Require mercure 0.6.2 and no publish abilities on client subscribe cookies

Author: silverbackdan

composer.json

@@ -87,7 +87,8 @@
         "symfony/dotenv": "^6.1",
         "symfony/http-client": "^6.1",
         "symfony/maker-bundle": "^1.0",
-        "symfony/mercure-bundle": "^0.3.4",
+        "symfony/mercure": "^0.6.2",
+        "symfony/mercure-bundle": "^0.3.5",
         "symfony/messenger": "^6.1",
         "symfony/monolog-bundle": "^3.8",
         "symfony/phpunit-bridge": "^6.1.3",

src/Mercure/MercureAuthorization.php

@@ -41,9 +41,7 @@ public function __construct(
     public function getAuthorizationCookie(): Cookie
     {
         $subscribeTopics = $this->getSubscribeTopics();
-        // TODO: await merge of https://github.com/symfony/mercure/pull/93 to remove ability to publish any updates and set to  null
-        // May also be able to await a mercure bundle update to set the cookie samesite in mercure configs
-        $cookie = $this->mercureAuthorization->createCookie($this->requestStack->getCurrentRequest(), $subscribeTopics, [], [], $this->hubName);
+        $cookie = $this->mercureAuthorization->createCookie($this->requestStack->getCurrentRequest(), $subscribeTopics, null, [], $this->hubName);
 
         return $cookie
             ->withSameSite($this->cookieSameSite)