Skip to content

Update dependency zircote/swagger-php to v7 - #578

Open
renovate[bot] wants to merge 1 commit into
7.0from
renovate/zircote-swagger-php-7.x
Open

renovate[bot] wants to merge 1 commit into
7.0from
renovate/zircote-swagger-php-7.x

Conversation

@renovate

@renovate renovate Bot commented Oct 28, 2026 •

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
zircote/swagger-php ^6.4.0 → ^7.0.0 age confidence

Release Notes

zircote/swagger-php

v7.5.0

Compare Source

7.5 is about the messages spec and hybrid log. A problem that makes the document invalid, or loses something declared, is now an error, and every message follows one form. The Rector set also keeps the operations it used to lose where classic copied an attribute into several others.

Both message changes affect builds and tests that read the log. Changed output in 7.5 has the details.

Changed output

  • Spec and hybrid log an error, rather than a warning, where the document is invalid or something declared is lost. Such a build makes Result::isValid() false, and the CLI exits with 1. Classic type aliases and the array form of a security requirement log a notice (#​2375)
  • Spec and hybrid messages are reworded to start with what they are about and end with where it was declared. For example, Ref: dangling reference '#/components/schemas/Pet' - no such component now reads Reference "#/components/schemas/Pet" points to no component. A test matching log lines in full needs updating. Classic's messages are unchanged (#​2377)

New

  • The Rector set adds fan: Fan::All where classic copied an attribute into several others, such as one response beside both a Get and a Post. Spec used to skip such a method as an ambiguous merge. ->withSkip([FanOutRector::class]) turns it off (#​2372, docs)
  • Writing messages, the form and levels of spec pipeline messages, for contributors (#​2375)

What's Changed

Full Changelog: zircote/swagger-php@7.4.0...7.5.0

v7.4.0

Compare Source

7.4 is a fixes and performance release. Scanning no longer reads a class's source again for every property, which matters most on slow filesystems such as Docker Desktop bind mounts.

Two changes affect the generated document. Changed output in 7.4 has the details.

Changed output

  • A public property with neither a property nor a schema attribute no longer puts its class in components. Where nothing else adds the class, a type that used it is left out, with a warning (#​2361)
  • Classic: a docblock @example is cast by the property's type, so @example 1 on an int writes 1 rather than '1'. #[OA\Examples(value:)] keeps false and floats as given (#​2368)

New

  • Warnings for schema keywords dropped beside a $ref, under 3.0 and 3.1 (#​2362)
  • 3.0 schema warnings name where the schema was declared (#​2370)
  • Builder::createSpecification(), so a subclass can supply its own specification (#​2366)

Changed

  • Resolver::getTypedReflectors() is replaced by getPropertyTypes(). A subclass overriding it overrides getPropertyTypes() instead (#​2361, docs)

Performance

What's Changed

New Contributors

Full Changelog: zircote/swagger-php@7.3.0...7.4.0

v7.3.0

Compare Source

7.3 adds plugins: a library can ship its translators, resolvers and augmenters together with the wiring, and a project names the plugin rather than repeating that wiring. Plugins configure the spec pipeline and are not used in classic mode.

One change affects what a build reports. Changed output in 7.3 has the details.

Changed output

  • Result::isValid(), log(), warnings() and errors() include what the source scan, the resolvers and skipped classes log. An error logged there now makes isValid() false, as it already made the CLI exit with an error (#​2360)

New

  • Plugins. A class implementing Contracts\PluginInterface configures the builder through Builder\Hooks: the resolver, augmenters, mergers, attribute factory and contributions. The component namer, type resolver, compiler and version stay with whoever runs the build. Builder::withPlugins() takes plugin classes, classes mapped to their settings, or instances, and runs them in the order given. An invalid entry is skipped and logged as an error. On the command line, --plugin adds a plugin built without settings (#​2360, docs)
  • Logger in the constructor. new Builder($logger) takes the PSR-3 logger. A plugin implementing LoggerAwareInterface gets it (#​2360)

Changed

  • Builder::$logger holds, and Builder::getLogger() returns, a CollectingLogger that forwards to the logger the builder is given. A subclass assigning its own logger to $logger wraps it first, new CollectingLogger($logger). A subclass overriding getLogger() declares CollectingLogger as its return type (#​2360, docs)

Deprecated, removed in 8.0

  • Builder::setLogger(). Pass the logger to the constructor. What plugins log in withPlugins() before setLogger() is called does not reach the logger (#​2360)

Docs

  • The guide's "Changed output in 7.2" lists the changes from #​2335 (#​2359)

What's Changed

Full Changelog: zircote/swagger-php@7.2.0...7.3.0

v7.2.0

Compare Source

7.2 is about describing a class more than once, which 7.1 started. Each description now gets a name of its own, and a resolver can make one when a reference asks for it. Everything below applies to spec and hybrid mode. Classic mode is unchanged.

