fix: revert JSON serialization workaround, upgrade SDK to 6.3.1 instead

v2.0.1's useJson() workaround was wrong: the JSON request serializer silently drops nested single-object fields (e.g. CustomerRef, which QuickBooks requires), and the JSON response deserializer never returns a typed entity, so $result->Id is always null downstream. That breaks every dsCall() site, worse than the bug it was meant to fix. The actual root cause was that quickbooks/v3-php-sdk 5.4.7 predates QuickBooks Online's new invoice AllowOnlinePayPalPayment field, so its XML deserializer throws on responses that include it. SDK 6.3.1 declares the field, so upgrading resolves the original error while keeping the fully-supported XML path (and closes out the SDK bump Dependabot already had queued in #3). Verified: deserializing a response containing AllowOnlinePayPalPayment throws RuntimeException on 5.4.7 and returns a correctly typed IPPInvoice (with Id populated) on 6.3.1.
fix: switch DataService to JSON serialization to survive QuickBooks schema drift
2026-11-14 22:11:50 +00:00 · 2026-07-27 07:15:59 +03:00 · 2026-07-27 07:03:21 +03:00 · 2026-05-27 06:18:22 +00:00 · 2026-05-27 14:48:52 +10:00
3 changed files with 101 additions and 57 deletions
@@ -0,0 +1,33 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    groups:
+      actions:
+        patterns: ["*"]
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    labels:
+      - "dependencies"
+
+  - package-ecosystem: "composer"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "tuesday"
+    open-pull-requests-limit: 10
+    groups:
+      php-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    labels:
+      - "dependencies"
@@ -0,0 +1,11 @@
+# Security Policy
+
+**PLEASE DON'T DISCLOSE SECURITY-RELATED ISSUES PUBLICLY, [SEE BELOW](#reporting-a-vulnerability).**
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability, please report it privately using the below channel:
+
+**GitHub Private Vulnerability Reporting** — go to the repository's **Security** tab and click **"Report a vulnerability"**. This creates a private advisory visible only to maintainers and provides a structured workflow for triage, fix coordination, and CVE assignment.
+
+All security vulnerabilities will be promptly addressed.
@@ -1,6 +1,6 @@
 {
    "name": "wearepixel/laravel-quickbooks",
-  "version": "2.0.0",
+    "version": "2.0.2",
    "description": "Laravel Client for QuickBooks.",
    "keywords": [
        "quickbooks",
@@ -22,7 +22,7 @@
        "illuminate/routing": "^10.0|^11.0|^12.0",
        "illuminate/support": "^10.0|^11.0|^12.0",
        "nesbot/carbon": "^2.62.1|^3.0",
-    "quickbooks/v3-php-sdk": "^5.4.6"
+        "quickbooks/v3-php-sdk": "^6.3.1"
    },
    "require-dev": {
        "laravel/pint": "^1.2",
Author	SHA1	Message	Date
Joel Male	32266f6dd5	fix: revert JSON serialization workaround, upgrade SDK to 6.3.1 instead v2.0.1's useJson() workaround was wrong: the JSON request serializer silently drops nested single-object fields (e.g. CustomerRef, which QuickBooks requires), and the JSON response deserializer never returns a typed entity, so $result->Id is always null downstream. That breaks every dsCall() site, worse than the bug it was meant to fix. The actual root cause was that quickbooks/v3-php-sdk 5.4.7 predates QuickBooks Online's new invoice AllowOnlinePayPalPayment field, so its XML deserializer throws on responses that include it. SDK 6.3.1 declares the field, so upgrading resolves the original error while keeping the fully-supported XML path (and closes out the SDK bump Dependabot already had queued in #3). Verified: deserializing a response containing AllowOnlinePayPalPayment throws RuntimeException on 5.4.7 and returns a correctly typed IPPInvoice (with Id populated) on 6.3.1.	2026-07-27 07:15:59 +03:00
Joel Male	9002e0ebca	fix: switch DataService to JSON serialization to survive QuickBooks schema drift The SDK's XML deserializer reflects on declared properties of its Data classes and throws a RuntimeException when QuickBooks returns a field the installed SDK version doesn't define yet (e.g. the new invoice AllowOnlinePayPalPayment field), breaking every invoice create/update. The JSON path builds instances from the class's own known properties and silently ignores unrecognised response fields instead, so it tolerates QuickBooks adding fields ahead of the SDK.	2026-07-27 07:03:21 +03:00
pixel-workflows[bot]	473103c243	chore: update dependabot configuration	2026-05-27 06:18:22 +00:00
Joel Male	f59295773d	Create SECURITY.md	2026-05-27 14:48:52 +10:00