Unpin utopia-php/http and move to 2.0.0-rc32

[ChiragAgg5k]

What

Moves utopia-php/http from an exact 2.0.0-rc23@RC pin to ^2.0@RC, currently resolving to 2.0.0-rc32.

Why

The exact pin is the ceiling for every consumer of the executor. A caret range lets downstream resolve newer release candidates without a coordinated bump here.

What moves

http rc23 → rc32, and with it validators 0.5.0 → 1.0.1, servers 0.4.8 → 0.4.11, storage 4.0.4 → 4.1.0, pools 2.0.2 → 2.1.2, span 4.1.0 → 4.2.0, client 0.3.0 → 0.4.4, plus patch bumps of system, di, telemetry, compression. servers 0.4.11 and storage 4.1.0 are required because they are the first releases that accept validators 1.0.

rc23 → rc32 changes

• Request::setTrustedIpHeaders() removed. Replaced by a TrustedHeaders value object passed to the server adapter constructor, so trusted forwarded headers are fixed at construction. The executor never called setTrustedIpHeaders, so no migration is needed here.
• getProtocol() reads only trusted proto headers. The default trusts x-forwarded-proto, so behaviour is unchanged for the executor.
• Range parsing treats start === end as a valid single-byte range per RFC 9110.
• Swoole Mode presets set max_request to 10,000 to recycle workers. The executor uses the SwooleCoroutine adapter, which does not use Mode, so this does not apply.
• Dependency constraints only: validators ^1.0, system ^0.10 || ^0.11.

validators 0.5 → 1.0 changes only Assoc::getType() and isArray() (now reported as object). That affects spec generation, not validation, so the executor's Assoc params validate exactly as before.

Testing

composer analyze, format:check, refactor:check and test:unit (35/35) pass.

E2E run locally against the rc32 image: 30/31 pass. The one failure was testCustomRuntimes for PHP, where the test function's own composer install hit a GitHub 504 downloading guzzle. Unrelated to this change.

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge, with no actionable failures identified in the changed dependency constraint or resolved lockfile.

Summary

• Resolves utopia-php/http at 2.0.0-rc32.
• Moves validators, servers, storage, client, pools, span, telemetry, and related transitive packages to compatible versions.
• Preserves the repository’s existing PHP 8.5 platform requirement.
• No actionable correctness, security, or repository-rule violations were identified.

_{Reviews (1) · Last reviewed commit: "chore: unpin utopia-php/http to ^2.0@RC ..."}