Write down three divergences instead of changing behaviour

[rasuvaeff]

Class B of the full-cycle review (docs/reviews/review-openapi-contract-2026-09-06-full-cycle.md): divergences from the specification with no observable harm. Documented, not fixed — deliberately.

Where	The specification	This package
A percent-encoded delimiter in a pipeDelimited/spaceDelimited value	| and space MUST be percent-encoded inside a value, so ?ids=a%7Cb is the single element a|b	folds the encoded form into the delimiter and reads two elements
A Header Object carrying name or in	both MUST NOT be specified	ignored, not refused
example and examples together	mutually exclusive	both kept as annotations

The delimiter one is the interesting call. parse_str('ids=a%7Cb') gives {"ids":"a|b"}, and a PHP application that decodes and then splits reads two elements — exactly as this package does. Conforming to the text would make the validator disagree with the application it validates for, which is the one thing a validator must not do. The cost is real and now stated: a value containing the delimiter cannot be expressed at all.

deepObject was checked and is not in this list: f%5Ba%5D=1 and f[a]=1 are one parameter here and in PHP's own parsing (probe delimiters3.php).

No source changes; composer build and bin/package-audit green.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 4aa77b26-b5c9-49c4-b9aa-a963bfe52a69

Warning

Your free Security trial is over. An organization admin can upgrade to Advanced for continuous pull request security review or dismiss this notice.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}