fix(security): refresh roave guard via web-token/jwt-library (unblocks stale advisories pin)

[rubenvdlinde]

What

Refreshes the stale roave/security-advisories guard, and unblocks that refresh by narrowing
web-token/jwt-framework (the monolithic metapackage) to web-token/jwt-library — the split
package that actually provides every class this app uses. Same major version, 3.4.10 → 3.4.10.
This is not an upgrade.

Why the guard was stuck

roave/security-advisories is declared dev-latest, but composer.lock pins a specific commit
and composer install honours that pin — so this repo's conflict rules, and all protection
against CVEs published since, were frozen months ago.

Refreshing it failed:

- web-token/jwt-framework is locked to version 3.4.10 and an update of this package
  was not requested.
- roave/security-advisories dev-latest conflicts with web-token/jwt-experimental <4.1.7
  (web-token/jwt-framework 3.4.10 replaces web-token/jwt-experimental self.version).

That conflict is an aliasing artifact, not a live vulnerability

We are on web-token/jwt-framework 3.4.10, and every upstream advisory for that package is
fixed in exactly 3.4.10 (<3.4.10|>=4.0.0,<4.0.7|>=4.1.0,<4.1.7) — the RSA1_5 padding
oracle, the Chacha20Poly1305 missing-auth-tag bug, the JWSVerifier algorithm-confusion bug and
the PBES2 unbounded-p2c bug. composer audit --locked reports 0 advisories here.

The block comes from the replaces mechanism: the advisory as recorded against the split
package web-token/jwt-experimental carries the range <=4.1.6, without the <3.4.10
carve-out the same advisory has against jwt-framework. Because the monolith declares
replace: web-token/jwt-experimental: self.version, Composer sees "jwt-experimental 3.4.10",
tests it against <4.1.7, and conflicts. Roave encodes the range correctly for the siblings:

web-token/jwt-library      <3.4.10|>=4,<4.0.7|>=4.1,<4.1.7   <- correct
web-token/jwt-bundle       <3.4.10|>=4,<4.0.7|>=4.1,<4.1.7   <- correct
web-token/jwt-experimental <4.1.7                             <- over-broad
web-token/jwt-framework    <4.1.7                             <- over-broad

The fix, and why it is safe

Rather than force a major upgrade to ^4 for a vulnerability we are already patched against,
this depends directly on the split package we actually use:

-  "web-token/jwt-framework": "^3"
+  "web-token/jwt-library": "^3.4.10"

web-token/jwt-library 3.4.10 autoloads Jose\Component\ at its root and ships
Checker, Console, Core, Encryption, KeyManagement, NestedToken and Signature.

Verified mechanically: every use Jose\... statement across openregister, doriath and
openconnector was extracted (24 distinct classes) and each was checked to resolve to a real
file inside the jwt-library 3.4.10 dist. All 24 resolve. The check was run with a positive
control (a known-good path returns present, a deliberately bogus path returns absent), so a
"present" result is not something a broken lookup could manufacture.

Also checked, with zero hits in lib/ and tests/: Jose\Bundle / JoseFramework /
Jose\Experimental, and the transitive packages that drop out as a result
(symfony/http-foundation, symfony/http-kernel, symfony/var-dumper,
spomky-labs/aes-key-wrap) — those were pulled in only by the bundle/experimental parts of the
metapackage.

Net effect: this reduces attack surface. jwt-experimental — the package that genuinely
carries an unbounded advisory range — is no longer installed at all.

Beyond a lockfile bump

This PR intentionally touches composer.json, so flagging it explicitly. Besides the swap, the
resolver moved a set of Symfony components by patch/minor (e.g. symfony/string,
symfony/http-client, symfony/console, several polyfills) and spomky-labs/pki-framework
1.4.2 → 1.5.0. No major upgrades.

Verification

• composer audit --locked: 0 before, 0 after.
• Positive control: the same command with the same flags was run against known-vulnerable
  historical lockfiles elsewhere in the fleet and correctly reported their advisories
  (softwarecatalog pre-fix → 9, nextcloud-app-template pre-fix → 6, petstore main → 6). The
  command demonstrably can fail, so a clean result here is meaningful.
• No composer audit ignore/allow-list entry was added, and the guard was not removed.

[github-actions]

Quality Report — ConductionNL/openregister @ f0686c1

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 173/173
npm			✅	✅ 713/713
PHPUnit					✅
Newman					❌
Playwright					❌

---

Quality workflow — 2026-08-03 10:25 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/openregister @ 3239e44

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
composer			✅	✅ 173/173
npm			✅	✅ 713/713
PHPUnit					✅
Newman					✅
Playwright					✅

---

Quality workflow — 2026-08-04 01:35 UTC

Download the full PDF report from the workflow artifacts.