OpenConext · johanib · Nov 20, 2025 · Nov 20, 2025 · Nov 24, 2025 · Nov 24, 2025
diff --git a/.github/workflows/test-integration.yml b/.github/workflows/test-integration.yml
@@ -22,4 +22,6 @@ jobs:
         run: composer install
 
       - name: Run QA tests
-        run: composer check
+        run: composer check-ci
+        env:
+          SYMFONY_DEPRECATIONS_HELPER: 999999
diff --git a/.gitignore b/.gitignore
@@ -1,4 +1,5 @@
 .idea
+.github/*.md
 /web/bundles/
 /web/app_dev.php
 /web/app_test.php

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,23 @@
 # Changelog
 
+# 7.0.0 - unreleased
+**Notable Changes**
+- Upgrade to Symfony 7.4 (from 6.4)
+- Upgrade to PHPUnit 10 (from 9.x)
+- Upgrade to PHPStan 2.0 (from 1.x)
+- Migrate from annotations to attributes (PHP 8 attributes)
+
+**Important for System Administrators**
+Ensure the `database_server_version` parameter contains the correct MariaDB version. e.g. `10.6.23-MariaDB`
+
+
+**Improvements**
+- Upgrade all Symfony components to 7.4
+- Upgrade Stepup-Bundle to 7.0
+- Modernize codebase with PHP 8+ features
+- Fix various Symfony and Doctrine deprecations
+- Improved code quality with updated tooling
+
 # 6.0.2
 - Repair deprovisioning API calls
 - Restore deprovisioned user on new login (returing users)

diff --git a/README.md b/README.md
@@ -7,19 +7,19 @@ This component is part of "Step-up Authentication as-a Service". See [Stepup-Dep
 
 ## Requirements
 
- * PHP 5.6+ or PHP7
+ * PHP 8.2
  * [Composer](https://getcomposer.org/)
  * A web server (Apache, Nginx)
- * MariaDB 10
+ * MariaDB 10.6
  * A working [Gateway](https://github.com/OpenConext/Stepup-Gateway)
 
 ## Installation
 
 Clone the repository or download the archive to a directory. Install the dependencies by running `composer install` and fill out the database credentials et cetera.
 
-Make sure to run database migrations using `bin/console middleware:migrations:migrate`.
+Make sure to run database migrations using `bin/console doctrine:migrations:migrate`.
 
-When using 'Stepup-Deploy' the 'deploy' entity manager should be used in order to use the correct credentials e.g. `bin/console middleware:migrations:migrate --em=deploy`
+When using 'Stepup-Deploy' the 'deploy' entity manager should be used in order to use the correct credentials e.g. `bin/console doctrine:migrations:migrate --em=deploy`
 
 ## Management API
 
@@ -31,6 +31,9 @@ Some of the configuration of the components is static (i.e. stored in parametere
 
 ## Development Notes
 
+### Technical debt
+ * https://github.com/broadway/event-store-dbal blocks upgrade to `doctrine/dbal:^4.0`
+
 ### Adding new events
 
 Whenever adding a new event, be sure to update `bin/config/events.yml`.

diff --git a/ci/qa/phpcs.xml b/ci/qa/phpcs.xml
@@ -6,10 +6,7 @@
     </description>
 
     <exclude-pattern>src/*/*Bundle/Resources</exclude-pattern>
-    <exclude-pattern>src/*/*Bundle/Tests</exclude-pattern>
     <exclude-pattern>src/*/Bundle/*Bundle/Resources</exclude-pattern>
-    <exclude-pattern>src/*/Bundle/*Bundle/Tests</exclude-pattern>
-    <exclude-pattern>*/Tests/*</exclude-pattern>
     <exclude-pattern>*/Migrations/*</exclude-pattern>
 
