mercadopago/dx-php

What's Changed

• feat(order): add 19 typed Request classes and dual array|OrderCreateRequest acceptance in create() by Diego Barajas (@barajas-d) in #639
• Feature/standardize testing and ci by luismeli10 (@luismeli10) in #651
• chore: bump version to 3.14.0 by Diego Barajas (@barajas-d) in #652

Full Changelog: 3.13.0...3.14.0

Added

• Automatic Payments example: two-step recurring flow (#639)
• Order typed Request classes with dual acceptance in create() (#639)
• Order request layer: reuse Common\Address, Identification, Phone (#639)
• Pagination: support data key (Orders v2) and string paging totals in MPAutoPaginationGenerator (#639)

Fixed

• Stored credential: rename prev_transaction_ref to previous_transaction_reference (#639)

CI

• Add CD workflow (#651)
• Standardize CI workflow (#651)
• Add mock-based unit test coverage (#651)

Dependencies

• Fix CVE-2026-67434: upgrade squizlabs/php_codesniffer to 4.0.4 (#651)

What's Changed

• Pin GitHub Actions to SHA for supply chain security by luismeli10 (@luismeli10) in #638
• chore(deps)(deps-dev): bump friendsofphp/php-cs-fixer from 3.95.15 to 3.95.17 by Dependabot (@dependabot)[bot] in #640
• chore(ci): bump actions/checkout from 7.0.0 to 7.0.1 by Dependabot (@dependabot)[bot] in #641
• Add CREDENTIAL_ON_FILE messaging fields to Payment resource by luismeli10 (@luismeli10) in #642
• chore(deps)(deps-dev): bump friendsofphp/php-cs-fixer from 3.95.17 to 3.95.18 by Dependabot (@dependabot)[bot] in #644
• chore(deps)(deps-dev): bump symfony/console from 7.4.14 to 7.4.15 by Dependabot (@dependabot)[bot] in #643
• Add delete to CustomerClient and get to CardTokenClient by luismeli10 (@luismeli10) in #645
• Fix webhook toleranceSeconds unit mismatch by luismeli10 (@luismeli10) in #647
• Feature/ergonomia sdk by Diego Barajas (@barajas-d) in #646
• chore: bump version to 3.13.0 by Diego Barajas (@barajas-d) in #648

Full Changelog: 3.12.1...3.13.0

Added

• SDK ergonomics: typed exceptions, configurable retry, and auto-pagination (#646)
  • MPApiException now has 12 specific subtypes per HTTP status code
  • MPRequestOptions gains optional maxRetries, retryOn, initialDelayMs, maxDelayMs and onRetry callback
  • New auto-pagination support on search endpoints
• Missing API methods — DisbursementRefundClient::list(), AdvancedPaymentClient::update(), CustomerCard::update(), PaymentClient::update() (#645)
• CREDENTIAL_ON_FILE messaging fields on Payment types (#642): firstTransaction, storage, transactionInitiator, reference

Fixed

• Webhook toleranceSeconds unit mismatch — ts header value compared in seconds against a millisecond clock (#647)
• constantTimeEquals RangeError on multibyte v1 hash (#647)

CI

• Hotfix: pin GitHub Actions to SHA for supply chain security (#638)

Dependencies

• Bump symfony/console (#643)
• Bump friendsofphp/php-cs-fixer (#644, #640)
• Bump actions/checkout to v7.0.1 (#641)

What's Changed

• chore(deps)(deps-dev): bump phpunit/phpunit from 11.5.55 to 11.5.56 by Dependabot (@dependabot)[bot] in #631
• chore(deps)(deps-dev): bump friendsofphp/php-cs-fixer from 3.95.11 to 3.95.15 by Dependabot (@dependabot)[bot] in #632
• Fix path traversal vulnerability in string-ID client methods by luismeli10 (@luismeli10) in #633
• Add missing industry fields to Preference and Payment models by luismeli10 (@luismeli10) in #634
• Fix Card expiration type and revert PHP minimum version to 8.2 by luismeli10 (@luismeli10) in #636
• Bump version to 3.12.1 by luismeli10 (@luismeli10) in #637

Full Changelog: 3.12.0...3.12.1

What's Changed

• Feature/orders cho pro by luismeli10 (@luismeli10) in #624
• chore(deps)(deps-dev): bump symfony/console from 7.4.13 to 7.4.14 by Dependabot (@dependabot)[bot] in #626
• chore(deps)(deps-dev): bump friendsofphp/php-cs-fixer from 3.95.10 to 3.95.11 by Dependabot (@dependabot)[bot] in #627
• Bump version 3.12.0 by luismeli10 (@luismeli10) in #628

Full Changelog: 3.11.3...3.12.0

Changed

• Order CheckokutPRO capability

Bump version to 3.12.0-beta.1

What's Changed

• fix(webhook): preserve data.id case in signature manifest by danielalfarourrea in #621
• chore(ci): bump actions/checkout from 6 to 7 by Dependabot (@dependabot)[bot] in #622
• chore(deps)(deps-dev): bump friendsofphp/php-cs-fixer from 3.95.4 to 3.95.10 by Dependabot (@dependabot)[bot] in #623

Full Changelog: 3.11.2...3.11.3

What's Changed

• Fix/preference metadata and webhook signature by luismeli10 (@luismeli10) in #617
• chore(deps)(deps-dev): bump friendsofphp/php-cs-fixer from 3.95.3 to 3.95.4 by Dependabot (@dependabot)[bot] in #616
• Bump version by luismeli10 (@luismeli10) in #618

Full Changelog: 3.11.1...3.11.2

What's Changed

• fix: remove deprecated curl_close() call for PHP 8.5 compatibility by Diego Barajas (@barajas-d) in #615

New Contributors

• Diego Barajas (@barajas-d) made their first contribution in #615

Full Changelog: 3.11.0...3.11.1

What's Changed

• feat(order): add prev_transaction_ref to StoredCredential DTO by danielalfarourrea in #611
• feat: add AdvancedPayment, DisbursementRefund and Chargeback clients (v3.11.0) by danielalfarourrea in #609

New Contributors

• Dependabot (@dependabot)[bot] made their first contribution in #601

Full Changelog: 3.10.0...3.11.0

Added

• AdvancedPayment: marketplace split-payment management — Create, Get, Search, Update, Capture, Cancel, UpdateReleaseDate (POST/GET/PUT /v1/advanced_payments).
• DisbursementRefund: refund management for split-payment disbursements — ListAll, CreateAll, Create (GET/POST /v1/advanced_payments/{id}/refunds, POST /v1/advanced_payments/{id}/disbursements/{id}/refunds).
• Chargeback: read-only access to payment dispute records — Get, Search (GET /v1/chargebacks).

Added

Changed

• Bump the SDK version to 3.7.1 in MercadoPagoConfig::$CURRENT_VERSION

Fixed

• Fix addresses and cards mapping in Customer resource

Deprecated

Security

Added

• Atualizações de documentação para instruções de instalação

Changed

• Bump the SDK version to 3.6.0 in MercadoPagoConfig::$CURRENT_VERSION

Fixed

Deprecated

Removed

Security

Added

• Add and update fields and tests

Changed

• Add and fix tests in OrderClientUnitTest
• Updates .gitignore to ignore .idea

Fixed

Deprecated

Security

<!-- When releasing, duplicate the block below replacing X.Y.Z and date --> <!-- Example: ## [3.6.0] - 2025-08-27 -->