Skip to content

chore: upgrade utopia queue and replace App with Http#11239

Merged
ChiragAgg5k merged 10 commits into1.8.xfrom
upgrade-utopia-queue
Feb 4, 2026
Merged

chore: upgrade utopia queue and replace App with Http#11239
ChiragAgg5k merged 10 commits into1.8.xfrom
upgrade-utopia-queue

Conversation

@ChiragAgg5k
Copy link
Member

No description provided.

@coderabbitai
Copy link
Contributor

coderabbitai bot commented Feb 4, 2026

📝 Walkthrough

Walkthrough

composer.json updates utopia-php/telemetry from "0.1." to "0.2.". A broad, mostly mechanical migration replaces Utopia\App / App::... with Utopia\Http / Http::... across routing, init/shutdown, resource registration, type hints, and environment checks. Non-mechanical changes include: requestTimestamp parsing now validates and throws on invalid values; a Span log was added for internal SMS; some routes gained or adjusted SDK/audit metadata and method names; the Realtime messaging adapter now lazily initializes its PubSubPool (nullable property, getter, constructor removed).

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

🚥 Pre-merge checks | ✅ 1 | ❌ 2
❌ Failed checks (2 warnings)
Check name Status Explanation Resolution
Description check ⚠️ Warning No description was provided by the author, making it impossible to assess relevance to the changeset. Add a pull request description explaining the migration from App to Http facade and the dependency upgrade to help reviewers understand the scope and rationale.
Docstring Coverage ⚠️ Warning Docstring coverage is 63.33% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (1 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately describes the main changes: upgrading utopia-php/telemetry and systematically replacing App facade with Http across the codebase.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch upgrade-utopia-queue

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions
Copy link

github-actions bot commented Feb 4, 2026

Security Scan Results for PR

Docker Image Scan Results

Package Version Vulnerability Severity
libcrypto3 3.5.4-r0 CVE-2025-15467 CRITICAL
libcrypto3 3.5.4-r0 CVE-2025-69419 HIGH
libcrypto3 3.5.4-r0 CVE-2025-69421 HIGH
libpng 1.6.51-r0 CVE-2025-66293 HIGH
libpng 1.6.51-r0 CVE-2026-22695 HIGH
libpng 1.6.51-r0 CVE-2026-22801 HIGH
libpng-dev 1.6.51-r0 CVE-2025-66293 HIGH
libpng-dev 1.6.51-r0 CVE-2026-22695 HIGH
libpng-dev 1.6.51-r0 CVE-2026-22801 HIGH
libssl3 3.5.4-r0 CVE-2025-15467 CRITICAL
libssl3 3.5.4-r0 CVE-2025-69419 HIGH
libssl3 3.5.4-r0 CVE-2025-69421 HIGH
libxml2 2.13.8-r0 CVE-2025-49794 CRITICAL
libxml2 2.13.8-r0 CVE-2025-49796 CRITICAL
libxml2 2.13.8-r0 CVE-2025-49795 HIGH
libxml2 2.13.8-r0 CVE-2025-6021 HIGH
openssl 3.5.4-r0 CVE-2025-15467 CRITICAL
openssl 3.5.4-r0 CVE-2025-69419 HIGH
openssl 3.5.4-r0 CVE-2025-69421 HIGH
openssl-dev 3.5.4-r0 CVE-2025-15467 CRITICAL
openssl-dev 3.5.4-r0 CVE-2025-69419 HIGH
openssl-dev 3.5.4-r0 CVE-2025-69421 HIGH
py3-urllib3 1.26.20-r0 CVE-2026-21441 HIGH
py3-urllib3-pyc 1.26.20-r0 CVE-2026-21441 HIGH
github.com/containerd/containerd/v2 v2.0.2 CVE-2024-25621 HIGH
golang.org/x/crypto v0.31.0 CVE-2025-22869 HIGH
golang.org/x/oauth2 v0.24.0 CVE-2025-22868 HIGH
stdlib 1.22.10 CVE-2025-47907 HIGH
stdlib 1.22.10 CVE-2025-58183 HIGH
stdlib 1.22.10 CVE-2025-61726 HIGH
stdlib 1.22.10 CVE-2025-61728 HIGH
stdlib 1.22.10 CVE-2025-61729 HIGH

Source Code Scan Results

🎉 No vulnerabilities found!

