Update only the expiration field of the token

Because WP_Session_Tokens::update() overwrites the entire session object
in its datastore, the previous code was wiping out fields like IP
address and original login date as well as any custom data attached to
the token. This reads the original token data array so that only the exp
field is updated.

Author: goldenapples

src/Actions/Authentication.php

@@ -601,11 +601,17 @@ public function onShutdown(): void
                 /** This filter is documented in wp-includes/pluggable.php */
                 $expiration = apply_filters('auth_cookie_expiration', 14 * DAY_IN_SECONDS, $userId, true);
 
-                // Update the server-side session record (wp_set_auth_cookie does not do this
-                // when a token is supplied).
-                \WP_Session_Tokens::get_instance($userId)->update($token, [
-                    'expiration' => time() + $expiration,
-                ]);
+                // Update the expiration date in the server-side session record
+                // (wp_set_auth_cookie does not do this when a token is supplied).
+                $manager = \WP_Session_Tokens::get_instance( $userId );
+                $session = $manager->get( $token );
+
+                if ( ! is_array( $session ) ) {
+                    return;
+                }
+
+                $session['expiration'] = time() + $expiration;
+                $manager->update( $token, $session );
 
                 // Reissue the browser cookies with the same token and new expiration.
                 wp_set_auth_cookie($userId, true, '', $token);