|
| 1 | +# Firebase PHP-JWT |
| 2 | + |
| 3 | +Endless Lifecycle Support (ELS) for Firebase PHP-JWT from TuxCare provides security fixes for Firebase PHP-JWT library versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. |
| 4 | + |
| 5 | +## Supported Versions |
| 6 | + |
| 7 | +* **Firebase PHP-JWT** 6.11.1 |
| 8 | + |
| 9 | +Other versions upon request. |
| 10 | + |
| 11 | +## Connection to ELS for Firebase PHP-JWT Repository |
| 12 | + |
| 13 | +This guide outlines the steps needed to integrate the TuxCare ELS for Firebase PHP-JWT repository into your application. The repository provides trusted Firebase PHP-JWT library versions that can be easily integrated into your **Composer** projects. |
| 14 | + |
| 15 | +### Step 1: Get user credentials |
| 16 | + |
| 17 | +You need a username and password in order to use TuxCare ELS for Firebase PHP-JWT repository. Anonymous access is disabled. To receive the credentials, please contact [sales@tuxcare.com](mailto:sales@tuxcare.com). |
| 18 | + |
| 19 | +### Step 2: Configure Composer authentication |
| 20 | + |
| 21 | +1. Create or edit the `auth.json` file for the user running Composer: |
| 22 | + |
| 23 | + * **Linux/macOS**: |
| 24 | + |
| 25 | + <CodeWithCopy> |
| 26 | + |
| 27 | + ```text |
| 28 | + ~/.composer/auth.json |
| 29 | + ``` |
| 30 | +
|
| 31 | + </CodeWithCopy> |
| 32 | +
|
| 33 | + * **Windows**: |
| 34 | +
|
| 35 | + <CodeWithCopy> |
| 36 | +
|
| 37 | + ```text |
| 38 | + %APPDATA%\Composer\auth.json |
| 39 | + ``` |
| 40 | +
|
| 41 | + </CodeWithCopy> |
| 42 | +
|
| 43 | +2. Use either the Composer CLI or edit `auth.json` directly to add your credentials for `nexus.repo.tuxcare.com`. |
| 44 | +
|
| 45 | + <CodeTabs :tabs="[ |
| 46 | + { title: 'Composer CLI', content: `composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD` }, |
| 47 | + { title: 'auth.json', content: authjson } |
| 48 | + ]" /> |
| 49 | +
|
| 50 | + Replace `USERNAME` and `PASSWORD` with the credentials you received in [Step 1](#step-1-get-user-credentials). |
| 51 | +
|
| 52 | +### Step 3: Register the TuxCare repository |
| 53 | +
|
| 54 | +Add the `els_php_custom1` Composer repository either via CLI or by editing `composer.json`: |
| 55 | +
|
| 56 | + <CodeTabs :tabs="[ |
| 57 | + { title: 'Composer CLI', content: cli }, |
| 58 | + { title: 'composer.json', content: composerjson } |
| 59 | + ]" /> |
| 60 | +
|
| 61 | +### Step 4: Install Firebase PHP-JWT |
| 62 | +
|
| 63 | +Install the TuxCare-maintained Firebase PHP-JWT release that matches your project: |
| 64 | +
|
| 65 | +<CodeTabs :tabs="[ |
| 66 | + { title: 'Composer CLI', content: `composer require firebase/php-jwt:6.11.1-p1+tuxcare` }, |
| 67 | + { title: 'composer.json', content: pkgjson } |
| 68 | +]" /> |
| 69 | +
|
| 70 | +**Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** |
| 71 | +
|
| 72 | +If you edited `composer.json` manually, run `composer update` to install the package: |
| 73 | +
|
| 74 | +<CodeWithCopy> |
| 75 | +
|
| 76 | +```text |
| 77 | +composer update |
| 78 | +``` |
| 79 | + |
| 80 | +</CodeWithCopy> |
| 81 | + |
| 82 | +Composer will resolve dependencies against the TuxCare repository and install the patched releases. |
| 83 | + |
| 84 | +### Composer Repository Configuration |
| 85 | + |
| 86 | +If you encounter dependency resolution errors like: |
| 87 | + |
| 88 | +`packages from higher priority repository do not match your constraint` |
| 89 | + |
| 90 | +it usually means your project requires a package version that is not yet available in the TuxCare repository. |
