Update stripe-php from 17.6.0 to 21.2.1 #195

Merged

thatguygriff merged 2 commits from feature/194-stripe-php-21 into main 2026-08-25 02:18:36 +00:00

Conversation 0 Commits 2 Files Changed 3

+17 -11

thatguygriff commented 2026-08-25 02:15:24 +00:00

Owner

Copy Link

Copy Source

Addresses #194. No site is using Stripe yet and the integration has not been verified end to end, so the pinned API version can move now at close to zero cost — doing it later would mean coordinating with live payment traffic.

The change

composer.json	stripe/stripe-php ^17.0 → ^21.0
composer.lock	v17.6.0 → v21.2.1, the only package that moves
Pinned Stripe API version	→ 2026-07-29.dahlia

No PHP source changes were needed.

Why the surface held

The plugin uses four Stripe symbols, all in src/Payment/StripeGateway.php: StripeClient, paymentIntents->create, Webhook::constructEvent and Event. I checked each against the installed v21 by reflection — all present with compatible signatures.

Most of the breakage flagged across 18 → 21 is in the V2 Events API, which this plugin does not touch; webhooks go through the V1 Webhook::constructEvent path. The one change I expected to bite, 21.0.0 retyping ErrorObject properties to null|string, produces no new PHPStan findings — nothing here inspects error objects.

Verified beyond the test suite

The unit tests mock the Stripe client, so a green suite proves nothing about the SDK itself. Checked directly against v21:

• A real HMAC-signed payload round-trips through Webhook::constructEvent and returns a Stripe\Event with the expected type, id and nested data.object fields.
• A forged signature still raises SignatureVerificationException.
• composer build produces a zip carrying stripe-php 21.2.1 in its --no-dev vendor tree.

What is still not verified

The issue's acceptance criteria include a test-mode payment round-trip against Stripe, which I cannot run — it needs live test keys. That remains outstanding, which is why this is Part of #194 rather than Closes. It overlaps with the end-to-end verification the integration has not had yet, so it is best done as one pass rather than as a gate on this bump.

Changelog

## [1.5.5] was empty; this fills it. Written as what it means for a studio rather than as a version bump — behaviour is unchanged, and there is nothing for anyone to do.

Tests

• composer test — 966 tests, 2795 assertions, OK
• composer lint — no errors
• composer cs — clean
• composer validate — valid
• composer audit — no advisories
• composer build — zip builds, ships 21.2.1

Addresses #194. No site is using Stripe yet and the integration has not been verified end to end, so the pinned API version can move now at close to zero cost — doing it later would mean coordinating with live payment traffic. ## The change | | | |---|---| | `composer.json` | `stripe/stripe-php` `^17.0` → `^21.0` | | `composer.lock` | v17.6.0 → v21.2.1, the only package that moves | | Pinned Stripe API version | → `2026-07-29.dahlia` | No PHP source changes were needed. ## Why the surface held The plugin uses four Stripe symbols, all in `src/Payment/StripeGateway.php`: `StripeClient`, `paymentIntents->create`, `Webhook::constructEvent` and `Event`. I checked each against the installed v21 by reflection — all present with compatible signatures. Most of the breakage flagged across 18 → 21 is in the **V2 Events API**, which this plugin does not touch; webhooks go through the V1 `Webhook::constructEvent` path. The one change I expected to bite, 21.0.0 retyping `ErrorObject` properties to `null|string`, produces no new PHPStan findings — nothing here inspects error objects. ## Verified beyond the test suite The unit tests mock the Stripe client, so a green suite proves nothing about the SDK itself. Checked directly against v21: - A real HMAC-signed payload round-trips through `Webhook::constructEvent` and returns a `Stripe\Event` with the expected `type`, `id` and nested `data.object` fields. - A forged signature still raises `SignatureVerificationException`. - `composer build` produces a zip carrying stripe-php 21.2.1 in its `--no-dev` vendor tree. ## What is still not verified The issue's acceptance criteria include a **test-mode payment round-trip against Stripe**, which I cannot run — it needs live test keys. That remains outstanding, which is why this is `Part of #194` rather than `Closes`. It overlaps with the end-to-end verification the integration has not had yet, so it is best done as one pass rather than as a gate on this bump. ## Changelog `## [1.5.5]` was empty; this fills it. Written as what it means for a studio rather than as a version bump — behaviour is unchanged, and there is nothing for anyone to do. ## Tests - `composer test` — 966 tests, 2795 assertions, OK - `composer lint` — no errors - `composer cs` — clean - `composer validate` — valid - `composer audit` — no advisories - `composer build` — zip builds, ships 21.2.1

thatguygriff added 1 commit 2026-08-25 02:15:25 +00:00

Update stripe-php from 17.6.0 to 21.2.1 ... e2da45a1b0

Four majors behind on the plugin's only production dependency. No site is
using Stripe yet and the integration has not been verified end to end, so
the pinned API version can move now at close to zero cost — later it would
mean coordinating with live payment traffic.

The library surface this plugin uses is four symbols, all in StripeGateway:
StripeClient, paymentIntents->create, Webhook::constructEvent and Event.
Checked each against the installed v21 by reflection; all present with
compatible signatures. Most of the breakage flagged across 18 to 21 is in
the V2 Events API, which this does not use — webhooks go through the V1
Webhook::constructEvent path.

The pinned Stripe API version moves to 2026-07-29.dahlia.

Verified beyond the suite, which mocks the client: a real HMAC-signed
payload round-trips through Webhook::constructEvent and returns a
Stripe\Event with the expected type and data, and a forged signature still
raises SignatureVerificationException. The 21.0.0 ErrorObject retyping to
null|string produces no new PHPStan findings.

Part of #194

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01D9acV1mHktGAb1uyvNmrR2

thatguygriff added 1 commit 2026-08-25 02:17:36 +00:00

Date the Stripe changelog entry by version rather than by "current" ... 88a8d0ae5c

"the current Stripe library" is only true until Stripe ships the next major.
A changelog is read long after the release it describes, so name the
versions — 17 to 21, API version 2026-07-29.dahlia — and let those date the
entry.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01D9acV1mHktGAb1uyvNmrR2

thatguygriff merged commit 61a40f0e8d into main 2026-08-25 02:18:36 +00:00

thatguygriff deleted branch feature/194-stripe-php-21 2026-08-25 02:18:36 +00:00

thatguygriff referenced this pull request 2026-08-25 02:19:09 +00:00

Payments: migrate stripe-php from 17.6.0 to 21.x #194

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something isn't working

enhancement

Extends an existing feature

feature

New user-facing capability

payments

Billing, Stripe, receipts, reporting

security

Security vulnerability or hardening

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

Kydoimos (Kydoimos) thatguygriff (James Griffin-Allwood)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Unsupervised/unsupervised-scheduler#195