[Spomky]

The backward compatibility audit of web-token/jwt-framework 4.3.x against 4.2.7 found changes that the migration guide (projects/jwt/4.3/docs/migration/from-v4.2-to-v4.3.md) did not mention, and one row that was wrong. This PR only touches that page.

Behaviour changes added

• Builders. Some errors are now reported by build(): the header, algorithm and key checks of JWEBuilder, and the b64 consistency of JWSBuilder. The messages are unchanged, and the classes are the ones thrown before or subclasses of them, so a try block around the whole sequence still catches them. A try block around the single call that used to throw no longer does.
• create(). It returns a new, empty builder and no longer empties the builder it is called on. $builder->create(); with the result ignored now keeps the earlier signatures or recipients.
• Loaders. The loaders of the library and of the bundle return the interfaces from getJwsVerifier(), getJweDecrypter() and getHeaderCheckerManager(). Nothing changes at runtime, but static analysers report calls to the deprecated methods.
• Key analyzer. AlgorithmAnalyzer adds a medium message to a key with alg: EdDSA.

Corrections

• Event dispatching services. The row of the deprecation summary said that the EventDispatching* decorators were already registered under the same service ids. In 4.3 the bundle still creates the deprecated Services classes; the decorators replace them in 5.0, as planned in 5.0.0: remove what 4.3 deprecated, seal what it announced web-token/jwt-framework#717.

Changes that depend on open PRs

These parts of the page only become true once the matching PR is merged into 4.3.x:

• fix(composer): require web-token/jwt-library ^4.3 in the bundle and experimental packages web-token/jwt-framework#820. Update the split packages together: the bundle and the experimental package require the library 4.3.
• fix(key-management): JKUFactory and X5UFactory extend UrlKeySetFactory again web-token/jwt-framework#821. JKUFactory and X5UFactory still extend UrlKeySetFactory in 4.3, without running its code, and stop extending it in 5.0.
• fix(bundle): keep the service ids of the library "none" and "RSA1_5" classes, deprecated web-token/jwt-framework#822. The bundle keeps the services of the library none and RSA1_5 classes, deprecated and untagged, like the experimental ES256K one.

Verification

• The builder and create() behaviours were checked with a probe on 4.2.7 and on 4.3.x (e39db7ef), and the analyzer message against the 4.3.x code.
• tools/build.py --strict --only jwt passes (342 pages), and the anchors used by the new links exist in the built page.