web-auth/webauthn-symfony-bundle

RS1 is RSASSA-PKCS1-v1_5 with SHA-1, which is no longer acceptable for digital
signatures. web-auth/cose-lib emits an E_USER_WARNING when the algorithm is
built without an explicit acknowledgement, and the Symfony error handler turns
that warning into an exception in the dev environment, so every attestation or
assertion request answered with a 500 as soon as the algorithm manager was
built.

Acknowledging the algorithm in the service definition would have silenced the
warning while keeping an insecure algorithm in the default verification
manager. The bundle should not make that choice on behalf of the applications,
so the definition is removed instead.

BREAKING CHANGE: webauthn.cose.algorithm.RS1 is no longer registered, so the
default verification manager no longer accepts RS1 signatures. The bundle never
offered RS1 at the registration, since public_key_credential_parameters
defaults to an empty list, so only the applications that explicitly added
COSE_ALGORITHM_RS1 to that list are affected. They have to declare the service
themselves; autoconfiguration adds it back to the manager.

fix(rp-entity): default rp.name to the Relying Party ID when serializ…

• ci: run PHPUnit without castor and drop the PHP 8.6 matrix entry

The tests job runs inside the phpqa image of the matrix PHP version and
called castor, which requires PHP >= 8.4, so the 8.2 and 8.3 entries
died before running a single test. The job now calls the same PHPUnit
command castor was wrapping.

The 8.6 image is not published, only 8.2 to 8.5 are, so that entry could
only fail at container initialisation. It can come back once the image
exists.

Ref #933

• fix(tests): keep the in-memory logger compatible with psr/log 1.x and 2.x

composer.json allows psr/log ^1.0|^2.0|^3.0, so the lowest-deps job
installs psr/log 1.x, whose LoggerInterface::log() takes an untyped
message. The fixture declared the 3.x signature and PHP refused to load
the test suite.

Ref #933

• ci: repair the ECS and Rector configurations

SetList::PHPUNIT, SetList::STRICT and PHPUnitSetList::PHPUNIT_120 have
been removed upstream, so both tools aborted before looking at a single
file. The rules that mattered from the STRICT set are already declared
one by one right below the imports, and the version specific PHPUnit set
is covered by withComposerBased().

RemoveEraseCredentialsRector is skipped: it would delete
eraseCredentials() from a test fixture implementing UserInterface, which
is fatal on Symfony 6.4.

Ref #933

• style: absorb the ECS and Rector backlog

Both tools had been silent for months, so a backlog accumulated: comment
spacing, native function invocation, global namespace imports, redundant
boolean identity comparisons, a readonly class, a dead instanceof assert
and a property default the constructor always overwrites.

Ref #933

• ci: regenerate the PHPStan baseline

Nineteen errors were reported outside the baseline, one of them an
unmatched ignored error on Psr18HttpClient which trips
reportUnmatchedIgnoredErrors. Generated on PHP 8.4, the version the CI
job uses.

Ref #933

fix(security): stop logging the raw Request object in WebauthnAuthent…

fix(security): stop logging the raw Request object in WebauthnAuthent…

fix(creation-profiles): default rp.name to rp.id when empty (#893) (#…

feat: support Conditional Create (mediation) for auto-register flows …

feat: support Conditional Create (mediation) for auto-register flows …