[Security] Improve BC-layer to deprecate eraseCredentials methods

Author: nicolas-grekas

CHANGELOG.md

@@ -4,8 +4,7 @@ CHANGELOG
 7.3
 ---
 
- * Deprecate `LdapUser::eraseCredentials()`, use `LdapUser::setPassword(null)` instead
- * Add `EraseLdapUserCredentialsListener`
+ * Deprecate `LdapUser::eraseCredentials()` in favor of `__serialize()`
 
 7.2
 ---

Security/EraseLdapUserCredentialsListener.php

@@ -60,9 +60,15 @@ public function getUserIdentifier(): string
         return $this->identifier;
     }
 
+    /**
+     * @deprecated since Symfony 7.3
+     */
+    #[\Deprecated(since: 'symfony/ldap 7.3')]
     public function eraseCredentials(): void
     {
-        trigger_deprecation('symfony/security-core', '7.3', sprintf('The "%s()" method is deprecated and will be removed in 8.0, call "setPassword(null)" instead.', __METHOD__));
+        if (\PHP_VERSION_ID < 80400) {
+            @trigger_error(\sprintf('Method %s::eraseCredentials() is deprecated since symfony/ldap 7.3', self::class), \E_USER_DEPRECATED);
+        }
 
         $this->password = null;
     }
@@ -100,11 +106,9 @@ public function isEqualTo(UserInterface $user): bool
 
     public function __serialize(): array
     {
-        return [$this->entry, $this->identifier, null, $this->roles, $this->extraFields];
-    }
+        $data = (array) $this;
+        unset($data[\sprintf("\0%s\0password", self::class)]);
 
-    public function __unserialize(array $data): void
-    {
-        [$this->entry, $this->identifier, $this->password, $this->roles, $this->extraFields] = $data;
+        return $data;
     }
 }

Security/LdapUser.php

@@ -18,7 +18,6 @@
     "require": {
         "php": ">=8.2",
         "ext-ldap": "*",
-        "symfony/deprecation-contracts": "^2.5|^3",
         "symfony/options-resolver": "^6.4|^7.0"
     },
     "require-dev": {