@github-actions
Copy link

github-actions bot commented Feb 4, 2026

✨ Benchmark results

  • Requests per second: 2,211
  • Requests with 200 status code: 398,114
  • P99 latency: 0.07129125

⚡ Benchmark Comparison

Metric This PR Latest version
RPS 2,211 1,141
200 398,114 205,460
P99 0.07129125 0.17676264

@ChiragAgg5k ChiragAgg5k changed the title chore: upgrade utopia queue chore: upgrade utopia queue and replace App with Http Feb 4, 2026
Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (5)
src/Appwrite/GraphQL/Schema.php (1)

5-10: ⚠️ Potential issue | 🔴 Critical

Re-add Utopia\App import for existing type hints.
App is used in the method signature (line 29) but the import is missing. Without it, the type hint resolves to \Appwrite\GraphQL\App which does not exist and will cause a fatal error.

Proposed fix
 use GraphQL\Type\Schema as GQLSchema;
+use Utopia\App;
 use Utopia\Http;
src/Appwrite/GraphQL/Resolvers.php (1)

5-10: ⚠️ Potential issue | 🔴 Critical

Missing Utopia\App import or incomplete refactoring to Utopia\Http.

The file uses App type hints throughout (lines 19, 24, 29, 64, 71, 86, 93, etc.) but imports only Utopia\Http without importing Utopia\App. Without the import, App cannot resolve in the Appwrite\GraphQL namespace and will cause fatal errors. Either add use Utopia\App; or complete the refactoring by changing all type hints from App to Http.

app/controllers/shared/api/auth.php (1)

33-41: ⚠️ Potential issue | 🔴 Critical

Type hint mismatch - App is no longer imported.

Line 40 uses App $utopia type hint in the closure, but Utopia\App was replaced with Utopia\Http on line 7. This will cause a fatal error at runtime since App is undefined.

🐛 Proposed fix
-    ->action(function (App $utopia, Request $request, Document $project, Reader $geodb, Authorization $authorization) {
+    ->action(function (Http $utopia, Request $request, Document $project, Reader $geodb, Authorization $authorization) {
src/Appwrite/Platform/Tasks/Specs.php (1)

334-336: ⚠️ Potential issue | 🔴 Critical

Undefined class App at line 335 - will cause fatal error at runtime.

Line 335 uses new App('UTC') but Utopia\App is not imported. The file imports Utopia\Http instead (line 15), which suggests an incomplete migration from App to Http. Since Utopia\Http has the same constructor signature and accepts the timezone parameter, change new App('UTC') to new Http('UTC') on line 335. This same issue exists in src/Appwrite/Platform/Tasks/Migrate.php:88 and src/Appwrite/SDK/Specification/Format.php also declares the undefined App type hint.

app/controllers/mock.php (1)

283-289: ⚠️ Potential issue | 🔴 Critical

Fix shutdown hook type-hint for utopia resource in 3 files.

App is not imported in any of these files, so the type-hint will cause a fatal error at runtime. The injected utopia resource is an instance of Utopia\Http, which provides both getRoute() and match(Request $request) methods. Change the type-hint to Http to match the injected resource.

Affected files and lines:

  • app/controllers/mock.php line 288
  • app/controllers/shared/api.php (multiple shutdown hooks)
  • app/controllers/shared/api/auth.php
🔧 Example fix (from mock.php)
-    ->action(function (App $utopia, Response $response, Request $request) {
+    ->action(function (Http $utopia, Response $response, Request $request) {
🤖 Fix all issues with AI agents
In `@app/realtime.php`:
- Line 19: Add the missing import for the App class so PHP resolves new
App('UTC') correctly at runtime: insert a `use Utopia\App;` alongside the other
use statements near the top of the file so the `new App('UTC')` instantiation
(symbol: App) references the correct Utopia\App class instead of the global
namespace.

