Skip to content

[Security] Clarify AuthenticatorManager constructor docblock for deprecated eraseCredentials argument - #65657

Merged
nicolas-grekas merged 1 commit into
symfony:8.1from
webdevsamran:fix/authenticator-manager-deprecation-doc
Aug 27, 2026
Merged

nicolas-grekas merged 1 commit into
symfony:8.1from
webdevsamran:fix/authenticator-manager-deprecation-doc

Conversation

@webdevsamran

@webdevsamran webdevsamran commented Aug 27, 2026 •

Copy link
Copy Markdown
Contributor
Q A
Branch? 8.1
Bug fix? yes
New feature? no
Deprecations? no
Issues Fix #65648
License MIT

Since Symfony 8.1, the 6th argument of AuthenticatorManager::__construct() is $exposeSecurityErrors: the former bool $eraseCredentials argument is gone from the signature and the arguments after it moved one position to the left. A bool in that position is only accepted as the removed $eraseCredentials of the pre-8.1 signature, which triggers the deprecation and re-reads $exposeSecurityErrors and $requiredBadges from the next two arguments. The docblock described this as "passing a bool is deprecated", which made it look like a deprecated form of $exposeSecurityErrors; it now says which argument the bool is and where it comes from.

@carsonbot

Copy link
Copy Markdown

Hey!

I see that this is your first PR. That is great! Welcome!

Symfony has a contribution guide which I suggest you to read.

In short:

Review the GitHub status checks of your pull request and try to solve the reported issues. If some tests are failing, try to see if they are failing because of this change.

When two Symfony core team members approve this change, it will be merged and you will become an official Symfony contributor!
If this PR is merged in a lower version branch, it will be merged up to all maintained branches within a few days.

I am going to sit back now and wait for the reviews.

Cheers!

Carsonbot

@nicolas-grekas nicolas-grekas modified the milestones: 8.2, 8.1 Aug 27, 2026
@nicolas-grekas
nicolas-grekas changed the base branch from 8.2 to 8.1 August 27, 2026 12:02
@nicolas-grekas
nicolas-grekas force-pushed the fix/authenticator-manager-deprecation-doc branch from 2bf1861 to 2f83185 Compare August 27, 2026 12:03
@nicolas-grekas

Copy link
Copy Markdown
Member

Thank you for the fix, and welcome. I retargeted the PR to 8.1, where the deprecation and the docblock were introduced, and pushed the merge-ready version to your branch:

  • the @param lines keep the API types (ExposeSecurityLevel, string[]): the union types belong to the BC layer, not to the documented signature. The note now says which argument the bool is: Passing the removed "bool $eraseCredentials" as 6th argument (pre-8.1 signature) is deprecated since Symfony 8.1;
  • the description is rewritten: the argument was still present in 7.4 and deprecated in 8.1 (it was the eraseCredentials() method that 8.0 removed), and the header table now has the License row that the checks look for.

@nicolas-grekas

Copy link
Copy Markdown
Member

Thank you @webdevsamran.

@nicolas-grekas
nicolas-grekas merged commit 36f6f4c into symfony:8.1 Aug 27, 2026
11 of 13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

AuthenticatorManager::__construct() Incorrectly flags $eraseCredentials as deprecated when $exposeSecurityErrors is boolean

3 participants