Commits
Tarun Sukhani authored 6887a1976b6
refactor!: remove play.libs.OpenID
BREAKING CHANGE: play.libs.OpenID and its nested UserInfo are gone. Apps still
calling OpenID.id(...)/getVerifiedID()/isAuthenticationResponse() will not
compile against 1.13.49+.
OpenID 2.0 is defunct - the major providers retired it around 2015, and the
spec has had no maintenance since. The class had zero callers inside the
framework: it was opt-in API for a protocol that no longer has providers to
authenticate against.
It was also the source of four java/polynomial-redos alerts. The patterns
("<link[^>]+openid2[.]local_id[^>]+>" and three siblings) run over HTML fetched
from a remote discovery endpoint, so a hostile provider page could pin CPU
quadratically. Deleting dead code beats hardening regexes nobody executes.
Removed the manual sections in both languages plus their index/TOC entries.
Historical release notes (1.3.2, 1.4.0) mention OpenID as a record of what
shipped then and are deliberately left alone.
No dependency drops out - OpenID used only the JDK, commons-lang3 and Play
internals, all used elsewhere. Apps needing federated identity should use
play.libs.OAuth2, which stays.
ant test passes; ant javadoc is still error-free.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>