[Bug]: PHP 8.4 Deprecation: Implicitly marking parameter $expected as nullable in spomky-labs/pki-framework

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

PHP 8.4 Deprecation Warning: Implicitly marking parameter $expected as nullable is deprecated in spomky-labs/pki-framework (3rdparty)

While using Nextcloud 33.0.2 on a system with PHP 8.4, a deprecation warning is triggered during WebAuthn authentication.
The issue stems from the bundled library 'spomky-labs/pki-framework' which is currently at version 1.2.1 in the 3rdparty directory.

Error log:
SpomkyLabs\Pki\ASN1\Component\Length::expectFromDER(): Implicitly marking parameter $expected as nullable is deprecated, the explicit nullable type must be used instead at /var/www/nextcloud/3rdparty/spomky-labs/pki-framework/src/ASN1/Component/Length.php#92

Steps to reproduce

1. Set up Nextcloud 33.0.2 on a server with PHP 8.4 (e.g., using the official Docker image or a manual install with Apache/PHP-FPM).
2. Ensure OPcache or APCu is enabled (default in most production setups).
3. Restart the web server or the PHP service (e.g., apachectl restart or systemctl restart php-fpm) to clear the bytecode cache.
4. Perform a login using WebAuthn or interact with PKI-related features.
5. Check the logs: the deprecation warning regarding 'spomky-labs/pki-framework' will appear immediately.

Expected behavior

Nextcloud should be fully compatible with PHP 8.4 without triggering deprecation warnings.
Specifically, the bundled 'spomky-labs/pki-framework' library in the 3rdparty directory should be updated to a version that explicitly declares nullable types (using the '?' prefix), as required by PHP 8.4 syntax.

The logs should remain clean during login and WebAuthn operations.

Nextcloud Server version

33

Operating system

Other

PHP engine version

PHP 8.4

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 31 to 32)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "33.0.2.2",
        "overwrite.cli.url": "https:\/\/my-domain.net",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "overwritehost": "my-domain.net",
        "overwriteprotocol": "https",
        "overwritewebroot": "\/nextfiles",
        "forwarded_for_headers": [
            "HTTP_X_FORWARDED_FOR",
            "HTTP_X_REAL_IP"
        ],
        "default_phone_region": "IT",
        "maintenance_window_start": 3,
        "maintenance": false,
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "data-fingerprint": "b2d0ad79663dc913ca9b7c5089ca2e15",
        "mail_smtpmode": "smtp",
        "mail_smtpsecure": "ssl",
        "mail_sendmailmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauth": true,
        "mail_smtpport": "465",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "twofactor_enforced": "true",
        "twofactor_enforced_groups": [],
        "twofactor_enforced_excluded_groups": [],
        "enabledPreviewProviders": [
            "OC\\Preview\\PNG",
            "OC\\Preview\\JPEG",
            "OC\\Preview\\GIF",
            "OC\\Preview\\BMP",
            "OC\\Preview\\XBitmap",
            "OC\\Preview\\MP3",
            "OC\\Preview\\TXT",
            "OC\\Preview\\MarkDown",
            "OC\\Preview\\PDF",
            "OC\\Preview\\SVG",
            "OC\\Preview\\Font",
            "OC\\Preview\\HEIC",
            "OC\\Preview\\Movie",
            "OC\\Preview\\MSOfficeDoc",
            "OC\\Preview\\MSOffice2003",
            "OC\\Preview\\MSOffice2007",
            "OC\\Preview\\OpenDocument",
            "OC\\Preview\\Krita",
            "OC\\Preview\\Image"
        ],
        "theme": "",
        "loglevel": 2,
        "memories.db.triggers.fcu": true,
        "memories.exiftool": "\/var\/www\/nextcloud\/apps\/memories\/bin-ext\/exiftool-aarch64-musl",
        "memories.vod.path": "\/share\/nextfiles\/apps_custom\/memories\/bin-ext\/go-vod-aarch64",
        "memories.vod.ffmpeg": "\/usr\/bin\/ffmpeg",
        "memories.vod.ffprobe": "\/usr\/bin\/ffprobe",
        "memories.exiftool_no_local": true,
        "app_install_overwrite": [],
        "apps_paths": [
            {
                "path": "\/var\/www\/nextcloud\/apps2",
                "url": "\/apps2",
                "writable": true
            },
            {
                "path": "\/var\/www\/nextcloud\/apps",
                "url": "\/apps",
                "writable": false
            }
        ],
        "memories.gis_type": 1,
        "session_lifetime": 86400,
        "session_keepalive": true,
        "debug": false,
        "log_type": "file",
        "logfile": "\/share\/nextfiles\/data\/nextcloud.log",
        "snowflake.server_id": 603,
        "tempdirectory": "\/share\/nextfiles\/tmp",
        "serverid": 1,
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379,
            "password": "***REMOVED SENSITIVE VALUE***"
        },
        "trusted_domains": [
            "my-domain.net",
            "localhost"
        ],
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***"
    }
}