     <!-- This is the rule we inherit from. If you want to exlude some specific rules, see the docs on how to do that -->
@@ -21,5 +18,18 @@
             <property name="lineLimit" value="120"/>
             <property name="absoluteLineLimit" value="150"/>
         </properties>
+      <exclude-pattern>*/Tests/*</exclude-pattern>
     </rule>
+
+    <rule ref="PSR1.Methods.CamelCapsMethodName">
+      <exclude-pattern>*/Tests/*</exclude-pattern>
+    </rule>
+
+    <rule ref="SlevomatCodingStandard.Namespaces.ReferenceUsedNamesOnly"/>
+    <rule ref="SlevomatCodingStandard.Namespaces.UnusedUses">
+      <properties>
+        <property name="searchAnnotations" type="bool" value="true"/>
+      </properties>
+    </rule>
+    <rule ref="SlevomatCodingStandard.Namespaces.AlphabeticallySortedUses"/>
 </ruleset>
diff --git a/ci/qa/phplint.yaml b/ci/qa/phplint.yaml
@@ -1,6 +1,6 @@
 path: [./src, ./tests]
 jobs: 10
-cache: /var/qa/phplint.cache
+cache-dir: var/cache/qa/phpla int.cache
 extensions:
   - php
 exclude:

diff --git a/ci/qa/phpstan-baseline.neon b/ci/qa/phpstan-baseline.neon
diff --git a/ci/qa/phpstan.neon b/ci/qa/phpstan.neon
@@ -5,6 +5,7 @@ includes:
     - ../../vendor/phpstan/phpstan-symfony/extension.neon
 
 parameters:
+	treatPhpDocTypesAsCertain: false
 	level: 9
 	paths:
 		- ../../src
diff --git a/ci/qa/phpunit b/ci/qa/phpunit
@@ -7,5 +7,5 @@ cd $(dirname $0)/../../
 
 # PHPUnit Bridge should always be used in Symfony applications. (https://symfony.com/doc/current/components/phpunit_bridge.html)
 # This will create a phpunit executable in /bin/ instead of /vendor/bin/
-./vendor/bin/phpunit --configuration=ci/qa/phpunit.xml --coverage-text --stop-on-error $1
+./vendor/bin/phpunit --configuration=ci/qa/phpunit.xml --stop-on-error $@
 ./vendor/bin/phpunit --configuration=ci/qa/phpunit.xml --testsuite=database
diff --git a/ci/qa/phpunit.xml b/ci/qa/phpunit.xml
@@ -1,18 +1,19 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!-- https://phpunit.readthedocs.io/en/latest/configuration.html -->
-<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/9.3/phpunit.xsd" backupGlobals="false" colors="true" bootstrap="../../tests/bootstrap.php">
-  <coverage processUncoveredFiles="true">
-    <include>
-      <directory suffix="Test.php">../../src</directory>
-    </include>
-  </coverage>
+<phpunit
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/9.3/phpunit.xsd"
+    backupGlobals="false"
+    colors="true"
+    bootstrap="../../tests/bootstrap.php"
+    cacheDirectory="../../var/qa/phpunit.cache"
+>
   <php>
     <ini name="error_reporting" value="-1"/>
     <ini name="memory_limit" value="256M"/>
     <server name="APP_ENV" value="test" force="true"/>
     <server name="SHELL_VERBOSITY" value="-1"/>
     <server name="KERNEL_CLASS" value="\Surfnet\StepupMiddleware\Kernel"/>
-    <env name="SYMFONY_DEPRECATIONS_HELPER" value="999999"/>
     <env name="APP_ENV" value="test" force="true"/>
   </php>
   <testsuites>
@@ -23,8 +24,4 @@
       <directory suffix="Test.php">../../tests/database</directory>
     </testsuite>
   </testsuites>
-  <listeners>
-    <listener class="Symfony\Bridge\PhpUnit\SymfonyTestsListener"/>
-    <listener class="\Mockery\Adapter\Phpunit\TestListener"/>
-  </listeners>
 </phpunit>
diff --git a/ci/qa/rector.php b/ci/qa/rector.php
@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+use Rector\Config\RectorConfig;
+use Rector\Php74\Rector\Property\RestoreDefaultNullToNullableTypePropertyRector;
+use Rector\Php80\Rector\Class_\ClassPropertyAssignToConstructorPromotionRector;
+use Rector\Php81\Rector\Property\ReadOnlyPropertyRector;
+use Rector\Php82\Rector\Class_\ReadOnlyClassRector;
+
+return RectorConfig::configure()
+    ->withPaths([
+        __DIR__ . '/../../config',
+        __DIR__ . '/../../src',
+        __DIR__ . '/../../tests',
+        __DIR__ . '/../../templates',
+    ])
+    ->withPhpSets()
+    ->withAttributesSets(all: true)
+    ->withComposerBased(symfony: true, twig: true, doctrine: true, phpunit: true)
+    ->withTypeCoverageLevel(10)
+    ->withDeadCodeLevel(10)
+    ->withCodeQualityLevel(10)
+    ->withSkip([
+        ReadOnlyClassRector::class,
+        ReadOnlyPropertyRector::class,
+        ClassPropertyAssignToConstructorPromotionRector::class,
+        RestoreDefaultNullToNullableTypePropertyRector::class,
+    ]);
diff --git a/ci/qa/rector.sh b/ci/qa/rector.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env sh
+
+# Ensure we run from project root
+cd "$(dirname "$0")/../../" || exit 1
+./vendor/bin/rector --config=ci/qa/rector.php "$@"
diff --git a/component_info b/component_info
@@ -1,5 +1,5 @@
 PHP_VERSION=82
-SYMFONY_VERSION=6
+SYMFONY_VERSION=7
 ENCORE=no
 ASSETIC=no
 NODE_VERSION=20

