GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [Security] Clarify AuthenticatorManager constructor docblock for deprecated eraseCredentials argument by webdevsamran · Pull Request #65657 · symfony/symfony

Conversation

@webdevsamran

@webdevsamran webdevsamran commented Aug 27, 2026 •
edited by nicolas-grekas
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor
Q A
Branch? 8.1
Bug fix? yes
New feature? no
Deprecations? no
Issues Fix #65648
License MIT

Since Symfony 8.1, the 6th argument of AuthenticatorManager::__construct() is $exposeSecurityErrors: the former bool $eraseCredentials argument is gone from the signature and the arguments after it moved one position to the left. A bool in that position is only accepted as the removed $eraseCredentials of the pre-8.1 signature, which triggers the deprecation and re-reads $exposeSecurityErrors and $requiredBadges from the next two arguments. The docblock described this as "passing a bool is deprecated", which made it look like a deprecated form of $exposeSecurityErrors; it now says which argument the bool is and where it comes from.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

d42ohpaz reacted with thumbs up emoji
All reactions
  • 👍 1 reaction
@webdevsamran
webdevsamran requested a review from chalasr as a code owner August 27, 2026 05:11
@carsonbot carsonbot added Status: Needs Review Bug Security labels Aug 27, 2026
@carsonbot carsonbot added this to the 8.2 milestone Aug 27, 2026
@carsonbot

carsonbot commented Aug 27, 2026

Copy link
Copy Markdown

Hey!

I see that this is your first PR. That is great! Welcome!

Symfony has a contribution guide which I suggest you to read.

In short:

  • Always add tests
  • Keep backward compatibility (see https://symfony.com/bc).
  • Bug fixes must be submitted against the lowest maintained branch where they apply (see https://symfony.com/releases)
  • Features and deprecations must be submitted against the 8.2 branch.

Review the GitHub status checks of your pull request and try to solve the reported issues. If some tests are failing, try to see if they are failing because of this change.

When two Symfony core team members approve this change, it will be merged and you will become an official Symfony contributor!
If this PR is merged in a lower version branch, it will be merged up to all maintained branches within a few days.

I am going to sit back now and wait for the reviews.

Cheers!

Carsonbot

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@webdevsamran @nicolas-grekas
[Security] Clarify AuthenticatorManager constructor docblock for depr…
2f83185
…ecated eraseCredentials argument
@nicolas-grekas nicolas-grekas modified the milestones: 8.2, 8.1 Aug 27, 2026
@nicolas-grekas
nicolas-grekas changed the base branch from 8.2 to 8.1 August 27, 2026 12:02
@nicolas-grekas
nicolas-grekas requested review from OskarStark, dunglas, jderusse, kbond, lyrixx, mtarld, welcoMattic, xabbuh and yceruto as code owners August 27, 2026 12:02
@nicolas-grekas
nicolas-grekas force-pushed the fix/authenticator-manager-deprecation-doc branch from 2bf1861 to 2f83185 Compare August 27, 2026 12:03
@nicolas-grekas nicolas-grekas added Status: Reviewed and removed Status: Needs Review labels Aug 27, 2026
@nicolas-grekas

nicolas-grekas commented Aug 27, 2026

Copy link
Copy Markdown
Member

Thank you for the fix, and welcome. I retargeted the PR to 8.1, where the deprecation and the docblock were introduced, and pushed the merge-ready version to your branch:

  • the @param lines keep the API types (ExposeSecurityLevel, string[]): the union types belong to the BC layer, not to the documented signature. The note now says which argument the bool is: Passing the removed "bool $eraseCredentials" as 6th argument (pre-8.1 signature) is deprecated since Symfony 8.1;
  • the description is rewritten: the argument was still present in 7.4 and deprecated in 8.1 (it was the eraseCredentials() method that 8.0 removed), and the header table now has the License row that the checks look for.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@nicolas-grekas

nicolas-grekas commented Aug 27, 2026

Copy link
Copy Markdown
Member

Thank you @webdevsamran.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@nicolas-grekas
nicolas-grekas merged commit 36f6f4c into symfony:8.1 Aug 27, 2026
11 of 13 checks passed

Uh oh!

There was an error while loading. Please reload this page.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chalasr chalasr Awaiting requested review from chalasr chalasr is a code owner
@xabbuh xabbuh Awaiting requested review from xabbuh
@lyrixx lyrixx Awaiting requested review from lyrixx
@mtarld mtarld Awaiting requested review from mtarld
@welcoMattic welcoMattic Awaiting requested review from welcoMattic
@kbond kbond Awaiting requested review from kbond
@dunglas dunglas Awaiting requested review from dunglas
@OskarStark OskarStark Awaiting requested review from OskarStark
@jderusse jderusse Awaiting requested review from jderusse
@yceruto yceruto Awaiting requested review from yceruto

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

Bug Security Status: Reviewed

Projects

None yet

Milestone

8.1

Development

Successfully merging this pull request may close these issues.

AuthenticatorManager::__construct() Incorrectly flags $eraseCredentials as deprecated when $exposeSecurityErrors is boolean

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@webdevsamran @carsonbot @nicolas-grekas
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.