Oauth2-server: Latest version of lcobucci/jwt is throwing deprecation messages breaking /oauth/token

[agwidarsito]

The standard "/oauth/token" route now longer works as the newly added deprecation messages are interrupting the flow, which were added in lcobucci/jwt at:

https://github.com/lcobucci/jwt/commit/5ce37ae2061942019e21ad5ef3af160cb5a4ad39

It's being tracked in that repository at:
https://github.com/lcobucci/jwt/issues/550

[seddighi78]

it just fixes with add this to the composer.josn:
"lcobucci/jwt": "3.3.1"

Edit: this is a temporary fix for this errors

[muhammad-zakir]

it just fixes with add this to the composer.josn:
"lcobucci/jwt": "3.3.1"

this should do as a temporary solution, but the latest version that won't break because of the exact same reason for now would be 3.3.3.

[lcobucci]

This is already being handled in #1146. Please check https://github.com/lcobucci/jwt/issues/550#issuecomment-733557709 for the rationale and suggestions on how to upgrade.

[Sephster]

I've now released version 8.2.0 of the oauth2-server package. If you are running PHP 7.3 or greater, you can install version 8.2.0 to resolve this issue. If you are below PHP 7.3, please ensure you have error notifications turned off on production as deprecation notices should not be turned on for production environments.

I hope this resolves your issues but if you have any follow up queries please do shout. Cheers

[guitar-freq]

Hello, I'm new to these kinds of issues & have read all this but the error is still there. I'd appreciate some more detail on how to fix this please. Make a change to some composer file somewhere and then what?
thanks.

[HenkPoley]

It is my understanding that these ought to fix the error:

"require": {
    "laravel/passport": "^9.4.0",
    "lcobucci/jwt": "3.4.2",
    "league/oauth2-server": "8.2.4"
}

Possibly some older, and maybe you don't use one of those (e.g. not using Laravel 👍). First check with composer show -i if these are packages you have installed.

[Sephster]

@guitar-freq can you upgrade to the latest version? If you can, you should.

If you aren't able to, you should turn off your deprecation notices on your production environment as these shouldn't be on. Which server do you use?