Consider releasing 5.3 early?

[jasonvarga]

Hello 👋

Would you consider releasing 5.3 before you've completed the last couple of issues in the milestone?

We have a CMS package that uses yours as a dependency.

In #751 you introduced the new CredentialRecord class. We have some classes that typehint it, and it would be a breaking change for us to change it to a union (if someone was extending one of our classes).

Selfishly, it would be much better if we could just require 5.3 and use just the new class and not worry about unions.

Thanks!

[Spomky]

Hi @jasonvarga,

Indeed the union is not a good idea.
Please have a look at #804. This PR should help you and other developers.

[jasonvarga]

I'm blown away that you made that PR so quickly. Thank you!

tl;dr I'd still love if 5.3 could be released.

---

Not so sound ungrateful, but this still leaves us in the same situation. Excuse the lengthy response.

We were getting reports from our users who has their minimum-stability set to dev that they were getting 5.3 of webauth-framework installed, which was causing issues with the typehints.

Yes your PR would resolves that. But, we already made changes to target 5.3 - we updated the typehints to CredentialRecord. We figured since we were releasing a new major version of our package with webauthn support we might as well use the right things. From my understanding of the original change, PublicKeyCredentialSource is "wrong" (but works).

This resolved it for us, but now if users have minimum-stability of stable, they get 5.2 and it'll break again.

In hindsight, that was stupid of me. I thought we could force 5.3.

So, if you could release 5.3 ,that would selfishly solve our problems.
But – understandably – if not, we'd happily switch back to PublicKeyCredentialSource. (We are still in beta and don't mind changing a typehint)

I hope that all made sense. Thanks again.

[Spomky]

Hi @jasonvarga,

Thanks for the detailed explanation, I understand the situation better now.

However, I would advise against depending on unreleased code.
When minimum-stability is set to dev, you are essentially opting into unstable, work-in-progress code.

Also, I do not want to rush the 5.3 release.

As you mentioned the safest approach is to stick with PublicKeyCredentialSource in your package.
It is still fully functional and will remain available on 5.x.
Once 5.3 is officially released, you can migrate to CredentialRecord at your own pace (same properties).

Thanks for your understanding

[jasonvarga]

All good, I understand completely. Thanks.

[tomsommer]

Would also like to vote for a 5.3 release, as it's the only thing blocking me from upgrading to Symfony 8 at the moment :)