A maintenance release. Nothing changes for consumers except a wider brick/math range — the substance is a repair to dev-dependency constraints that were declared but broken, plus the CI job that will now catch that class of problem.
For consumers
brick/math now accepts ^0.18 || ^0.19 instead of only ^0.18. Nothing else changes; upgrading from 4.0.0 requires no action.
0.19.0 is purely additive (a RoundingMode::HalfOdd case and RoundingMode::fromNativeRoundingMode()), and this SDK uses neither. The range is widened rather than moved on purpose: BigDecimal is public API here via VatRate::getValue(), and for a 0.x package Composer treats ^0.18 and ^0.19 as mutually exclusive — so replacing the constraint would have locked out anyone pinned to 0.18 and forced a major release for a rounding mode nobody here calls.
The fix
Three require-dev lower bounds did not work at their floors on PHP 8.4:
| Constraint | Before | After |
|---|---|---|
php-vcr/php-vcr |
>=1.6.4 <1.12 |
>=1.8.1 <1.12 |
symfony/event-dispatcher |
^6.0 || ^7.0 |
^6.4.8 || ^7.1 |
symfony/event-dispatcher-contracts |
(transitive) | ^3.5 |
At their old floors, all three declare implicitly-nullable parameters — dispatch(object $event, string $eventName = null) and hasListeners(string $eventName = null). On PHP 8.4 that raises a deprecation, and ext-soap converts a deprecation raised during a call into a RequestException, which this client maps to ServiceUnavailableException. So the integration and network suites did not warn; they failed with a network error that had nothing to do with the network.
No released version was ever affected. All three are development dependencies and never reach a consumer's install.
Why it went unnoticed
config.lock is false, so there is no lockfile. Every CI run and every local install resolves each constraint to its ceiling, and nothing had ever installed the floor. A lower bound in this repository was an assertion, not a tested fact.
The new Tests (lowest deps) job resolves every constraint with --prefer-lowest --prefer-stable and runs the unit, integration and network suites against that set. It installs brick/math 0.18.0, php-vcr 1.8.1, event-dispatcher 6.4.8 and contracts 3.5.0, where the standard jobs install 0.19.0, 1.11.2, 7.4.15 and 3.7.1 — so the two legs genuinely exercise different dependency sets.
Full Changelog: v4.0.0...v4.1.0