Two changes affect the generated document. Changed output in 7.2 has the details.

Changed output

  • A component whose key has qualifiers, and no explicit name, is named after its key: Author-groups.summary rather than Author. It used to take its class's name and clash with the plain component, so the document kept only one of them. Components without qualifiers keep their names (#​2345)
  • Parameters, response headers and inline schemas derived from a property take its docblock description. A component schema backed by a method no longer takes the method's description and deprecated (#​2335)

New

  • Resolving a key. A resolver implementing KeyResolverInterface is asked about a class plus its qualifiers, so a Schema\Ref with qualifiers no component has can have its description made on demand. KeyResolverTrait answers resolve() with resolveKey(). Resolvers that only know class names keep working, and are asked about references without qualifiers only (#​2346, docs)
  • Builder services by interface. The builder hands its component namer, attribute factory and type resolver to every augmenter, resolver and merger implementing ComponentNamerAwareInterface, AttributeFactoryAwareInterface or TypeResolverAwareInterface. One type resolver is shared by everything reading PHP types (#​2353, #​2354)
  • Builder::setTypeResolver(). A type resolver set on Types with setTypeResolver() is now replaced when the build runs. Set it on the builder instead (#​2357)
  • Walker. Walker::visit() takes a list of classes and visits each matching attribute once, and Walker::eachTypedAttribute() visits the properties, parameters and request bodies that Types types (#​2355, #​2358)

Fixes

  • A docblock type that type-info can read but not build, such as T&\Countable with an unbounded T, is logged as unsupported rather than ending the build (#​2352)
  • An empty media type or a security requirement naming no scheme compiles to {}, as OpenAPI requires. Also in 6.20.2 (#​2348)
  • Warnings from the compiler checks come in document order rather than grouped by attribute class (#​2358)

Changed

  • Spec\Header::$description defaults to Undefined::UNDEFINED, so an omitted description can be inferred and an explicit null suppresses it. Code checking the default with === null should use Undefined::isDefault() (#​2335)

Deprecated, removed in 8.0

  • ResolverInterface. Implement KeyResolverInterface, which extends it; a class name is the key without qualifiers. A resolver implementing ResolverInterface alone triggers a runtime deprecation naming its class (#​2347)

What's Changed

Full Changelog: zircote/swagger-php@7.1.0...7.2.0

v7.1.0

Compare Source

7.1 is about components: how they are named, how a class is matched to them, and which ones Cleanup keeps. Everything below applies to spec and hybrid mode. Classic mode is unchanged.

Two changes affect the generated document. Changed output in 7.1 has the details.

Changed output

  • A path parameter defaults to required: true, as OpenAPI requires. A path parameter set to anything else logs a warning (#​2338)
  • A class with more than one component in a bucket no longer stands for whichever was indexed last. A $ref given as the class, or a property typed with it, resolves to none of them and logs a warning. A property typed with a class that has a schema references the schema, not a component in another bucket (#​2342)

New

  • Component namer. Builder::setComponentNamer() and --component-namer choose how components without an explicit name are named. ShortName is the default, QualifiedName uses the whole class name, so two classes that share a short name no longer claim one name, and a custom namer implements ComponentNamerInterface (#​2341, docs)
  • Describing a class more than once. A component can carry a key of its class plus qualifiers, for example one per serialization group, and a Schema\Ref with the same qualifiers references it. In an augmenter, ComponentIndex::findByKey() and findAllByKey() look components up by key (#​2342, docs)
  • Keeping a component. Cleanup keeps a component whose meta value under Cleanup::class is false, referenced or not. The meta key is configurable as cleanup.metaKey (#​2339)
  • RefInterface. Every spec attribute with a ref implements Contracts\RefInterface, with getRefValue(), getRefKey() and setRef() (#​2343)

Fixes

The fixes from 6.20.1 are in 7.1 as well: #​2328, #​2330, #​2331, #​2333 and #​2334.

Deprecated, removed in 8.0

  • ComponentIndex::buildRefMap(). Use ComponentIndex::findByKey(), which takes the bucket a use means
  • OpenApi31Compiler::refString(). Use RefInterface::getRefValue() on the attribute that holds the ref

Docs

  • A cookbook recipe for building parts of a document to use in another one (#​2336)
  • openapi-json-schema is listed on the related projects page, and the openapi-router entry now says it reads spec attributes (#​2340, #​2332)

What's Changed

New Contributors

Full Changelog: zircote/swagger-php@7.0.0...7.1.0

v7.0.0

Compare Source

Hybrid is now the default mode, and spec attributes are stable. Classic attributes and docblock annotations still work, in hybrid and in classic mode. They are deprecated and removed in 8.0.

