From 76c72743e5c68359043cd0ef62e5c43b3e9e3d52 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Joachim=20L=C3=B8vgaard?= Date: Mon, 21 Sep 2026 11:45:49 +0200 Subject: [PATCH] Let Dependabot watch facebook/php-business-sdk The Graph API version the client talks to is ApiConfig::APIVersion from facebook/php-business-sdk, and Meta ships a new major of that package for every Graph API version, roughly three times a year. Until the constraint is widened, users of this library stay capped at the previous Graph API version, and so far somebody had to notice the release by hand. Dependabot now opens a PR that widens the constraint when a new major is released. It watches 2.x, which is now the default branch and therefore where Dependabot reads its config from. No composer.lock is committed, so releases inside the allowed range produce no PR. Other dependencies are left out on purpose: their ranges already float, and the dev tools are held on the majors that still support PHP 8.1. CLAUDE.md is updated for 2.x being the default branch. --- .github/dependabot.yml | 21 +++++++++++++++++++++ CLAUDE.md | 4 ++-- 2 files changed, 23 insertions(+), 2 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..5f5a57a --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,21 @@ +# Dependabot only reads this file from the default branch, 2.x, which is also the only branch it watches. +# +# Only facebook/php-business-sdk is watched. The Graph API version the client talks to is ApiConfig::APIVersion from that +# package, and Meta ships a new major of it for every Graph API version, a few times a year. Without a PR that widens the +# constraint, users of this library stay capped at the previous Graph API version. +# +# No composer.lock is committed, so a PR is only opened when a release falls outside the allowed range, i.e. for a new +# major. The other dependencies are left out on purpose: their ranges already float, and the dev tools are held on the +# majors that still support PHP 8.1. +version: 2 + +updates: + - package-ecosystem: "composer" + directory: "/" + schedule: + interval: "weekly" + allow: + - dependency-name: "facebook/php-business-sdk" + versioning-strategy: "widen" + labels: + - "dependencies" diff --git a/CLAUDE.md b/CLAUDE.md index f19c5af..cda4349 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -31,7 +31,7 @@ CI (`.github/workflows/build.yaml`) runs coding standards, dependency analysis, ### Branches -There is no `master`. **`1.x`** is the default branch and holds the released 1.x line: bug fixes and additive changes only, and the BC check must stay green — this is a public library. **`2.x`** is the next major: BC breaks are allowed there, but every one must be documented in `UPGRADE-2.0.md`. Because the BC check compares against the PR's base, it is expected to be red on `2.x` PRs that break BC; its output should match what `UPGRADE-2.0.md` lists. Always pass `--base` to `gh pr create`. `Closes #123` only auto-closes issues when merged into the default branch, so issues fixed on `2.x` have to be closed by hand. +There is no `master`. **`2.x`** is the default branch and the next major: BC breaks are allowed there, but every one must be documented in `UPGRADE-2.0.md`. Because the BC check compares against the PR's base, it is expected to be red on `2.x` PRs that break BC; its output should match what `UPGRADE-2.0.md` lists. **`1.x`** holds the released 1.x line: bug fixes and additive changes only, and the BC check must stay green there — this is a public library. Always pass `--base` to `gh pr create`. `Closes #123` only auto-closes issues when merged into the default branch, so issues fixed on `1.x` have to be closed by hand. Config that GitHub only reads from the default branch, like `.github/dependabot.yml`, lives on `2.x` only. ### LiveClientTest @@ -62,4 +62,4 @@ So to add a field: add the public property, map it in `getMapping()`, and regist **Value objects (`src/ValueObject/`)** — `Fbc`/`Fbp` (extending `Fb`) model the `_fbc`/`_fbp` cookie values with `fromString()` validation and `value()` serialization; assignable to `User::$fbc`/`$fbp` as either the typed object or a raw string. Both accept the optional trailing appendix segment that Meta's parameter builder writes (`getAppendix()`/`withAppendix()`) and write it back unchanged, so a cookie value round-trips byte for byte. -The `facebook/php-business-sdk` dependency is used only for `Normalizer`, `Util::hash`, and `ApiConfig::APIVersion` (the API version is pinned to whatever that package ships). +The `facebook/php-business-sdk` dependency is used only for `Normalizer`, `Util::hash`, and `ApiConfig::APIVersion` (the API version is pinned to whatever that package ships). Dependabot (`.github/dependabot.yml`) watches this one package on `2.x` and opens a PR that widens the constraint when Meta releases a new major; `1.x` is not watched. CI covers the normalization and hashing on the new major; run `LiveClientTest` once against it before tagging a release.