diff --git a/composer.json b/composer.json
@@ -25,7 +25,7 @@
         "ext-pdo": "*",
         "broadway/broadway": "^2.5",
         "broadway/event-store-dbal": "^0.6",
-        "doctrine/annotations": "^2.0.2",
+        "doctrine/annotations": "^2.0",
         "doctrine/doctrine-bundle": "^2.13.2",
         "doctrine/doctrine-migrations-bundle": "^3.4.1",
         "doctrine/orm": "^3.3.2",
@@ -35,53 +35,58 @@
         "openconext/monitor-bundle": "^4.3.1",
         "pagerfanta/pagerfanta": "^4.7.1",
         "ramsey/uuid": "^4.7.6",
-        "surfnet/stepup-bundle": "^6.0.17",
-        "symfony/asset": "6.4.*",
-        "symfony/expression-language": "6.4.*",
+        "surfnet/stepup-bundle": "^7.0",
+        "symfony/asset": "7.4.*",
+        "symfony/expression-language": "7.4.*",
         "symfony/flex": "^2.4.7",
-        "symfony/form": "6.4.*",
-        "symfony/framework-bundle": "6.4.*",
-        "symfony/intl": "6.4.*",
-        "symfony/mailer": "6.4.*",
+        "symfony/form": "7.4.*",
+        "symfony/framework-bundle": "7.4.*",
+        "symfony/intl": "7.4.*",
+        "symfony/mailer": "7.4.*",
         "symfony/monolog-bundle": "^3.10",
-        "symfony/password-hasher": "6.4.*",
-        "symfony/runtime": "6.4.*",
-        "symfony/security-bundle": "6.4.*",
-        "symfony/translation": "6.4.*",
-        "symfony/twig-bundle": "6.4.*",
-        "symfony/validator": "6.4.*",
+        "symfony/password-hasher": "7.4.*",
+        "symfony/runtime": "7.4.*",
+        "symfony/security-bundle": "7.4.*",
+        "symfony/translation": "7.4.*",
+        "symfony/twig-bundle": "7.4.*",
+        "symfony/validator": "7.4.*",
         "twig/extra-bundle": "^3.20",
         "twig/intl-extra": "^3.20",
         "twig/twig": "^3.20"
     },
     "require-dev": {
-        "doctrine/data-fixtures": "^1.8.1",
-        "doctrine/doctrine-fixtures-bundle": "^3.7.1",
-        "liip/test-fixtures-bundle": "^2.9.2",
+        "doctrine/data-fixtures": "^2.2",
+        "doctrine/doctrine-fixtures-bundle": "^4.3",
+        "irstea/phpcpd-shim": "^6.0",
+        "liip/test-fixtures-bundle": "^3.6",
         "malukenho/docheader": "^1.1",
         "mockery/mockery": "1.7.x-dev",
-        "moontoast/math": "^1.2.1",
         "overtrue/phplint": ">=9.5.6",
         "phpmd/phpmd": "^2.15",
-        "phpstan/phpstan": "^1.11.x-dev",
