Add header sanitization and update dependencies

[adriaanzon]

Summary by CodeRabbit

• Security
  • Sanitized response header values to strip newline characters and prevent header injection.
  • Ensured only the approved x-sendy-* headers are exposed, with normalized values.
• Bug Fixes
  • Improved handling of revoked refresh-token responses while preserving existing token state.
  • Made the mock HTTP transport always provide a valid response for more reliable tests.
• Tests
  • Added/expanded coverage for header filtering and newline sanitization.
• Chores
  • Enabled automated weekly dependency updates and upgraded static analysis tooling.
  • Expanded CI to include PHP 8.5.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The SDK sanitizes Sendy response headers, tightens internal types, strengthens token refresh assertions, updates version handling, upgrades PHPStan, configures weekly dependency updates, and adds PHP 8.5 to the test matrix.

Changes

SDK hardening and maintenance

Layer / File(s)	Summary
Sanitized Sendy response headers src/Http/Response.php, tests/ConnectionTest.php	Response headers are normalized and stripped of CR/LF characters, with tests verifying filtered x-sendy-* headers and sanitized values.
Internal type contracts and token-flow validation src/Connection.php, src/Http/Transport/MockTransport.php, tests/ConnectionTest.php	The token callback and mock response use stricter types; user-agent expectations use Connection::VERSION, and revoked refresh-token handling asserts retained token values.
Release and tooling maintenance bump_version.sh, composer.json, .github/dependabot.yml, .github/workflows/tests.yml	Version validation accepts multi-digit patch values, PHPStan is upgraded to ^2.2, weekly dependency updates are configured, and PHP 8.5 is added to the test matrix.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main changes: header sanitization and dependency updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sanitize-sendy-headers

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/Http/Response.php`:
- Around line 103-107: Update normalizeHeaders() to validate each header name
against the HTTP token grammar before lowercasing or returning it, rejecting or
excluding malformed names containing carriage returns, line feeds, or other
non-token characters. Preserve normalization of valid headers and ensure invalid
names cannot reach Connection.php’s x-sendy- filter or public sendyHeaders.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 2d2498eb-3b9a-4740-84dc-668cc977c75d

📥 Commits

Reviewing files that changed from the base of the PR and between a43b17d and e905cf7.

📒 Files selected for processing (2)

• src/Connection.php
• src/Http/Response.php

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

tests/ConnectionTest.php (1)

260-263: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Avoid the five-second expiry window in this test.

The setup gives the existing token only five seconds of validity. A slow CI run can cross that deadline before checkOrAcquireAccessToken() handles the revoked refresh token, causing a false ClientException failure. Use a generous TTL such as time() + 3600.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/ConnectionTest.php` around lines 260 - 263, Update the token setup in
the test around checkOrAcquireAccessToken so the existing access token expires
at least an hour in the future, using a TTL such as time() + 3600 instead of the
current five-second window. Keep the revoked refresh-token behavior and
assertions for getAccessToken() and getRefreshToken() unchanged.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@bump_version.sh`:
- Line 20: Update the version validation regex in bump_version.sh to require
each numeric component to match 0 or a nonzero digit followed by digits, while
preserving multi-digit versions and the existing prerelease format. Apply the
same constraint to the version pattern in tests/ConnectionTest.php, and add
regression coverage rejecting versions such as 1.2.01.

---

Outside diff comments:
In `@tests/ConnectionTest.php`:
- Around line 260-263: Update the token setup in the test around
checkOrAcquireAccessToken so the existing access token expires at least an hour
in the future, using a TTL such as time() + 3600 instead of the current
five-second window. Keep the revoked refresh-token behavior and assertions for
getAccessToken() and getRefreshToken() unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 244cdddb-f06d-48ff-affd-3bdc911797d9

📥 Commits

Reviewing files that changed from the base of the PR and between 312114d and 872713d.

📒 Files selected for processing (2)

• bump_version.sh
• tests/ConnectionTest.php