[maximizeIT]

Goal: stop the PHP 8.4+ deprecation warning and get CI green again.

What and why

On PHP 8.4+, every request that loads PluginSession logs:

destroySession(): Implicitly marking parameter $sessionId as nullable is deprecated

No released version fixes this. The core change:

-    public function destroySession(String $sessionId = null): bool
+    public function destroySession(?string $sessionId = null): bool

SSOTokenGenerator::createSignedTokenFromData() gets the same fix (?Signer $signer).

CI on main is red: Composer blocks the test-only phpseclib/phpseclib ^2.0 because of security advisories. The tests only used it to create RSA keys; they now use ext-openssl and the dependency is gone. Supersedes #50.

Also: CI adds PHP 8.5, one test stops using null as an array key (deprecated in 8.5), version 3.0.2. No API or behaviour change.

How to test

Runs on PHP 8.5, shows any deprecation:

docker run --rm -v "$PWD":/app -w /app composer:2 sh -c 'composer install -q && php -d error_reporting=E_ALL vendor/bin/phpunit'

Locally on PHP 8.3, 8.4 and 8.5: 26 tests pass (2 skipped, as before), no deprecations, composer audit clean.

After merge

Please tag and release 3.0.2. CC Tech's plugins need it.

Created with OpenCode; AI wrote most of this change.

[Copilot]

🟢 Approval recommended

Static review found no blocking issues in these focused compatibility changes; automated tests were not run during this review.

No open issues 🎉

What changed in this PR

Updates the Staffbase PHP SDK for PHP 8.4 and 8.5 compatibility, removing deprecation warnings while preserving runtime behavior and preparing release 3.0.2.

Changes:

• Makes nullable parameters explicit in session handling, token generation, and test helpers.
• Replaces test-only phpseclib key generation with OpenSSL and removes null array keys from test data.
• Adds PHP 8.5 to CI and updates Composer metadata.

File	Description
test/​SSOTokenTest.php	Uses the shared OpenSSL key-pair helper.
test/​SSOTestData.php	Adds RSA key-pair generation using OpenSSL.
test/​SSOData/​SSODataTest.php	Preserves null test inputs without null array keys.
test/​PluginSessionTest.php	Uses shared key generation and explicit nullable parameters.
src/​SSOTokenGenerator.php	Makes the optional signer explicitly nullable.
src/​SessionHandling/​SessionHandlerTrait.php	Makes the optional session ID explicitly nullable.
composer.json	Removes phpseclib, simplifies the PHP constraint, and sets version 3.0.2.
.github/​workflows/​php.yml	Adds PHP 8.5 to the test matrix.

_{Review effort: Balanced}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Enterprise
• Run ID: ee259470-617a-4c51-b853-a5993e57fd20

📥 Commits

Reviewing files that changed from the base of the PR and between 483df95 and e6a08e8.

📒 Files selected for processing: 8

• .github/workflows/php.yml
• composer.json
• src/SSOTokenGenerator.php
• src/SessionHandling/SessionHandlerTrait.php
• test/PluginSessionTest.php
• test/SSOData/SSODataTest.php
• test/SSOTestData.php
• test/SSOTokenTest.php

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

Summary by CodeRabbit

• Updates

  • Updated the package to version 3.0.2.
  • Added PHP 8.5 to the versions checked by the automated compatibility workflow.
  • Updated PHP compatibility declarations to support PHP 8.3 and later within the 8.x series.

• Bug Fixes

  • Improved handling of optional values in session and token-related APIs, without changing their default behavior.

Walkthrough

The changes update PHP package metadata and nullable parameter declarations, and adjust test key-pair setup and role-case iteration. CI now includes PHP 8.5. No production outage path is indicated by these changes.

Changes

PHP package and test updates

Layer / File(s)	Summary
Package and runtime declarations .github/workflows/php.yml, composer.json, src/SSOTokenGenerator.php, src/SessionHandling/SessionHandlerTrait.php	The PHP CI matrix adds PHP 8.5. The package version changes to 3.0.2, and its PHP requirement changes to ^8.3. The optional Signer and session ID parameters are explicitly nullable.
Test key setup and role cases test/SSOTestData.php, test/PluginSessionTest.php, test/SSOTokenTest.php, test/SSOData/SSODataTest.php	Tests use SSOTestData::createKeyPair() for RSA keys. setupEnvironment declares nullable query parameters. Role test cases use pairs to keep null distinct from an empty string.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to e6a08

No actionable merge-blocking risk was identified in the reviewed changes; normal CI checks should still be run.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly summarizes the primary changes: PHP 8.4 and 8.5 support without deprecation warnings.
Description check		The description directly explains the nullable parameter fixes, test dependency removal, CI updates, and version change. The changes address deprecation warnings and test infrastructure, with no indic…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description directly explains the nullable parameter fixes, test dependency removal, CI updates, and version change. The changes address deprecation warnings and test infrastructure, with no indicated production outage path.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[Sono304]

LGTM