symfony\Component\Mercure\HubInterface
• Added Symfony\Component\Mercure\HubRegistry
• Added Symfony\Component\Mercure\Discovery
• Added Symfony\Component\Mercure\Authorization
• Deprecated Jwt\StaticJwtProvider, use Jwt\StaticTokenProvider instead.
• Deprecated PublisherInterface interface in favor of HubInterface.
• Deprecated Publisher class in favor of Hub.
• Deprecated Debug\TraceablePublisher class in favor of Debug\TraceableHub.

• Compatibility with PHP 8

• Compatibility with Mercure 0.10

• Compatibility with Symfony 5
• Add TraceablePublisher to collect debug information
• Add PublisherInterface
• Fix an error when using the retry parameter

• Use the Symfony HttpClient component