Release 6.0.0

.github/workflows/changelog.yaml

@@ -18,7 +18,7 @@ jobs:
       fail-fast: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 2
 

.github/workflows/composer.yaml

@@ -44,7 +44,7 @@ jobs:
       matrix:
         prefer: [prefer-lowest, prefer-stable]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Create docker network
         run: |
@@ -58,7 +58,7 @@ jobs:
     strategy:
       fail-fast: false
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Create docker network
         run: |
@@ -73,7 +73,7 @@ jobs:
     strategy:
       fail-fast: false
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Create docker network
         run: |

.github/workflows/github_build_release.yml

@@ -16,7 +16,7 @@ jobs:
       APP_ENV: prod
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Create a release in GitHub
         run: gh release create ${{ github.ref_name }} --verify-tag --generate-notes

.github/workflows/markdown.yaml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Create docker network
         run: |

.github/workflows/php.yaml

@@ -15,7 +15,7 @@ jobs:
     name: PHP - Check Coding Standards
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Create docker network
         run: |
@@ -26,17 +26,50 @@ jobs:
           docker compose run --rm phpfpm vendor/bin/php-cs-fixer fix --dry-run --diff
 
   phpstan:
+    # Analysed on the highest supported PHP, not the default 8.3 service: Symfony 8.1
+    # requires PHP >= 8.4.1, so on 8.3 composer cannot install the Symfony 8 that
+    # composer.json advertises and the analysis never sees it. phpstan.neon pins the
+    # analysis to the declared php ^8.3 range, so the floor stays protected from here.
     name: PHPStan
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
+
+      - name: Create docker network
+        run: |
+          docker network create frontend
+
+      - run: |
+          docker compose run --rm phpfpm85 composer install
+          docker compose run --rm phpfpm85 vendor/bin/phpstan
+
+  phpstan-lowest:
+    # The declared dependency floor, analysed with current dev tooling. A plain
+    # --prefer-lowest also downgrades PHPUnit and phpstan-phpunit, and then nearly
+    # every error reported is an artefact of that rather than a statement about
+    # Symfony 6.4 — 29 of 30, when this was measured. Lowering only what `require`
+    # names keeps the analysis about the runtime the bundle claims to support.
+    #
+    # Runs on the PHP floor too, in the default 8.3 service, as the counterpart to the
+    # phpstan job's ceiling on 8.5.
+    #
+    # Analysis only: lowering the runtime packages drags shared Symfony components
+    # (finder, console) down with them, and php-cs-fixer built on those emits nonsense
+    # such as `previous : $e`. Never add a formatter to this job, and do not reuse the
+    # resulting vendor/ for anything but PHPStan.
+    name: PHPStan (lowest runtime dependencies)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
 
       - name: Create docker network
         run: |
           docker network create frontend
 
       - run: |
           docker compose run --rm phpfpm composer install
+          docker compose run --rm phpfpm sh -c \
+            'composer update --prefer-lowest --with-all-dependencies $(composer show --direct --no-dev --name-only)'
           docker compose run --rm phpfpm vendor/bin/phpstan
 
   unit-tests:
@@ -65,7 +98,7 @@ jobs:
             php: "8.5"
             prefer: prefer-stable
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Create docker network
         run: |
@@ -96,7 +129,7 @@ jobs:
             php: "8.3"
             prefer: prefer-stable
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Create docker network
         run: |

.github/workflows/yaml.yaml

@@ -31,7 +31,7 @@ jobs:
   yaml-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Create docker network
         run: |

CHANGELOG.md

@@ -7,6 +7,52 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [6.0.0] - 2026-08-25
+
+See [UPGRADE-6.0.md](UPGRADE-6.0.md).
+
+### Changed (BREAKING)
+
+- A failed OpenID Connect callback throws `AuthenticationFailedException` instead of
+  Symfony's `AuthenticationException`, so it escapes the firewall rather than
+  redirecting to the identity provider again. `CliLoginTokenAuthenticator` is
+  unchanged.
+- `getPrevious()` on that exception is the underlying OpenID Connect exception.
+- A callback is recognised only on the provider's callback path, not on any URL
+  carrying `state` and `code` (#63).
+- Each provider must declare `redirect_uri`, `redirect_route` or `callback_path`.
+
+### Added
+
+- `callback_path` per provider, for a proxy that rewrites the path without announcing
+  it.
+- `OpenIdLoginAuthenticator::getSupportedProviderKeys()`, to narrow an authenticator to
+  named providers. Defaults to all of them.
+- `OpenIdLoginAuthenticator::createTargetPathRedirect()`, returning the user to the
+  page that sent them to log in.
+- `?target_path=` on the login route, validated as a path within the application.
+- `OpenIdConfigurationProviderManager::getRedirectUriPaths()` and `isCallbackPath()`.
+
+### Changed
+
+- `client_secret_expires_at` remains optional, and the 5.1 deprecation for leaving it
+  unset is gone. Unset reports `unknown`; a value that is set must be a string and
+  parseable.
+- `UPGRADE-6.0.md` rewritten and linked from `README.md`.
+- Static analysis runs against both ends of the supported dependency range.
+- `actions/checkout` updated to v7.
+
+### Fixed
+
+- `logging_options.logger` no longer depends on bundle registration order.
+- `getContainerExtension()` no longer returns `mixed` on Symfony 6.4.
+
+### Removed (BREAKING)
+
+- `ItkOpenIdConnectBundleException`. Catch `OpenIdConnectBundleExceptionInterface`.
+- `UserDoesNotExistException`. Use Symfony's `UserNotFoundException`.
+- `symfony/deprecation-contracts` from `require`.
+
 ## [5.1.1] - 2026-08-19
 
 ### Fixed
@@ -281,7 +327,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `itk-dev/openid-connect` 1.0.0 to 2.1.0
 - OpenId Connect Bundle: Added CLI login feature.
 
-[unreleased]: https://github.com/itk-dev/openid-connect-bundle/compare/5.1.1...HEAD
+[unreleased]: https://github.com/itk-dev/openid-connect-bundle/compare/6.0.0...HEAD
+[6.0.0]: https://github.com/itk-dev/openid-connect-bundle/compare/5.1.1...6.0.0
 [5.1.1]: https://github.com/itk-dev/openid-connect-bundle/compare/5.1.0...5.1.1
 [5.1.0]: https://github.com/itk-dev/openid-connect-bundle/compare/5.0.0...5.1.0
 [5.0.0]: https://github.com/itk-dev/openid-connect-bundle/compare/4.2.0...5.0.0