Builder is now the entry point for generating a document. In 6.x it was available next to Generator. With Generator deprecated, code that calls it directly moves to Builder.

For most installations upgrading does not require any code changes. Migrating to v7 covers the details.

The default mode

Without a mode set, the document is built in hybrid mode. Hybrid scans the same classic attributes and docblock annotations as classic, so for most projects the document stays the same. The known differences:

  • The output is OpenAPI 3.1.0 instead of 3.0.0. Builder::setVersion('3.0.0') or --version 3.0.0 keeps 3.0.0
  • Components that no path references are removed. cleanup.enabled set to false keeps them
  • A class docblock becomes the description of each schema declared on the class
  • properties declared beside allOf on a nested property stay beside it
  • -c takes augmenter keys rather than processor keys, apart from generator.*

Custom processors only see the annotation instances as scanned in hybrid mode. A project that depends on them can stay on classic with Builder::setMode(Mode::CLASSIC) or --mode classic while the processors are rewritten as augmenters.

Requirements

  • nikic/php-parser ^5.0
  • Symfony components ^5.4 || ^6.4 || ^7.0 || ^8.0

Removed

The elements deprecated for 7.0:

  • LegacyTypeResolver
  • The aliases left at the old names of TokenScanner, Pipeline, SourceFinder and TypeMapper
  • TypeResolverInterface::NATIVE_TYPE_MAP

Deprecated, removed in 8.0

  • Classic attributes and docblock annotations. The Rector set rewrites classic attributes to spec attributes
  • Processors, Generator, Analysis and the analysers. Augmenters and Builder replace them
  • Builder::setMode(), Mode and the CLI's --mode
  • Raw security arrays on spec attributes. SecurityToRequirementRector rewrites them

In 8.0 spec attributes move from OpenApi\Spec to OpenApi\Attributes. For code already written against OpenApi\Spec, that is one use line per file.

What's Changed

Full Changelog: zircote/swagger-php@6.20.0...7.0.0


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@codecov

codecov Bot commented Oct 28, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 64.64%. Comparing base (fbd96b3) to head (cea2d44).

Additional details and impacted files
@@            Coverage Diff            @@
##                7.0     #578   +/-   ##
=========================================
  Coverage     64.64%   64.64%           
  Complexity     1003     1003           
=========================================
  Files           181      181           
  Lines          3437     3437           
=========================================
  Hits           2222     2222           
  Misses         1215     1215           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@github-actions

github-actions Bot commented Oct 28, 2026 •

Copy link
Copy Markdown

Qodana for PHP

It seems all right 👌

No new problems were found according to the checks applied

💡 Qodana analysis was run in the pull request mode: only the changed files were checked
☁️ View the detailed Qodana report