List of activated Apps

Enabled:
  - activity: 6.0.0
  - bruteforcesettings: 6.0.0
  - cloud_federation_api: 1.17.0
  - comments: 1.23.0
  - contacts: 8.4.4
  - contactsinteraction: 1.14.1
  - dashboard: 7.13.0
  - dav: 1.36.0
  - federatedfilesharing: 1.23.0
  - federation: 1.23.0
  - files: 2.5.0
  - files_downloadlimit: 5.1.0
  - files_pdfviewer: 6.0.0
  - files_reminders: 1.6.0
  - files_sharing: 1.25.2
  - files_trashbin: 1.23.0
  - files_versions: 1.26.0
  - firstrunwizard: 6.0.0
  - logreader: 6.0.0
  - lookup_server_connector: 1.21.0
  - memories: 8.0.1
  - nextcloud_announcements: 5.0.0
  - notifications: 6.0.0
  - oauth2: 1.21.0
  - password_policy: 5.0.0
  - photos: 6.0.0
  - privacy: 5.0.0
  - profile: 1.2.0
  - provisioning_api: 1.23.0
  - recommendations: 6.0.0
  - related_resources: 4.0.0
  - serverinfo: 5.0.0
  - settings: 1.16.0
  - sharebymail: 1.23.0
  - support: 5.0.0
  - survey_client: 5.0.0
  - suspicious_login: 11.0.0
  - systemtags: 1.23.0
  - text: 7.0.0
  - theming: 2.8.0
  - twofactor_backupcodes: 1.22.0
  - twofactor_nextcloud_notification: 7.0.0
  - twofactor_totp: 15.0.0
  - updatenotification: 1.23.0
  - user_status: 1.13.0
  - viewer: 6.0.0
  - weather_status: 1.13.0
  - webhook_listeners: 1.5.0
  - workflowengine: 2.15.0
Disabled:
  - admin_audit: 1.23.0
  - app_api: 33.0.0 (installed 32.0.0)
  - circles: 33.0.0 (installed 32.0.0)
  - encryption: 2.21.0
  - files_external: 1.25.1
  - testing: 1.23.0
  - user_ldap: 1.24.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

{"reqId":"oftAD7BVzlZ6TloJZX9S","level":3,"time":"2026-04-12T13:07:19+00:00","remoteAddr":"***REMOVED***","user":"***REMOVED***","app":"PHP","method":"POST","url":"/nextfiles/index.php/login/webauthn/finish","scriptName":"/nextfiles/index.php","message":"SpomkyLabs\\Pki\\ASN1\\Component\\Length::expectFromDER(): Implicitly marking parameter $expected as nullable is deprecated, the explicit nullable type must be used instead at /var/www/nextcloud/3rdparty/spomky-labs/pki-framework/src/ASN1/Component/Length.php#92","userAgent":"***REMOVED***","version":"33.0.2.2","data":{"app":"PHP"}}

Additional info

Operating system: Running inside a Docker container (Alpine Linux 3.23) as a Home Assistant Add-on.

Start with 3rdparty/spomky-labs/pki-framework/src/ASN1/Component/Length.php at line 92 and inspect how version 1.2.1 is bundled. Reproduce a WebAuthn login under PHP 8.4, then verify the dependency update or compatibility fix removes the deprecation warning from the logs.