oauth2 authentication auth plugin deprecated / replaced by oauth2_client

Summary

The oauth2 authentication plugin has been deprecated and replaced by a new oauth2_client plugin.

The old plugin depended on sainsburys/guzzle-oauth2-plugin, which has a known security vulnerability CVE-2025-45769 via its transitive dependency on firebase/php-jwt. That library is also effectively unmaintained. The new oauth2_client plugin uses the actively maintained league/oauth2-client library, which does not carry this vulnerability.

Affected configuration

Any migration that uses plugin: oauth2 under authentication: in its source configuration.

Before

  source:
    plugin: url
    data_fetcher_plugin: http
    authentication:
      plugin: oauth2
      grant_type: client_credentials
      base_uri: https://login.example.com
      client_id: my-client-id
      client_secret: my-client-secret
      token_url: /oauth2/token
      scope: https://api.example.com/

After

  source:
    plugin: url
    data_fetcher_plugin: http
    authentication:
      plugin: oauth2_client
      grant_type: client_credentials
      provider_options:
        clientId: my-client-id
        clientSecret: my-client-secret
        urlAuthorize: https://login.example.com/oauth2/authorize
        urlResourceOwnerDetails: https://login.example.com/oauth2/resource
        urlAccessToken: https://login.example.com/oauth2/token
      grant_options:
        scope: https://api.example.com/

TLDR;

1. Replace plugin: oauth2 with plugin: oauth2_client in your migration source configuration.
2. Update the authentication options to use the provider_options and grant_options keys as shown above. The provider_options keys follow the
league/oauth2-client GenericProvider constructor parameter names.
3. Remove sainsburys/guzzle-oauth2-plugin from your project's composer.json if it is no longer needed.
4. Run composer require league/oauth2-client if it is not already a dependency.