Detected 109 dependencies

Third-party software list

This page lists the third-party software dependencies used in project

Dependency Version Licenses
brick/math 1.0.0 MIT
brick/varexporter 0.7.0 MIT
defuse/php-encryption v2.4.0 MIT
doctrine/collections 3.1.0 MIT
doctrine/common 3.5.0 MIT
doctrine/data-fixtures 2.2.1 MIT
doctrine/dbal 4.5.0 MIT
doctrine/deprecations 1.1.6 MIT
doctrine/event-manager 2.1.1 MIT
doctrine/inflector 2.1.1 MIT
doctrine/instantiator 2.1.0 MIT
doctrine/lexer 3.0.3 MIT
doctrine/migrations 3.9.8 MIT
doctrine/orm 3.7.6 MIT
doctrine/persistence 4.2.1 MIT
dotkernel/dot-cache 4.4.0 MIT
dotkernel/dot-cli 3.11.1 MIT
dotkernel/dot-data-fixtures 1.5.0 MIT
dotkernel/dot-dependency-injection 1.4.1 MIT
dotkernel/dot-errorhandler 4.0.2 MIT
dotkernel/dot-event 4.4.0 MIT
dotkernel/dot-log 4.0.6 MIT
dotkernel/dot-mail 5.4.3 MIT
dotkernel/dot-response-header 3.6.0 MIT
dotkernel/dot-router 1.1.0 MIT
egulias/email-validator 4.0.4 MIT
fig/http-message-util 1.1.5 MIT
laminas/laminas-authentication 2.19.0 BSD-3-Clause
laminas/laminas-cli 1.16.0 BSD-3-Clause
laminas/laminas-component-installer 3.8.0 BSD-3-Clause
laminas/laminas-config-aggregator 1.20.0 BSD-3-Clause
laminas/laminas-diactoros 3.10.0 BSD-3-Clause
laminas/laminas-escaper 2.18.0 BSD-3-Clause
laminas/laminas-eventmanager 3.15.0 BSD-3-Clause
laminas/laminas-filter 2.42.0 BSD-3-Clause
laminas/laminas-httphandlerrunner 2.14.0 BSD-3-Clause
laminas/laminas-hydrator 4.19.0 BSD-3-Clause
laminas/laminas-inputfilter 2.35.0 BSD-3-Clause
laminas/laminas-permissions-acl 2.18.0 BSD-3-Clause
laminas/laminas-permissions-rbac 3.8.0 BSD-3-Clause
laminas/laminas-servicemanager 3.24.0 BSD-3-Clause
laminas/laminas-stdlib 3.21.0 BSD-3-Clause
laminas/laminas-stratigility 4.3.1 BSD-3-Clause
laminas/laminas-validator 2.65.0 BSD-3-Clause
lcobucci/jwt 5.6.1 BSD-3-Clause
league/event 3.0.3 MIT
league/oauth2-server 9.4.1 MIT
league/uri-interfaces 7.10.0 MIT
league/uri 7.10.0 MIT
mezzio/mezzio-authentication-oauth2 3.1.0 BSD-3-Clause
mezzio/mezzio-authentication 1.13.0 BSD-3-Clause
mezzio/mezzio-authorization-acl 1.13.0 BSD-3-Clause
mezzio/mezzio-authorization-rbac 1.10.0 BSD-3-Clause
mezzio/mezzio-authorization 1.11.0 BSD-3-Clause
mezzio/mezzio-cors 1.16.0 BSD-3-Clause
mezzio/mezzio-fastroute 3.14.0 BSD-3-Clause
mezzio/mezzio-hal 2.14.0 BSD-3-Clause
mezzio/mezzio-helpers 5.20.0 BSD-3-Clause
mezzio/mezzio-problem-details 1.19.0 BSD-3-Clause
mezzio/mezzio-router 3.20.0 BSD-3-Clause
mezzio/mezzio-template 3.0.0 BSD-3-Clause
mezzio/mezzio 3.28.1 BSD-3-Clause
nikic/fast-route 1.3.1 BSD-3-Clause
nikic/php-parser v5.9.0 BSD-3-Clause
paragonie/random_compat v9.99.100 MIT
phpstan/phpdoc-parser 2.4.1 MIT
psr/cache 3.0.0 MIT
psr/clock 1.0.0 MIT
psr/container 1.1.2 MIT
psr/event-dispatcher 1.0.0 MIT
psr/http-client 1.0.3 MIT
psr/http-factory 1.1.0 MIT
psr/http-message 2.0 MIT
psr/http-server-handler 1.0.2 MIT
psr/http-server-middleware 1.0.2 MIT
psr/link 1.1.1 MIT
psr/log 3.0.2 MIT
radebatz/type-info-extras 1.0.12 MIT
ramsey/collection 2.1.1 MIT
ramsey/uuid-doctrine 2.1.0 MIT
ramsey/uuid 4.9.4 MIT
roave/psr-container-doctrine 6.2.0 BSD-2-Clause
spatie/array-to-xml 3.4.4 MIT
symfony/cache-contracts v3.8.1 MIT
symfony/cache v7.4.23 MIT
symfony/console v7.4.23 MIT
symfony/deprecation-contracts v3.8.1 MIT
symfony/event-dispatcher-contracts v3.8.1 MIT
symfony/event-dispatcher v8.1.5 MIT
symfony/filesystem v7.4.23 MIT
symfony/finder v8.1.11 MIT
symfony/mailer v7.4.22 MIT
symfony/mime v8.1.10 MIT
symfony/polyfill-ctype v1.37.0 MIT
symfony/polyfill-intl-grapheme v1.43.3 MIT
symfony/polyfill-intl-idn v1.43.0 MIT
symfony/polyfill-intl-normalizer v1.43.0 MIT
symfony/polyfill-mbstring v1.43.3 MIT
symfony/polyfill-php86 v1.43.0 MIT
symfony/service-contracts v3.8.1 MIT
symfony/stopwatch v8.1.0 MIT
symfony/string v8.1.10 MIT
symfony/type-info v8.1.11 MIT
symfony/var-exporter v7.4.22 MIT
symfony/yaml v8.1.11 MIT
webimpress/safe-writer 2.2.0 BSD-2-Clause
webmozart/assert 2.5.0 MIT
willdurand/negotiation 3.1.0 MIT
zircote/swagger-php 7.4.0 Apache-2.0
Contact Qodana team

Contact us at [email protected]

@renovate
renovate Bot force-pushed the renovate/zircote-swagger-php-7.x branch from be27b12 to 223a0e8 Compare October 31, 2026 02:08
@renovate
renovate Bot force-pushed the renovate/zircote-swagger-php-7.x branch from 223a0e8 to cea2d44 Compare November 8, 2026 13:27

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants