fix: remove deprecated eraseCredentials() — breaks logout on Symfony 8

[smbpunt]

Summary

• Remove empty eraseCredentials() method from CasUser
• Remove $security->getToken()?->eraseCredentials() call from Logout controller
• Remove now-unused Security dependency from Logout controller

Context

eraseCredentials() was deprecated in Symfony 7.3 and removed in 8.0. Since cas-bundle now supports Symfony 8 ("symfony/framework-bundle": "^7 || ^8"), the call in the Logout controller causes a fatal error, breaking logout entirely.

Ref: https://symfony.com/blog/new-in-symfony-7-3-security-improvements#deprecate-erasecredentials-method

[smbpunt]

Heads up — compatibility concern with this PR as-is.

Removing eraseCredentials() from the Logout controller fixes the SF8 fatal error, but removing it from CasUser breaks Symfony 7.x: UserInterface still declares eraseCredentials() in all 7.x versions (deprecated in 7.3, only removed from the interface in 8.0). Since composer.json declares "^7 || ^8", this would cause a fatal error for all SF7 users.

How would you like to handle this @drupol ? Should I adjust the PR, or do you prefer a different approach?

[drupol]

What's the best way to handle this ?

[smbpunt]

I reworked the PR. Here's what I propose:

• I'm keeping the change in the Logout controller. We remove the call to eraseCredentials(). It doesn't do anything useful anymore, so it's safe to remove on Symfony 6.4, 7, and 8.
• I'm putting the empty eraseCredentials() method back in CasUser. It's still needed on Symfony 6.4 and 7. On Symfony 8, it doesn't cause any harm, it just does nothing. It's dead code, but harmless.
• I added a comment on that method explaining why it's still there, and that it can be removed once we drop support for Symfony 6.4 and 7.

My recommendation: merge this as-is and tag it as 3.1.1. It's a bug fix on top of an already-tagged release, nothing more, so a patch version fits.

Separately, worth discussing: the bundle supports three major Symfony versions at once (6.4, 7, and 8). Looking at composer.json on this branch, require already sets symfony/framework-bundle to ^7 || ^8 — 6.4 is no longer installable as a main dependency, even though require-dev still lists it for some sub-packages. So 6.4 is already half-gone from the file, just not everywhere.

Might be worth planning a proper 6.4 drop soon, instead of leaving that inconsistency in place — it's exactly the kind of half-state that caused this bug. And with Symfony 8.2 landing in November, closing the gap with 8.x sooner rather than later would help avoid supporting three majors for much longer.

One more thought: this PR sat open for a while, so I get that everyone's busy. Maybe the next major version could just jump straight to Symfony 8 only. That would get rid of this whole eraseCredentials() mess for good, and give the bundle a clean start.

[smbpunt]

I pushed two more commits. Both remove a leftover Security argument from specs.

[drupol]

LGTM !

I'll push this further by Friday 21.

Thank you!