In `@src/Appwrite/SDK/Specification/Format.php`:
- Around line 5-7: The file is missing an import for the App class used in the
Format class type hint and the constructor parameter; add the appropriate import
(e.g., use Appwrite\App;) at the top of the file so the Format class's type hint
and the __construct(App $app, ...) parameter resolve correctly instead of
assuming Appwrite\SDK\Specification\App.

@ChiragAgg5k ChiragAgg5k force-pushed the upgrade-utopia-queue branch 2 times, most recently from db807a3 to 4f935ee Compare February 4, 2026 05:45
Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (4)
app/controllers/api/vcs.php (1)

1767-1853: ⚠️ Potential issue | 🔴 Critical

Add missing Request dependency injection.

The action function requires Request $request parameter (used on the final line), but ->inject('request') is missing from the route's dependency chain. Utopia Http does not auto-inject Request by type-hint alone; explicit injection is required.

🛠️ Suggested fix
 Http::patch('/v1/vcs/github/installations/:installationId/repositories/:repositoryId')
     ->desc('Update external deployment (authorize)')
     ->groups(['api', 'vcs'])
     ->label('scope', 'vcs.write')
@@
     ->inject('gitHub')
+    ->inject('request')
     ->inject('response')
app/controllers/api/messaging.php (3)

481-487: ⚠️ Potential issue | 🟠 Major

Msg91 providers can never be enabled at creation.

$options['from'] is never set and there’s no from param, so $enabled is always forced to false even with valid credentials.

Suggested fix
         if (
             $enabled === true
             && \array_key_exists('senderId', $credentials)
             && \array_key_exists('authKey', $credentials)
-            && \array_key_exists('from', $options)
+            && \array_key_exists('templateId', $credentials)
         ) {

2329-2335: ⚠️ Potential issue | 🟠 Major

APNS update stores bundleId under the wrong key.

You write bundle but the enablement check expects bundleId, which can prevent enabling after an update.

Suggested fix
-            $credentials['bundle'] = $bundleId;
+            $credentials['bundleId'] = $bundleId;

2513-2521: ⚠️ Potential issue | 🟠 Major

Cursor should use the document, not $cursorDocument[0].

getDocument() returns a Document; indexing it is likely null/invalid and can break cursor pagination.

Suggested fix
-            $cursor->setValue($cursorDocument[0]);
+            $cursor->setValue($cursorDocument);
🧹 Nitpick comments (5)
app/controllers/api/migrations.php (1)

453-457: Remove duplicate setProject() in CSV import trigger.

setProject() is invoked twice in a row; likely a copy/paste artifact. If you intended to pass other context (e.g., platform/user), replace the duplicate with the missing call.

Suggested tweak
         $queueForMigrations
             ->setMigration($migration)
             ->setProject($project)
-            ->setProject($project)
             ->trigger();
app/http.php (1)

184-184: $pools parameter is unused in createDatabase.

PHPMD already flagged this; consider removing the parameter and adjusting call sites.

Suggested change (update call sites accordingly)
-function createDatabase(Http $app, string $resourceKey, string $dbName, array $collections, mixed $pools, callable $extraSetup = null): void
+function createDatabase(Http $app, string $resourceKey, string $dbName, array $collections, callable $extraSetup = null): void
app/controllers/general.php (1)

63-63: Remove unused $utopia parameter from router() and call sites.

PHPMD flags this as an unused parameter. Dropping it reduces noise without changing behavior.

