Merge branch '4.0.x' into 4.1.x

Mise à jour de la contrainte de version de brick/math pour inclure le…

Fix PHP 8.5 deprecation (#648)

Fix PHP 8.5 deprecation (#648)

Fix PHP 8.5 deprecation (#648)

Add GitHub Action to auto-switch default branch on new tags

Refactor command help text definitions for Symfony Console compatibil…

• 3.4.x:
  Update signature tests for the protected-header "alg" requirement (#651)
  Merge commit from fork
  Merge commit from fork
  Merge commit from fork
  Merge commit from fork
  Add sodium support for Base64 URL safe encoding/decoding (#644)
  Allow psr/cache v2 (#620)
  Fix call function on null (#596)
  Add RangeException to Base64UrlSafe (#577)
  Add Base64UrlSafe utility and refactor code references (#576)

Conflicts:

composer.json

phpstan-baseline.neon

src/Bundle/DataCollector/JWECollector.php

src/Experimental/KeyEncryption/AESCTR.php

src/Experimental/KeyEncryption/Chacha20Poly1305.php

src/Experimental/Signature/Blake2b.php

src/Library/Console/GeneratorCommand.php

src/Library/Core/JWK.php

src/Library/Core/Util/Base64UrlSafe.php

src/Library/Encryption/Algorithm/ContentEncryption/AESCBCHS.php

src/Library/Encryption/Algorithm/ContentEncryption/AESGCM.php

src/Library/Encryption/Algorithm/KeyEncryption/AESGCMKW.php

src/Library/Encryption/Algorithm/KeyEncryption/AESKW.php

src/Library/Encryption/Algorithm/KeyEncryption/AbstractECDH.php

src/Library/Encryption/Algorithm/KeyEncryption/Dir.php

src/Library/Encryption/Algorithm/KeyEncryption/PBES2AESKW.php

src/Library/Encryption/Algorithm/KeyEncryption/RSA15.php

src/Library/Encryption/Algorithm/KeyEncryption/Util/ConcatKDF.php

src/Library/Encryption/Algorithm/KeyEncryption/Util/RSACrypt.php

src/Library/Encryption/Serializer/CompactSerializer.php

src/Library/Encryption/Serializer/JSONFlattenedSerializer.php

src/Library/Encryption/Serializer/JSONGeneralSerializer.php

src/Library/KeyManagement/Analyzer/ESKeyAnalyzer.php

src/Library/KeyManagement/Analyzer/HSKeyAnalyzer.php

src/Library/KeyManagement/Analyzer/OctAnalyzer.php

src/Library/KeyManagement/Analyzer/RsaAnalyzer.php

src/Library/KeyManagement/Analyzer/ZxcvbnKeyAnalyzer.php

src/Library/Signature/Algorithm/EdDSA.php

src/Library/Signature/Algorithm/HMAC.php

src/Library/Signature/Serializer/CompactSerializer.php

src/Library/Signature/Serializer/JSONFlattenedSerializer.php

src/Library/Signature/Serializer/JSONGeneralSerializer.php

src/Library/composer.json

tests/Bundle/JoseFramework/Functional/Encryption/JWECollectorTest.php

tests/Bundle/JoseFramework/Functional/KeyManagement/JWKLoaderTest.php

tests/Component/Encryption/RFC7520/A128KWAndA128GCMEncryptionWithCompressionTest.php

tests/Component/KeyManagement/JWKFactoryTest.php

JWSVerifier::getAlgorithm() merged the protected and unprotected headers
with [...$protected, ...$unprotected]; with duplicate keys PHP keeps the
LAST value, so the attacker-controlled unprotected header could override
the integrity-protected "alg". Combined with HeaderCheckerManager (which
validates "alg" from the protected header), this is a TOCTOU
algorithm-confusion / downgrade vector (e.g. forcing HS256 against an RSA
public key, or HS512 -> HS256), and "alg" placed only in the unprotected
header bypassed the duplicate-parameter check entirely.

Per RFC 7515 §4.1.1 "alg" MUST be integrity protected. getAlgorithm() now
reads "alg" exclusively from the protected header and rejects a JWS whose
"alg" is absent from (or present only outside) the protected header.

Co-authored-by: Claude Opus 4.8 (1M context) [email protected]

Add sodium support for Base64 URL safe encoding/decoding (#644)