[dependabot]

Bumps zircote/swagger-php from 6.11.0 to 6.13.0.

Release notes

Sourced from zircote/swagger-php's releases.

6.13.0

A Rector set for moving to spec attributes

A new Rector set rewrites OpenApi\Attributes code to OpenApi\Spec. Pass it to Rector as --config vendor/zircote/swagger-php/rector/set/classic-to-spec.php. Renaming classes is not enough to migrate. Spec orders constructor parameters differently. Property, JsonContent and XmlContent no longer take schema keywords, which go in a nested schema: instead. So renamed code parses and then fails when the document is generated. The set first turns positional arguments into named ones, using the classic constructor's parameter names, and then renames the classes. It also lifts info:, servers:, tags: and externalDocs: off a root OpenApi into separate attributes, and moves schema keywords off Property, JsonContent and XmlContent into a nested schema:.

The set was run over two real codebases, one with 22 files of classic attributes and one with 354. Spec mode then generated the same document as classic for both. Migrating to spec attributes covers running it, the cases it leaves for you, and the code that drives the generator, which the set does not rewrite.

Spec and hybrid prune components, and now say so

In spec and hybrid mode, Cleanup removes every component that no path references, and it is on by default. It used to do this silently, so a schema kept only for client code generation disappeared from the document with no reason given. A run that removes anything now prints one notice on stderr, with the count and the setting that keeps them, cleanup.enabled=false.

That setting did not work in hybrid. -c went to the classic Generator, whose processors hybrid does not run, so every key except generator.* was silently ignored. Hybrid now sends generator.* to the Generator and every other key to the augmenters, so -c cleanup.enabled=false works. A hybrid key that no augmenter knows, such as -c operationId.hash=false, now prints an "Unknown config key" warning. It had no effect before either. See Behavioral differences.

Fixes in every mode

A $ref schema keeps its keywords

A property typed with a schema class compiles to a $ref, and keywords written on it, such as title or example, were dropped. Spec and hybrid kept only description. Classic writes a nullable $ref as a oneOf and kept everything on that oneOf. Beside a plain $ref in 3.1, it kept only description. title, default, example, examples, deprecated, readOnly and writeOnly are now kept in every mode, on the oneOf around a nullable $ref and beside a plain $ref in 3.1.

This changes 3.1 output for existing sources. A title or example declared beside a $ref now appears. In 3.0, the first of examples is written as example on the oneOf around a nullable $ref.

A list of scheme names is a security requirement

security: [['bearerAuth']], a list of scheme names instead of the [['bearerAuth' => []]] map, stopped hybrid and spec with a TypeError. Classic wrote it out as given, which is not a valid requirement. All three modes now read a bare scheme name as that scheme with no scopes.

Classic also wrote the optional requirement in a root security: [[]] as [] instead of {}. Root-level security now writes each requirement as an object, as operation-level security already did, so it comes out as [{}].

Spec and hybrid

A $ref is inferred only to a component

When a property's PHP type is a class, spec and hybrid added a $ref to it even when the class had no #[Schema]. The document then carried a class name that resolves to nothing, such as $ref: Brick\Math\BigInteger. The same inference replaced an explicit enum on a property typed with a backed enum, so the case values were lost. A $ref is now inferred only to a class that is a component, and never where enum is set. Classic, hybrid and spec now give the same output for both.

A class that fails while being resolved is skipped

Since 6.10, a class whose attributes fail to instantiate is skipped with a warning when the scan reaches it. Reached through a reference from another class, the same class ended the run with no document. Which way it was reached first depended on scan order. Both ways now skip the class with the same warning, and the run continues.

Spec pipeline

Folding two halves of one operation

By default, the later of two operations on the same path and method replaces the earlier one whole. When a route table contributed through withSpecification() and an attribute both describe an operation, the attribute has to repeat everything the route gave. Merge\Operations folds the two instead. It takes what only one half sets, and folds parameters by name and location and responses by status code. Merge\Mode decides who wins where both set the same field. A field both halves set to different values is logged as a warning.

It is opt-in, so nothing changes until you register it with Builder::withMergers(), ahead of the default Merge\LastWins, which claims every type: $mergers->insert(new Merge\Operations(), Merge\LastWins::class). A new Parameters augmenter, on by default, gives a ref parameter its component's name and location before the merge runs. That way a ref parameter and an inline one for the same name and location fold into one, and the reference is what survives. See Mergers.

For packages built on a Specification

Several things a package needed to copy from the augmenters are now public:

• PathItemHierarchy::prefixFor() and pathFor() give the prefix an operation's #[PathItem] chain composes to, and the operation's full path. pathFor() reads the path as declared, so calling it after the PathItems augmenter has run adds the prefix twice.

... (truncated)

Commits

• 6cbca4b feat(Specification): list the parameters a PathItem chain declares for an ope...
• e5494e4 feat(Augmenter): give a ref parameter the name and location of its component ...
• 6db29a0 feat(Utils): name the method a source location is in as Class::method (#2243)
• 590256f feat(Specification): compose an operation's path prefix in PathItemHierarchy ...
• 4821b5a fix(Schema): keep a $ref schema's annotations instead of only its description...
• 292e351 docs(Writing): add a voice section, and rewrite the page in it (#2236)
• c041b2c docs(Dev): rewrite the contributor pages and ADRs in plain sentences (#2241)
• b1aca4d docs(Guide): take the em dashes and semicolons out of the remaining guide pag...
• 1090fb6 docs(Guide): rewrite the extension points and migration guides in plain sente...
• 9b4dbac docs(Guide): rewrite the spec attributes guide in plain sentences (#2238)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)