Replace spomky-labs/base64url with paragonie/constant_time_encoding#397
Replace spomky-labs/base64url with paragonie/constant_time_encoding#397Minishlink merged 3 commits intoweb-push-libs:masterfrom
spomky-labs/base64url with paragonie/constant_time_encoding#397Conversation
| "guzzlehttp/guzzle": "^7.4.5", | ||
| "web-token/jwt-library": "^3.3.0", | ||
| "spomky-labs/base64url": "^2.0.4" | ||
| "web-token/jwt-library": "^3.3.0" |
There was a problem hiding this comment.
Is it best practive nowadays in PHP to use sub dependencies in the project? Shouldn't the dependency be added as a direct dependency so that if jw-library removes paragonie/constant_time_encoding on a minor/patch version, the project still works?
There was a problem hiding this comment.
You are right, I forgot to add that.
|
Hi @Minishlink, the latest release is more than one year old. Is it possible to make a new one, please 🙏. |
|
Hello, yep it is planned as soon as #394 lands :) That PR is a breaking change so I would prefer avoiding two breaking change releases in a row (in addition of dropping PHP 8.0 support). |
|
@Minishlink @Cyperghost replacing spomky-labs/base64url library was a mistake IMHO. Let me explain why.
Please reconsider this change. Return old library or may be use libsodium https://www.php.net/manual/en/book.sodium.php |
|
Hello, thanks for your feedback. Can you send a PR that adds a test for your use case please? (which should fail on master) Can you stick with v8 in the meantime? |
|
Hi, |
|
Thank you |
|
Reverted in v9.0.0-rc2 |
The composer package
paragonie/constant_time_encodingis already provided byweb-token/jwt-libraryand gives a better security.