fix(deps): update dependency psr/http-message to v2 (next)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
psr/http-message	^1.0 → ^2.0

---

Release Notes

php-fig/http-message (psr/http-message)

v2.0

Compare Source

Added return types, see https://www.php-fig.org/psr/psr-7/meta/#​72-type-additions

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • Between 12:00 AM and 04:59 AM (* 0-4 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[ThomasAFink]

@coderabbitai what should we test here?

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

Let me explore the codebase to understand what's impacted by this dependency change.

---

🏁 Script executed:

#!/bin/bash
# Find all composer.json files
fd -e json -n composer.json --exec echo {}

echo "---"

# Find usages of PSR-7 HTTP message interfaces
rg -rn "psr/http-message|Psr\\\\Http\\\\Message|ServerRequestInterface|RequestInterface|ResponseInterface|StreamInterface|UriInterface|MessageInterface" --type php -l

echo "---"

# Look at all composer.json files for psr/http-message dependency
fd -e json -n composer.json --exec grep -l "http-message" {}

Length of output: 19484

---

🏁 Script executed:

#!/bin/bash
# Look at the custom PSR-7 implementations in zmsclient
echo "=== zmsclient/src/Zmsclient/Psr7/Response.php ==="
cat zmsclient/src/Zmsclient/Psr7/Response.php

echo "=== zmsclient/src/Zmsclient/Psr7/Request.php ==="
cat zmsclient/src/Zmsclient/Psr7/Request.php

echo "=== zmsclient/src/Zmsclient/Psr7/Stream.php ==="
cat zmsclient/src/Zmsclient/Psr7/Stream.php

echo "=== zmsclient/src/Zmsclient/Psr7/Uri.php ==="
cat zmsclient/src/Zmsclient/Psr7/Uri.php

echo "=== zmsslim/src/Slim/Response.php ==="
cat zmsslim/src/Slim/Response.php

echo "=== zmsslim/src/Slim/Factory/ResponseFactory.php ==="
cat zmsslim/src/Slim/Factory/ResponseFactory.php

echo "=== zmsclient/src/Zmsclient/Psr17/ResponseFactory.php ==="
cat zmsclient/src/Zmsclient/Psr17/ResponseFactory.php

echo "=== existing PSR7 tests ==="
cat zmsclient/tests/Zmsclient/HttpTest.php

echo "=== zmsslim test middleware mock ==="
cat zmsslim/tests/Slim/Middleware/RequestHandlerMock.php

echo "=== zmscitizenapi middleware test ==="
cat zmscitizenapi/tests/Zmscitizenapi/MiddlewareTestCase.php

echo "=== composer.json files with psr/http-message ==="
for f in zmsclient/composer.json zmsslim/composer.json zmsapi/composer.json zmscitizenapi/composer.json zmsadmin/composer.json; do
  echo "--- $f ---"
  cat "$f" 2>/dev/null | grep -A2 -B2 "http-message" || echo "(not found)"
done

Length of output: 19001

---

@ThomasAFink Great question! The key breaking change in psr/http-message v2 is the addition of return types to all interface methods. PHP enforces these at class-declaration time, so any custom class implementing a PSR-7 interface will throw a fatal error if its methods don't have matching return type declarations.

Here's what I'd focus testing on, based on the codebase:

---

🔴 Highest Priority — Custom PSR-7 Implementations (zmsclient/src/Zmsclient/Psr7/)

These classes explicitly declare implements \Psr\Http\Message\*Interface and delegate to Slim's implementations. PHP v2 return type enforcement will catch mismatches here first.

1. Uri.php — Most fragile. It directly copies protected properties from another Uri instance (e.g. $temp->scheme, $temp->host). Verify:

   • All UriInterface methods have correct v2 return types
   • The property-copying pattern in the else branch still works with Slim PSR-7 internals

2. Response.php, Request.php, Stream.php — Extend Slim PSR-7 classes and implement PSR interfaces. Test that instantiation and all interface methods work without fatal errors after the upgrade.

---

🟠 Important — Factory Classes

Both factories implement PSR-17 interfaces that depend on PSR-7 v2 return types:

• zmsclient/src/Zmsclient/Psr17/ResponseFactory.php — createResponse() must return ResponseInterface (v2)
• zmsslim/src/Slim/Factory/ResponseFactory.php — same; also chains .withStatus()

Test: instantiate each factory and call createResponse() with various status codes and reason phrases.

---

🟡 Middleware — zmsslim & zmscitizenapi

The middleware chain is the most exercised path. Key tests:

• zmsslim/src/Slim/Middleware/ — ZmsSlimRequest, Validator, SessionMiddleware, IpAddress, OAuthMiddleware, etc. all handle ServerRequestInterface/ResponseInterface. Run the existing PHPUnit suite (zmsslim/tests/) to catch any type-mismatch fatals.
• zmscitizenapi middleware tests (RequestSanitizerMiddlewareTest, IpFilterMiddlewareTest) — already use mocks of ServerRequestInterface; these should still pass since the mocks are generated at runtime by PHPUnit.

---

🟢 Existing Integration Tests (Smoke Test)

zmsclient/tests/Zmsclient/HttpTest.php already covers:

• PSR-7 ResponseInterface / RequestInterface instance checks
• Header access (getHeaderLine)
• Body streaming (getBody())
• Uri round-trips (basic auth, scheme, host, port, path)

Run this suite against a live API environment as a smoke test after the upgrade.

---

Summary Checklist

Area	What to verify
Psr7/Uri.php	No fatal on instantiation; all UriInterface methods have v2-compatible return types
Psr7/Response.php, Request.php, Stream.php	No fatal; interface contract satisfied
Psr17/ResponseFactory.php (both)	createResponse() returns valid ResponseInterface
zmsslim middleware suite	Full phpunit run — catch any return type mismatches
zmscitizenapi middleware tests	Mocks still satisfy v2 interface
HttpTest.php integration suite	Smoke test against live API

[renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: zmsadmin/composer.lock

Command failed: composer update psr/http-message:2.0 --with-dependencies --ignore-platform-req=ext-* --ignore-platform-req=lib-* --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins --minimal-changes
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - phpoffice/phpspreadsheet is locked to version 1.30.4 and an update of this package was not requested.
    - phpoffice/phpspreadsheet 1.30.4 requires php >=7.4.0 <8.5.0 -> your php version (8.5.6) does not satisfy that requirement.
  Problem 2
    - vimeo/psalm is locked to version 6.5.0 and an update of this package was not requested.
    - vimeo/psalm 6.5.0 requires php ~8.1.17 || ~8.2.4 || ~8.3.0 || ~8.4.0 -> your php version (8.5.6) does not satisfy that requirement.

File name: zmsclient/composer.lock

Command failed: composer update psr/http-message:2.0 --with-dependencies --ignore-platform-req=ext-* --ignore-platform-req=lib-* --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins --minimal-changes
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - vimeo/psalm is locked to version 6.5.0 and an update of this package was not requested.
    - vimeo/psalm 6.5.0 requires php ~8.1.17 || ~8.2.4 || ~8.3.0 || ~8.4.0 -> your php version (8.5.6) does not satisfy that requirement.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 2.x releases. But if you manually upgrade to 2.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.