V6 of `stevenmaguire/oauth2-keycloak` is here and it fixes a CVE caused by `firebase/php-jwt` < 7.0.0: https://github.com/stevenmaguire/oauth2-keycloak/tags Would be good to release a new version that fix #59 and this issue 🙏