♻️ Proposed update
-function router(Http $utopia, Database $dbForPlatform, callable $getProjectDB, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, array $platform, string $previewHostname, Authorization $authorization, ?Key $apiKey, DeleteEvent $queueForDeletes, int $executionsRetentionCount)
+function router(Database $dbForPlatform, callable $getProjectDB, SwooleRequest $swooleRequest, Request $request, Response $response, Log $log, Event $queueForEvents, StatsUsage $queueForStatsUsage, Func $queueForFunctions, Executor $executor, Reader $geodb, callable $isResourceBlocked, array $platform, string $previewHostname, Authorization $authorization, ?Key $apiKey, DeleteEvent $queueForDeletes, int $executionsRetentionCount)
 {
     ...
 }
-            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $authorization, $apiKey, $queueForDeletes, $executionsRetentionCount)) {
+            if (router($dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $authorization, $apiKey, $queueForDeletes, $executionsRetentionCount)) {
                 $utopia->getRoute()?->label('router', true);
             }
-        if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $authorization, $apiKey, $queueForDeletes, $executionsRetentionCount)) {
+        if (router($dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $authorization, $apiKey, $queueForDeletes, $executionsRetentionCount)) {
             $utopia->getRoute()?->label('router', true);
         }
-            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $authorization, $apiKey, $queueForDeletes, $executionsRetentionCount)) {
+            if (router($dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $authorization, $apiKey, $queueForDeletes, $executionsRetentionCount)) {
                 $utopia->getRoute()?->label('router', true);
             }
-            if (router($utopia, $dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $authorization, $apiKey, $queueForDeletes, $executionsRetentionCount)) {
+            if (router($dbForPlatform, $getProjectDB, $swooleRequest, $request, $response, $log, $queueForEvents, $queueForStatsUsage, $queueForFunctions, $executor, $geodb, $isResourceBlocked, $platform, $previewHostname, $authorization, $apiKey, $queueForDeletes, $executionsRetentionCount)) {
                 $utopia->getRoute()?->label('router', true);
             }

Also applies to: 898-902, 1189-1193, 1582-1584, 1617-1619

app/init/resources.php (2)

1207-1209: Suspicious unused parameter in plan resource callback.

The $plan parameter in the callback signature has a default value and is never used - the function always returns an empty array. This parameter appears to be dead code. If $plan is meant to be injected from another resource, it should be listed in the dependencies array (the third parameter to setResource).

-Http::setResource('plan', function (array $plan = []) {
+Http::setResource('plan', function () {
     return [];
 });

86-87: Global variable pattern for register initialization is systematic and intentional.

The global $register; usage is part of an established bootstrap pattern used consistently across all entry points (app/init/resources.php, app/cli.php, app/worker.php, etc.) where the globally-initialized registry is immediately exposed through each system's resource container. While the global keyword creates a temporary dependency during bootstrap, the register is properly registered as a resource rather than left as an implicit dependency throughout the application.

If future refactoring removes the global bootstrap pattern entirely in favor of pure dependency injection at the initialization layer, this global usage would be eliminated naturally.

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
app/controllers/api/vcs.php (1)

597-611: ⚠️ Potential issue | 🟡 Minor

Fix undefined $redirectFailure in the project-not-found branch.
It’s checked before assignment, which can trigger notices and skip a valid redirect.

🛠️ Suggested fix
-        $state = \json_decode($state, true);
+        $state = \json_decode($state, true);
+        $redirectFailure = \is_array($state) ? ($state['failure'] ?? '') : '';
         $projectId = $state['projectId'] ?? '';
🧹 Nitpick comments (1)
app/controllers/general.php (1)

63-63: Remove or use unused $utopia parameter in router.
Line 63: $utopia isn’t referenced in the function body, which matches the static analysis warning. If not required, drop it and update call sites.

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Fix all issues with AI agents
In `@composer.json`:
- Around line 75-77: Update composer.json to ensure your environment and
dependency constraints match the new package requirements: verify and bump the
PHP engine requirement to ">=8.1" if you intend to upgrade to utopia-php/swoole
1.0.*, and restrict or pin "utopia-php/swoole" and "utopia-php/telemetry" to
compatible versions if you cannot meet Swoole 6.x or the newer telemetry
dependency versions; specifically check and adjust the "require" entries for
utopia-php/swoole and utopia-php/telemetry and the "platform" PHP version
(engine) constraint, and run composer why-not / composer update to confirm no
other packages conflict with PHP 8.1 or Swoole 6 before merging.
- Line 72: Pin the dependency to a commit SHA to ensure reproducible builds:
replace the current version string "utopia-php/queue": "dev-fix-servers-lib as
0.15.3" in composer.json with a commit-pinned reference using the branch plus
SHA, e.g. "utopia-php/queue": "dev-fix-servers-lib#<COMMIT_SHA> as 0.15.3",
where <COMMIT_SHA> is the exact commit you want to lock to.

@ChiragAgg5k ChiragAgg5k merged commit ce49b8e into 1.8.x Feb 4, 2026
71 of 72 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants