From e2da45a1b06e912b66efd6c1b2f6df09a9fcf94e Mon Sep 17 00:00:00 2001 From: James Griffin Date: Mon, 24 Aug 2026 23:15:01 -0300 Subject: [PATCH 1/2] Update stripe-php from 17.6.0 to 21.2.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Four majors behind on the plugin's only production dependency. No site is using Stripe yet and the integration has not been verified end to end, so the pinned API version can move now at close to zero cost — later it would mean coordinating with live payment traffic. The library surface this plugin uses is four symbols, all in StripeGateway: StripeClient, paymentIntents->create, Webhook::constructEvent and Event. Checked each against the installed v21 by reflection; all present with compatible signatures. Most of the breakage flagged across 18 to 21 is in the V2 Events API, which this does not use — webhooks go through the V1 Webhook::constructEvent path. The pinned Stripe API version moves to 2026-07-29.dahlia. Verified beyond the suite, which mocks the client: a real HMAC-signed payload round-trips through Webhook::constructEvent and returns a Stripe\Event with the expected type and data, and a forged signature still raises SignatureVerificationException. The 21.0.0 ErrorObject retyping to null|string produces no new PHPStan findings. Part of #194 Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01D9acV1mHktGAb1uyvNmrR2 --- CHANGELOG.md | 3 +++ composer.json | 2 +- composer.lock | 23 +++++++++++++---------- 3 files changed, 17 insertions(+), 11 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b3495fd..eef10e3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,9 @@ each change under the current top section as you work. ## [1.5.5] +### Changed +- **Payments now run on the current Stripe library.** The plugin had fallen four major versions behind Stripe's PHP SDK, which also meant it was asking Stripe to behave like an older version of its API. Taking a card payment and handling a webhook work exactly as before — the same charge is raised, the same events are honoured, and a forged webhook is still rejected — but the plugin now speaks Stripe's current API version, so later payment work does not have to clear this upgrade first. Nothing to do on your side. + ## [1.5.4] ### Fixed diff --git a/composer.json b/composer.json index fc0735b..8a2fbc2 100644 --- a/composer.json +++ b/composer.json @@ -5,7 +5,7 @@ "license": "GPL-2.0-or-later", "require": { "php": ">=8.1", - "stripe/stripe-php": "^17.0" + "stripe/stripe-php": "^21.0" }, "require-dev": { "phpunit/phpunit": "^10.5", diff --git a/composer.lock b/composer.lock index 444fa8c..132f9e2 100644 --- a/composer.lock +++ b/composer.lock @@ -4,32 +4,32 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "24094d05e029ee5534769a89f1dbad12", + "content-hash": "015f4bbb03f15362596d3a14aeca1582", "packages": [ { "name": "stripe/stripe-php", - "version": "v17.6.0", + "version": "v21.2.1", "source": { "type": "git", "url": "https://github.com/stripe/stripe-php.git", - "reference": "a6219df5df1324a0d3f1da25fb5e4b8a3307ea16" + "reference": "da798f6224c5ff6f89d8d78025044f418ee27db8" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/stripe/stripe-php/zipball/a6219df5df1324a0d3f1da25fb5e4b8a3307ea16", - "reference": "a6219df5df1324a0d3f1da25fb5e4b8a3307ea16", + "url": "https://api.github.com/repos/stripe/stripe-php/zipball/da798f6224c5ff6f89d8d78025044f418ee27db8", + "reference": "da798f6224c5ff6f89d8d78025044f418ee27db8", "shasum": "" }, "require": { "ext-curl": "*", "ext-json": "*", "ext-mbstring": "*", - "php": ">=5.6.0" + "php": ">=7.2.0" }, "require-dev": { - "friendsofphp/php-cs-fixer": "3.72.0", + "friendsofphp/php-cs-fixer": "3.94.0", "phpstan/phpstan": "^1.2", - "phpunit/phpunit": "^5.7 || ^9.0" + "phpunit/phpunit": "^8.0 || ^9.0" }, "type": "library", "extra": { @@ -38,6 +38,9 @@ } }, "autoload": { + "files": [ + "lib/version_check.php" + ], "psr-4": { "Stripe\\": "lib/" } @@ -61,9 +64,9 @@ ], "support": { "issues": "https://github.com/stripe/stripe-php/issues", - "source": "https://github.com/stripe/stripe-php/tree/v17.6.0" + "source": "https://github.com/stripe/stripe-php/tree/v21.2.1" }, - "time": "2025-08-27T19:32:42+00:00" + "time": "2026-08-20T21:06:13+00:00" } ], "packages-dev": [ -- 2.54.0 From 88a8d0ae5c57b595b6a8e79bd20e562e33fe4add Mon Sep 17 00:00:00 2001 From: James Griffin Date: Mon, 24 Aug 2026 23:17:33 -0300 Subject: [PATCH 2/2] Date the Stripe changelog entry by version rather than by "current" MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit "the current Stripe library" is only true until Stripe ships the next major. A changelog is read long after the release it describes, so name the versions — 17 to 21, API version 2026-07-29.dahlia — and let those date the entry. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01D9acV1mHktGAb1uyvNmrR2 --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index eef10e3..72d6477 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,7 +14,7 @@ each change under the current top section as you work. ## [1.5.5] ### Changed -- **Payments now run on the current Stripe library.** The plugin had fallen four major versions behind Stripe's PHP SDK, which also meant it was asking Stripe to behave like an older version of its API. Taking a card payment and handling a webhook work exactly as before — the same charge is raised, the same events are honoured, and a forged webhook is still rejected — but the plugin now speaks Stripe's current API version, so later payment work does not have to clear this upgrade first. Nothing to do on your side. +- **Payments moved up to version 21 of Stripe's PHP library**, from version 17. Being four major versions behind also meant asking Stripe to behave like an older version of its API; the plugin now uses API version `2026-07-29.dahlia`. Taking a card payment and handling a webhook are unchanged — the same charge is raised, the same events are honoured, and a forged webhook is still rejected. Nothing to do on your side. ## [1.5.4] -- 2.54.0