Version 10.0.0

Breaking

• A PHP release patched for PHP2Shell is required. The minimum PHP version is raised from 7.4 to "php": "~8.2.35 || ~8.3.36 || ~8.4.27 || >=8.5.12":

  • 8.2.35 or any later 8.2 release
  • 8.3.36 or any later 8.3 release
  • 8.4.27 or any later 8.4 release
  • 8.5.12 or later

  Composer refuses to install the SDK on PHP 7.4, 8.0 and 8.1 (end-of-life), and on releases affected by CVE-2026-109618 / CVE-2026-109619. See the PHP security advisory. If your Linux distribution has backported the fix but reports an older version number, install with composer install --ignore-platform-req=php, and only after confirming that your PHP build includes the fix.

• JWT library changed to firebase/php-jwt (^7.0), replacing adhocore/jwt (^1.1). The signatures of requestJWTUserToken() and requestJWTApplicationToken() are unchanged.

• JWT Grant now requires an RSA private key of at least 2048 bits. A shorter key throws DomainException: Provided key is too short before any request is sent. To check your key size, run openssl rsa -in private.key -noout -text | head -1.

Fixed

• Removed the deprecated utf8_decode() call from the Basic authorization header in generateAccessToken() and refreshAccessToken(). On PHP 8.2 and later it raised a deprecation warning on every call. The header value is unchanged.
• Added #[\ReturnTypeWillChange] to the ArrayAccess methods of the remaining model classes (TBD: confirm once the 32-model patch is merged), so the SDK loads with no PHP 8.1+ deprecation warnings.
• HTTP response header names are now lower-cased before lookup, so Content-Disposition is read correctly over HTTP/2. This keeps the v9.0.0 fix in the generator templates.

Changed

• Updated the README requirements and dependency list.
• Updated the SDK release version.