Support PHP 8 (installable on patched PHP 8.2.35+ releases)

.gitattributes

@@ -4,7 +4,7 @@
 # Ignore all test and documentation with "export-ignore".
 /.gitattributes     export-ignore
 /.gitignore         export-ignore
-/.travis.yml        export-ignore
+/.github            export-ignore
 /phpunit.xml.dist   export-ignore
 /.scrutinizer.yml   export-ignore
 /tests              export-ignore

.github/workflows/tests.yml

@@ -0,0 +1,48 @@
+name: Tests
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  tests:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ['7.2', '7.3', '7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5']
+        dependencies: ['highest']
+        include:
+          - php: '7.2'
+            dependencies: 'lowest'
+          - php: '8.5'
+            dependencies: 'lowest'
+    name: PHP ${{ matrix.php }} (${{ matrix.dependencies }})
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
+        with:
+          php-version: ${{ matrix.php }}
+          coverage: none
+      - name: Install dependencies
+        run: |
+          if [ "${{ matrix.dependencies }}" = "lowest" ]; then
+            composer update --prefer-lowest --prefer-stable --no-interaction --no-progress
+          else
+            composer update --no-interaction --no-progress
+          fi
+      - name: Run tests
+        # PHPUnit 10+ only reports PHP deprecations, warnings and notices; make them fail the build.
+        run: |
+          if vendor/bin/phpunit --version | grep -qE 'PHPUnit (1[0-9])\.'; then
+            vendor/bin/phpunit --fail-on-deprecation --fail-on-warning --fail-on-notice
+          else
+            vendor/bin/phpunit
+          fi
+      - name: Check code style
+        run: vendor/bin/phpcs --standard=PSR2 src/

.scrutinizer.yml

@@ -16,8 +16,3 @@ checks:
         fix_line_ending: true
         fix_identation_4spaces: true
         fix_doc_comments: true
-
-tools:
-    external_code_coverage:
-        timeout: 600
-        runs: 3

CHANGELOG.md

@@ -6,19 +6,26 @@ All Notable changes to `omnipay-paystack` will be documented in this file
 
 ### Added
 
--   Nothing
+-   PHP 8 support (`"php": "^7.2 || ^8.0"`), so the package installs on the PHP releases from the 21 Oct 2026 security update (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp): 8.2.35, 8.3.36, 8.4.27, 8.5.12
+-   GitHub Actions test matrix for PHP 7.2–8.5, failing on PHP deprecations, warnings and notices on PHPUnit 10+
+-   Tests for `completePurchase()` (success, declined, unknown reference, partial payload) and for failed purchase and refund responses
 
 ### Deprecated
 
 -   Nothing
 
 ### Fixed
 
--   Nothing
+-   Implicitly nullable `$data` parameter in `AbstractRequest::sendRequest()`, which is deprecated in PHP 8.4
+-   "Undefined array key" warnings on PHP 8 when the Paystack API returns an error or partial payload. Return values are unchanged
+-   Passing `null` to `rawurlencode()` when `completePurchase()` is sent without a transaction reference (deprecated in PHP 8.1)
 
 ### Removed
 
--   Nothing
+-   Travis CI config (`.travis.yml`), replaced by GitHub Actions
+-   `phpro/grumphp` dev dependency and `grumphp.yml`: version 0.14 only installs with Composer 1, and current versions require PHP 8.2+
+-   PHP 7.0 and 7.1 support: the nullable type in `sendRequest()` and the test tools need PHP 7.2+. Composer keeps those projects on the previous release
+-   Scrutinizer `external_code_coverage`: coverage was uploaded from Travis CI, which is removed
 
 ### Security
 

README.md

@@ -1,7 +1,14 @@
 # Paystack support for Omnipay
 
 [Omnipay](https://github.com/thephpleague/omnipay) is a framework agnostic, multi-gateway payment
-processing library for PHP 5.3+. This package implements Paystack support for Omnipay.
+processing library for PHP. This package implements Paystack support for Omnipay.
+
+Requires PHP 7.2 or later. The test suite runs on PHP 7.2–8.5.
+
+In production, use a supported PHP release that includes the 21 Oct 2026 security fixes for critical
+remote code execution flaws (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp): **8.2.35, 8.3.36, 8.4.27,
+8.5.12 or later** ([php.net advisory](https://www.php.net/releases/8_2_35.php)). PHP 8.1 and older
+no longer receive security fixes.
 
