Summary of Changes

broken plugin provider:
79f439d#diff-1ef53f817b8a4f39b93b37580c846c5946c22b78f3e3c6c07d849524391dd6e4

changes lcobucci\jwt:
3.4.6: https://github.com/lcobucci/jwt/blob/3ef8657a78278dfeae7707d51747251db4176240/src/Parsing/Decoder.php#L50
4.3.0: https://github.com/lcobucci/jwt/blob/4d7de2fe0d51a96418c0d04004986e410e87f6b4/src/Encoding/JoseEncoder.php#L39

deprecation from webauthn-lib fixed

#Fields: datetime	priority clientip	category	message
2025-07-08T16:05:47+00:00	WARNING 127.0.0.1	deprecated	Since web-auth/metadata-service 4.5.0: The parameter "$clock" will become mandatory in 5.0.0. Please set a valid PSR Clock implementation instead of "null". - [ROOT]\libraries\vendor\symfony\deprecation-contracts\function.php - Line 25
2025-07-08T16:05:47+00:00	WARNING 127.0.0.1	deprecated	Since web-auth/webauthn-symfony-bundle 4.3.0: The parameter "$tokenBindingHandler" is deprecated since 4.3.0 and will be removed in 5.0.0. Please set "null" instead. - [ROOT]\libraries\vendor\symfony\deprecation-contracts\function.php - Line 25
2025-07-08T16:05:47+00:00	WARNING 127.0.0.1	deprecated	Since web-auth/webauthn-lib 4.5.0: Passing a Psr\Http\Message\ServerRequestInterface to the method `check` of the class "Webauthn\AuthenticatorAttestationResponseValidator" is deprecated since 4.5.0 and will be removed in 5.0.0. Please inject the host as a string instead. - [ROOT]\libraries\vendor\symfony\deprecation-contracts\function.php - Line 25
2025-07-08T16:05:47+00:00	WARNING 127.0.0.1	deprecated	Since web-auth/webauthn-lib 4.5.0: Passing a Psr\Http\Message\ServerRequestInterface to the method `createAuthenticatorAttestationResponseValidationSucceededEvent` of the class "Webauthn\AuthenticatorAttestationResponseValidator" is deprecated since 4.5.0 and will be removed in 5.0.0. Please inject the host as a string instead. - [ROOT]\libraries\vendor\symfony\deprecation-contracts\function.php - Line 25
2025-07-08T16:05:47+00:00	WARNING 127.0.0.1	deprecated	Since web-auth/webauthn-lib 4.5.0: Passing a Psr\Http\Message\ServerRequestInterface to the class "Webauthn\Event\AuthenticatorAttestationResponseValidationSucceededEvent" is deprecated since 4.5.0 and will be removed in 5.0.0. Please inject the host as a string instead. - [ROOT]\libraries\vendor\symfony\deprecation-contracts\function.php - Line 25
2025-07-08T16:05:52+00:00	WARNING 127.0.0.1	deprecated	Since web-auth/metadata-service 4.5.0: The parameter "$clock" will become mandatory in 5.0.0. Please set a valid PSR Clock implementation instead of "null". - [ROOT]\libraries\vendor\symfony\deprecation-contracts\function.php - Line 25
2025-07-08T16:05:52+00:00	WARNING 127.0.0.1	deprecated	Since web-auth/webauthn-lib 4.5.0: Passing a Psr\Http\Message\ServerRequestInterface to the method `check` of the class "Webauthn\AuthenticatorAssertionResponseValidator" is deprecated since 4.5.0 and will be removed in 5.0.0. Please inject the host as a string instead. - [ROOT]\libraries\vendor\symfony\deprecation-contracts\function.php - Line 25
2025-07-08T16:05:52+00:00	WARNING 127.0.0.1	deprecated	Since web-auth/webauthn-lib 4.5.0: Passing a Psr\Http\Message\ServerRequestInterface to the method `createAuthenticatorAssertionResponseValidationSucceededEvent` of the class "Webauthn\AuthenticatorAssertionResponseValidator" is deprecated since 4.5.0 and will be removed in 5.0.0. Please inject the host as a string instead. - [ROOT]\libraries\vendor\symfony\deprecation-contracts\function.php - Line 25
2025-07-08T16:05:52+00:00	WARNING 127.0.0.1	deprecated	Since web-auth/webauthn-lib 4.5.0: Passing a Psr\Http\Message\ServerRequestInterface to the class "Webauthn\Event\AuthenticatorAssertionResponseValidationSucceededEvent" is deprecated since 4.5.0 and will be removed in 5.0.0. Please inject the host as a string instead. - [ROOT]\libraries\vendor\symfony\deprecation-contracts\function.php - Line 25

Testing Instructions

• enable attestation support in plugin options
• add passkey (if possible different devices)
• rename passkey
• use passkey to login
• delete passkey

MFA

• use passkeys for multi-factor authentication (no attestation support)

Actual result BEFORE applying this Pull Request

attestation support not available

Expected result AFTER applying this Pull Request

attestation support works (description and icons are displayed if available)

Link to documentations

Please select:

• No documentation changes for docs.joomla.org needed
• No documentation changes for manual.joomla.org needed