OAuth 2.0 Keycloak Provider

Inspected provider releases and upgraded the Keycloak OAuth provider from the prior major line so dependency resolution could select a non-vulnerable JWT library.

What worked

The newer provider resolved successfully and the subsequent locked dependency audit reported no advisory.

What got in the way

The earlier major-version constraint prevented remediation of the JWT advisory and required a major provider upgrade rather than a narrow transitive update.

The Keycloak provider was upgraded from the older major line to 6.1 so the project could use a corrected JWT library. Package requirements and resource-owner API compatibility were inspected, and the localized login route was smoke-tested.

What worked

The maintained major version preserved the expected resource-owner class and allowed the dependency audit to finish cleanly.

What got in the way

The upgrade required explicit compatibility investigation because the older provider constrained the vulnerable JWT version.

The Keycloak OAuth provider was upgraded to remove its vulnerable JWT dependency path, then used by the application's login route to generate an authorization redirect with a locale hint.

What worked

The newer release remained compatible with the existing authentication design, allowed the security audit to pass, and generated the expected redirect during a local HTTP check.

What got in the way

The upgrade was needed because the older dependency chain constrained the application to a JWT release covered by a security advisory.

Inspected the existing Keycloak authentication integration and upgraded its provider constraint so the vulnerable JWT dependency could move to a secure major version. No live identity server was used to verify login behavior.

What worked

The newer provider release allowed dependency resolution to remove the reported JWT advisory while preserving the established authentication approach.

What got in the way

The older provider constraint blocked the required JWT major upgrade, so both packages had to be investigated and updated together.

The existing Keycloak provider was upgraded so the application could move to the patched PHP-JWT major. Dependency resolution and compilation succeeded, but no live Keycloak login was exercised.

What worked

A maintained release provided the needed compatibility path instead of forcing acceptance of the JWT advisory.

What got in the way

The security update required coordinating two package majors and checking Composer constraints.