| 91 | + |
| 92 | +**Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: |
| 93 | + |
| 94 | +<CodeWithCopy> |
| 95 | + |
| 96 | +``` |
| 97 | +{ |
| 98 | + "repositories": [ |
| 99 | + { |
| 100 | + "type": "composer", |
| 101 | + "url": "https://nexus.repo.tuxcare.com/repository/els_php_custom1/", |
| 102 | + "canonical": false |
| 103 | + } |
| 104 | + ] |
| 105 | +} |
| 106 | +``` |
| 107 | + |
| 108 | +</CodeWithCopy> |
| 109 | + |
| 110 | +This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. |
| 111 | + |
| 112 | +## Vulnerability Exploitability eXchange (VEX) |
| 113 | + |
| 114 | +VEX is a machine-readable format that tells you if a known vulnerability is actually exploitable in your product. It reduces false positives and helps prioritize real risks. |
| 115 | + |
| 116 | +TuxCare provides VEX for Firebase PHP-JWT ELS versions: [security.tuxcare.com/vex/cyclonedx/els_lang_php/firebase-php-jwt/](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/firebase-php-jwt/). |
| 117 | + |
| 118 | +## How to Upgrade to a Newer Version |
| 119 | + |
| 120 | +If you have already installed a TuxCare Firebase PHP-JWT package and want to upgrade to a newer release, update the version string in your `composer.json` file or run the `composer require` command with the new version: |
| 121 | + |
| 122 | +<CodeWithCopy> |
| 123 | + |
| 124 | +```text |
| 125 | +composer require firebase/php-jwt:VERSION-pN+tuxcare |
| 126 | +``` |
| 127 | + |
| 128 | +</CodeWithCopy> |
| 129 | + |
| 130 | +Then run `composer update` to apply the changes: |
| 131 | + |
| 132 | +<CodeWithCopy> |
| 133 | + |
| 134 | +```text |
| 135 | +composer update |
| 136 | +``` |
| 137 | + |
| 138 | +</CodeWithCopy> |
| 139 | + |
| 140 | +## Resolved CVEs in Firebase PHP-JWT |
| 141 | + |
| 142 | +Fixes for the following vulnerabilities are available in ELS for Firebase PHP-JWT from TuxCare: |
| 143 | + |
| 144 | +<TableTabs label="Choose a version: " > |
| 145 | + |
| 146 | +<template #Firebase_PHP-JWT_6.11.1> |
| 147 | + |
| 148 | +| CVE ID | Severity | Vulnerable versions | Fixed in version | |
| 149 | +|----------------|----------|---------------------|-----------------------| |
| 150 | +| CVE-2025-45769 | High | 6.11.1 | 6.11.1-p1+tuxcare | |
| 151 | + |
| 152 | +</template> |
| 153 | + |
| 154 | +</TableTabs> |
| 155 | + |
| 156 | +If you are interested in the TuxCare Endless Lifecycle Support, contact [sales@tuxcare.com](mailto:sales@tuxcare.com). |
| 157 | + |
| 158 | +<script setup> |
| 159 | + |
| 160 | +const authjson = |
| 161 | +`{ |
| 162 | + "http-basic": { |
| 163 | + "nexus.repo.tuxcare.com": { |
| 164 | + "username": "USERNAME", |
| 165 | + "password": "PASSWORD" |
| 166 | + } |
| 167 | + } |
| 168 | +}` |
| 169 | + |
| 170 | +const composerjson = |
| 171 | +`{ |
| 172 | + "repositories": [ |
| 173 | + { |
| 174 | + "type": "composer", |
| 175 | + "url": "https://nexus.repo.tuxcare.com/repository/els_php_custom1/", |
| 176 | + "options": { |
| 177 | + "http": { |
| 178 | + "verify": true |
| 179 | + } |
| 180 | + } |
| 181 | + } |
| 182 | + ] |
| 183 | +}` |
| 184 | + |
| 185 | +const cli = |
| 186 | +`composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php_custom1/","options":{"http":{"verify":true}}}' --json` |
| 187 | + |
| 188 | +const pkgjson = |
| 189 | +`{ |
| 190 | + "require": { |
| 191 | + "firebase/php-jwt": "6.11.1-p1+tuxcare" |
| 192 | + } |
| 193 | +}` |
| 194 | + |
| 195 | +</script> |
0 commit comments