Composer package upgrades

[stwalkerster]

We should consider upgrading the following packages:

Semi-relevant but old information

---

• smarty/smarty => ^v4.2.0
• twbs/bootstrap => ^5.2
• fortawesome/font-awesome => ^6.2
• spomky-labs/otphp => ^v11.0
• wikimedia/common-passwords => ^v0.4
• league/commonmark => ^2.3

Some of these (wikimedia/common-passwords, league/commonmark) should be fairly straight-forward since they're used in very specific and easily-testable ways.

Others (spomky-labs/otphp) have security considerations, and need to be very well tested as well as ensuring existing TOTP codes work.

More still (smarty/smarty, fortawesome/font-awesome) are so ingrained into the UI of the tool that a change will require retesting pretty much every page in the tool.

Finally, twbs/bootstrap will have some major breaking changes, and will likely require substantial fiddling around with SCSS to do the upgrade.

---

Most of the minor upgrades will be dealt with by @dependabot. Some of the more major updates will require more work.

General list of additional work

Beta Give feedback

1. Bump phpunit/phpunit from 6.5.14 to 9.6.7 #789
   dependencies php +2
2. Smarty upgrade deprecates usage of PHP functions as modifiers #794
   good first issue +1
3. Upgrade twbs/bootstrap and all our custom styling built on top of it #797
   1 of 2
   actually quite difficult scss +2
4. Bump smarty/smarty from 3.1.48 to 4.3.1 #793
   dependencies +1
   
5. Bump wikimedia/common-passwords from 0.2.0 to 0.5.0 #790
   dependencies +1
6. Bump mediawiki/oauthclient from 1.2.0 to 2.0.0 #788
   dependencies +1
   
7. Bump fortawesome/font-awesome from 5.13.1 to 6.4.0 #787
   dependencies +1
   
8. U2F deprecation #796
   +0
9. Bump league/commonmark from 1.6.7 to 2.4.0 #801
   dependencies +1
10. Bump spomky-labs/otphp from 10.0.1 to 10.0.3 #798
    dependencies +1
    
11. Bump phpmd/phpmd from 2.10.2 to 2.13.0 #799
    dependencies +1
    
12. Bump bjeavons/zxcvbn-php from 1.2.0 to 1.3.1 #800
    dependencies +1
    
13. Bump squizlabs/php_codesniffer from 3.6.1 to 3.7.2 #802
    dependencies +1
    
14. Bump scssphp/scssphp from 1.8.1 to 1.11.0 #804
    dependencies +1
    
15. Pull in popper.js via npm #795
    dependencies +1

[methecooldude]

font-awesome should be easy enough, the fonts haven't really changed

[dqwiki]

Would creating a PR for this help so we can at least run through the existing tests in the system plus set it up on a dev server and start seeing what's broken?

[stwalkerster]

I don't think we should put all of these in one pull request, but having a series of PRs we can test is fine by me.

The four groups I listed above would make a good starting point so we're not creating thousands of PRs

[stwalkerster]

So I'm basically working through this list with the assistance of dependabot. I'll update the main description with the current status.

[stwalkerster]

I'm gonna close this as Dependabot has worked it's way through everything, except the ones that have different tasks opened.