 ## Install
 

composer.json

@@ -15,13 +15,12 @@
         }
     ],
     "require": {
-        "php": "^7.0",
+        "php": "^7.2 || ^8.0",
         "omnipay/common": "^3.0"
     },
     "require-dev": {
-        "omnipay/tests": "~3.0",
-        "squizlabs/php_codesniffer": "^3",
-        "phpro/grumphp": "^0.14"
+        "omnipay/tests": "^4.1",
+        "squizlabs/php_codesniffer": "^3"
     },
     "autoload": {
         "psr-4": {
@@ -43,6 +42,11 @@
             "dev-master": "1.0-dev"
         }
     },
+    "config": {
+        "allow-plugins": {
+            "php-http/discovery": false
+        }
+    },
     "minimum-stability": "stable",
     "prefer-stable": true
 }

phpunit.xml.dist

@@ -1,22 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<phpunit backupGlobals="false"
-         backupStaticAttributes="false"
-         bootstrap="vendor/autoload.php"
+<phpunit bootstrap="vendor/autoload.php"
          colors="true"
-         convertErrorsToExceptions="true"
-         convertNoticesToExceptions="true"
-         convertWarningsToExceptions="true"
-         processIsolation="false"
-         stopOnFailure="false"
-         syntaxCheck="false">
+         stopOnFailure="false">
     <testsuites>
         <testsuite name="Omnipay Test Suite">
             <directory>./tests/</directory>
         </testsuite>
     </testsuites>
-    <filter>
-        <whitelist>
-            <directory>./src</directory>
-        </whitelist>
-    </filter>
 </phpunit>

src/Message/AbstractRequest.php

@@ -37,7 +37,7 @@ public function setSecretKey($value)
         $this->setParameter('secret_key', $value);
     }
 
-    protected function sendRequest($method, $endpoint, array $data = null)
+    protected function sendRequest($method, $endpoint, ?array $data = null)
     {
         $headers = [
             'Authorization' => 'Bearer ' . $this->getSecretKey(),

src/Message/CompletePurchaseRequest.php

@@ -11,7 +11,7 @@ class CompletePurchaseRequest extends AbstractRequest
      */
     public function getApiEndpoint()
     {
-        return '/transaction/verify/' . rawurlencode($this->getTransactionReference());
+        return '/transaction/verify/' . rawurlencode((string) $this->getTransactionReference());
     }
 
     /**
@@ -35,4 +35,4 @@ public function sendData($data)
 
         return $this->response = new CompletePurchaseResponse($this, $response);
     }
-}
+}

src/Message/CompletePurchaseResponse.php

@@ -15,7 +15,7 @@ public function isSuccessful()
     public function getTransactionId()
     {
         if (isset($this->data['data']) && $data = $this->data['data']) {
-            if ($data['reference']) {
+            if (!empty($data['reference'])) {
                 return $data['reference'];
             }
         }
@@ -24,13 +24,13 @@ public function getTransactionId()
     public function getMessage()
     {
         if (isset($this->data['data']) && $data = $this->data['data']) {
-            if ($data['message']) {
+            if (!empty($data['message'])) {
                 return $data['message'];
             }
         }
 
         if (isset($this->data['data']) && $data = $this->data['data']) {
-            if ($data['gateway_response']) {
+            if (!empty($data['gateway_response'])) {
                 return $data['gateway_response'];
             }
         }
@@ -45,7 +45,7 @@ public function getMessage()
     public function getTransactionReference()
     {
         if (isset($this->data['data']) && $data = $this->data['data']) {
-            return $data['reference'];
+            return $data['reference'] ?? null;
         }
 
         return '';
@@ -55,9 +55,9 @@ public function getTransactionReference()
     public function getCode()
     {
         if (isset($this->data['data']) && $data = $this->data['data']) {
-            return $data['status'];
+            return $data['status'] ?? null;
         }
 
         return '';
     }
-}
+}

src/Message/PurchaseResponse.php

@@ -24,7 +24,7 @@ public function isRedirect()
     public function getRedirectUrl()
     {
         if (isset($this->data['data']) && $data = $this->data['data']) {
-            return $data['authorization_url'];
+            return $data['authorization_url'] ?? null;
         }
 
         return '';
@@ -53,7 +53,7 @@ public function getRedirectMethod()
     public function getCode()
     {
         if (isset($this->data['data']) && $data = $this->data['data']) {
-            return $data['access_code'];
+            return $data['access_code'] ?? null;
         }
 
         return '';
@@ -62,7 +62,7 @@ public function getCode()
     public function getTransactionReference()
     {
         if (isset($this->data['data']) && $data = $this->data['data']) {
-            return $data['reference'];
+            return $data['reference'] ?? null;
         }
 
         return '';

src/Message/RefundResponse.php

@@ -10,7 +10,7 @@ class RefundResponse extends AbstractResponse
     public function isSuccessful()
     {
 
-        if (isset($this->data['data']) && $transaction = $this->data['data']['transaction']) {
+        if (isset($this->data['data']['transaction']) && $transaction = $this->data['data']['transaction']) {
             if (isset($transaction['status']) && $transaction['status'] == 'reversed') {
                 return true;
             }
@@ -36,7 +36,7 @@ public function getMessage()
     public function getCode()
     {
         if (isset($this->data['data']) && $data = $this->data['data']) {
-            return $data['access_code'];
+            return $data['access_code'] ?? null;
         }
 
         return '';
@@ -46,7 +46,7 @@ public function getTransactionReference()
     {
         if (isset($this->data['data']) && $data = $this->data['data']) {
             if (isset($data['transaction']) && $transaction = $data['transaction']) {
-                return $transaction['reference'];
+                return $transaction['reference'] ?? null;
             }
         }