chore: bump utopia-php/http to 2.0.0-rc16

[loks0n]

What

Bumps utopia-php/http from 2.0.0-rc5 to 2.0.0-rc16.

The two breaking releases in between:

• rc15 split PSR-7 into a separate package (utopia-php/psr7, pulled in transitively).
• rc16 replaced the Utopia HTTP request with a PSR-7 ServerRequest.

Changes

• Type-hint request actions with Psr\Http\Message\ServerRequestInterface instead of the now-removed Utopia\Http\Request.
• PSR getHeaderLine() takes only a name and returns '' when the header is absent, so header defaults are applied explicitly via ?: instead of passing a second argument:
  • x-executor-response-format → falls back to 0.10.0
  • accept → falls back to multipart/form-data
  • authorization → PSR empty-string default (unchanged behavior)

Response, Http, and Server APIs are unchanged.

Verification

• ✅ composer analyze (PHPStan) — no errors
• ✅ composer format:check (Pint) — passed
• ✅ composer refactor:check (Rector) — clean
• ✅ composer test:unit — 12 tests, 57 assertions
• ✅ Built the Docker image and booted the executor: server starts cleanly on rc16, /v1/health returns 200, and the auth flow (which exercises the changed PSR getHeaderLine) correctly returns 200 for a valid key and 401 for missing/invalid keys.
• E2E suite left to CI (requires the full runtime stack).

Why

Unblocks the corresponding utopia-php/http rc16 migration in appwrite-labs/edge, which currently can't move past rc5 because this package pins http to exactly rc5.

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR migrates utopia-php/http from 2.0.0-rc5 to 2.0.0-rc16, adopting the PSR-7 ServerRequestInterface that rc16 introduced in place of the now-removed Utopia\Http\Request.

• app/controllers.php: Type-hints updated to ServerRequestInterface; all three getHeaderLine call sites converted to PSR-7's single-argument form with explicit ?: fallbacks for the two headers that previously relied on a default argument (x-executor-response-format → '0.10.0', accept → 'multipart/form-data'). The authorization header correctly relies on PSR-7's native empty-string return.
• composer.json: Version constraint updated to 2.0.0-rc16@RC; the project's existing php >= 8.5.0 requirement already satisfies the library's new >=8.4 minimum.
• composer.lock: Adds the new transitive utopia-php/psr7 0.2.0 package and brings along routine patch bumps across several Symfony and utopia-php dependencies.

Confidence Score: 5/5

Safe to merge — the changes are a straightforward mechanical migration with no logic alterations and all three header call sites behave identically under PSR-7's empty-string-on-absent contract.

All three getHeaderLine conversions are correct: PSR-7 returns '' for absent headers, so the ?: fallbacks exactly replicate the previous default-argument behaviour. The new utopia-php/psr7 transitive dependency is minimal and well-scoped. The project's PHP 8.5 floor already exceeds the library's new 8.4 minimum, and the author reports clean runs of PHPStan, Pint, Rector, and the unit test suite.

No files require special attention.

Important Files Changed

Filename	Overview
app/controllers.php	Migrates three getHeaderLine call sites from the old Utopia Request API to PSR-7 ServerRequestInterface; defaults applied via ?: since PSR-7 returns '' when a header is absent. All three usages are correct.
composer.json	Bumps utopia-php/http from 2.0.0-rc5@RC to 2.0.0-rc16@RC; the project's php >= 8.5.0 requirement satisfies the library's new >=8.4 constraint.
composer.lock	Lock file updated with utopia-php/http rc16, the new transitive utopia-php/psr7 0.2.0 dependency, and routine patch/minor bumps across utopia-php and Symfony packages.

_{Reviews (1): Last reviewed commit: "chore: bump utopia-php/http to 2.0.0-rc1..." | Re-trigger Greptile}