Release a version that allows setono/meta-conversions-api-php-sdk ^1.0 (Meta Graph API v20.0 sunsets 24 Sep 2026)

[loevgaard]

Why

Meta is retiring Graph API v20.0 on 24 September 2026 and asks apps to move all calls to v21.0 or higher. Consumers of this bundle cannot get there today:

• v0.1.5 requires setono/meta-conversions-api-php-sdk: ^0.2.1 → SDK 0.2.4 requires facebook/php-business-sdk: ^14.0 → the SDK derives the endpoint version from that package's version, so every event is POSTed to https://graph.facebook.com/v14.0/{pixel}/events.
• SDK v1.0.0 (2026-06-15) targets v25.0 (facebook/php-business-sdk ^25.0; src/Client/Client.php:59 uses ApiConfig::APIVersion), but no released version of this bundle allows it.

Meta routes calls to unavailable versions to the oldest version the app may use, so nothing hard-fails on 24 September — but that is an implicit, per-app fallback, not a fix.

What master needs before it can be tagged

master (2fb343c, 27 commits since v0.1.5, all from 2025-04-14) is close, with two blockers:

1. SDK constraint — composer.json:16 is "setono/meta-conversions-api-php-sdk": "dev-master". Change to ^1.0. SDK 1.0 removed Client::setResponseFactory(); this bundle never called it, so nothing else needs adapting.
2. Shadow dependency on setono/consent-contracts — src/DependencyInjection/Configuration.php:9,35 references Setono\Consent\DefaultConsents::CONSENT_MARKETING unconditionally while building the config tree. setono/consent-contracts is not in require; it is only in the local vendor through the dev dependency setono/consent-bundle, and composer-dependency-analyser.php ignores it as "optional". In any app without the consent bundle (e.g. the Sylius plugin's test app) container compilation fatals with a class-not-found. Fix: add "setono/consent-contracts": "^1.1" to require (php-only package), or use a literal default ('marketing') / class_exists() guard. src/ConsentChecker/ConsentChecker.php:7 and consent.xml:12 are fine as they are (nullable argument, on-invalid="null").

Also: gh run list shows no CI runs for master since 2025-04-14 — run the suite / push before tagging to confirm green.

Release notes to include (BC breaks vs 0.1.5)

• All service ids renamed from setono_meta_conversions_api.* to FQCNs, e.g. setono_meta_conversions_api.pixel_provider.default → Setono\MetaConversionsApiBundle\Provider\PixelProviderInterface, setono_meta_conversions_api.client.default → Setono\MetaConversionsApi\Client\Client. Apps that override or decorate by the old ids silently lose their override.
• PHP >=8.1; Symfony ^6.4 || ^7.0 (5.4 and 6.0–6.3 dropped).
• symfony/monolog-bundle and composer-runtime-api no longer required.
• New consent.category option (defaults to the marketing category) and a ConsentCheckerInterface service.
• Via SDK 1.0: a PSR-18 client and PSR-17 factories must be installed (psr/http-client-implementation, psr/http-factory-implementation), and php-http/discovery is pulled in — consumers need "php-http/discovery": false (or true) in allow-plugins.
• Graph API endpoint version moves from v14.0 to v25.0.

Suggested version: v1.0.0 — the SDK is 1.0 now, and this signals semver from here on.

Alternative if a fast, low-risk release is preferred

Branch from v0.1.5, change only composer.json:17 to "setono/meta-conversions-api-php-sdk": "^0.2.1 || ^1.0", tag v0.1.6. 0.1.5 uses nothing the SDK removed, so it works unchanged with SDK 1.0 and gets consumers to v25.0 immediately; the master release can follow separately.

Downstream

Setono/SyliusFacebookPlugin will bump to this release and adapt its pixel-provider compiler pass — tracked in Setono/SyliusFacebookPlugin#88.