-        "phpstan/phpstan-doctrine": "^1.5.7",
-        "phpstan/phpstan-mockery": "^1.1.3",
-        "phpstan/phpstan-symfony": "^1.4.13",
-        "phpunit/phpunit": "^9.6.22",
-        "rector/rector": "^1.2.10",
-        "sebastian/phpcpd": "^6.0.3",
-        "squizlabs/php_codesniffer": "^3.11.3",
-        "symfony/browser-kit": "6.4.*",
-        "symfony/phpunit-bridge": "^6.4.16",
-        "symfony/stopwatch": "6.4.*",
-        "symfony/web-profiler-bundle": "6.4.*"
+        "phpstan/phpstan": "^2.0",
+        "phpstan/phpstan-doctrine": "^2.0",
+        "phpstan/phpstan-mockery": "^2.0",
+        "phpstan/phpstan-symfony": "^2.0",
+        "phpunit/phpunit": "^10",
+        "rector/rector": "^2.2",
+        "slevomat/coding-standard": "^8.25",
+        "squizlabs/php_codesniffer": "^4",
+        "symfony/browser-kit": "7.4.*",
+        "symfony/phpunit-bridge": "7.4.*",
+        "symfony/stopwatch": "7.4.*",
+        "symfony/web-profiler-bundle": "7.4.*"
     },
     "scripts": {
         "auto-scripts": {
             "cache:clear": "symfony-cmd",
             "assets:install %PUBLIC_DIR%": "symfony-cmd"
         },
         "check": [
+          "@check-ci",
+          "@rector",
+          "composer audit"
+        ],
+        "check-ci": [
             "@phplint",
             "@phpmd",
             "@phpcs",
@@ -93,11 +98,13 @@
         "phplint": "./ci/qa/phplint",
         "phpmd": "./ci/qa/phpmd",
         "license-headers": "./ci/qa/docheader",
+        "rector":  "./ci/qa/rector.sh --dry-run",
+        "rector-fix":  "./ci/qa/rector.sh",
         "phpstan": "./ci/qa/phpstan",
         "phpcs": "./ci/qa/phpcs",
         "phpcbf": "./ci/qa/phpcbf",
         "phpcpd": "./ci/qa/phpcpd",
-        "phpunit": "./ci/qa/phpunit --",
+        "phpunit": "./ci/qa/phpunit",
 
         "post-install-cmd": [
             "Incenteev\\ParameterHandler\\ScriptHandler::buildParameters",
@@ -128,6 +135,7 @@
     },
     "config": {
         "allow-plugins": {
+            "dealerdirect/phpcodesniffer-composer-installer": true,
             "endroid/installer": false,
             "symfony/flex": true,
             "symfony/runtime": true
@@ -144,7 +152,7 @@
         },
         "symfony": {
             "allow-contrib": false,
-            "require": "6.4.*"
+            "require": "7.4.*"
         },
         "runtime": {
             "disable_dotenv": true