[fern-api]

Regenerates the PHP SDK from Intercom-OpenAPI 184e88b with fernapi/fern-php-sdk 2.30.12 and encode-path-params: true.

What changes

• Path parameters are encoded and checked. All 199 path-parameter substitutions go through RawClient::encodePathParam(). /, ? and # are percent-encoded. Exact . and .. throw InvalidArgumentException before any request is sent. Values such as v1.2 and ... are unchanged.
• No mixed|null type hints. The generator fix in 2.30.11 is included. For example, Unstable\Messages\MessagesClient::createMessage is now mixed $request = null.
• Pagination is kept. 12 methods return Pager.
• Generator update. This moves from 1.25.0 to 2.30.12, so src/Core is regenerated too. For example, the HTTP client now uses PSR-18 discovery.

Please review before merging

• composer.json is in .fernignore, so it was not updated. The regenerated code needs packages that it does not list:
  • php-http/multipart-stream-builder, used by src/Core/Multipart/MultipartFormData.php.
  • psr/http-factory, used by src/Core/Client/HttpClientBuilder.php.
  • The generated composer.json also requires PHPUnit ^12.5 for dev. This file still has ^9.0.
• Some class names change, which can break callers. Examples: Unstable\Conversations\Requests\ReplyConversationRequest becomes ReplyConversationBody, and Articles\Types\UpdateArticleRequestState becomes UpdateArticleRequestBodyState. There are 16 renames in total; see the renamed files in the diff.
• SDK version is still 5.0.2 in the headers in src/IntercomClient.php. Please set the version you want to release.
• Unchanged on purpose: src/Legacy, tests/Legacy and .github/. The generated ci.yml was not added, so the disabled workflow stays disabled.

Verification

• php -l passes on all generated files.
• No native mixed|null type hints remain.
• Because composer install was not run, the runtime tests (phpunit) have not been run.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	composer/​phpunit/​phpunit@​9.6.38.0 ⏵ 12.5.43.0
	composer/​php-http/​multipart-stream-builder@​1.4.2.0

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Recently published: composer phpunit/phpunit published 3 days ago Location: Package overview From: composer.json → composer/phpunit/phpunit@12.5.43.0 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore composer/phpunit/phpunit@12.5.43.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block

View full report