[loks0n]

Picks up the Swoole multipart upload hardening from appwrite/appwrite#14897, which shipped in utopia-php/http 2.0.0-rc35. The http constraint gets a floor of ^2.0.0-rc35 so older releases can't come back through a lock refresh.

rc34+ requires utopia-php/validators ^2.0. utopia-php/storage 4.4.x still required ^1.0, so this also moves storage to 4.5.0, the first release on validators 2. No aliases.

Package	Before	After
utopia-php/http	2.0.0-rc32	2.0.0-rc35
utopia-php/storage	4.4.0	4.5.0
utopia-php/validators	1.0.1	2.0.0
utopia-php/servers	0.4.11	0.4.12
utopia-php/client, composer/semver, open-telemetry/api, symfony/http-client		patch

The validators 2.0 break is limited to moving the base class Utopia\Validator (shimmed until 3.0). The executor only uses concrete validators (Text, Integer, Boolean, WhiteList, Assoc, AnyOf, FloatValidator), whose names don't change.

Storage 4.5.0 brings the S3 fixes since 4.4.1: recursive deletes that remove whole directories and refuse whole-bucket or out-of-root deletes, path-style bucket addressing, and streamed reads. Appwrite Cloud already runs 22 of those 23 commits in production.

Verified on Swoole 6.2.0 (the phpswoole/swoole:6.2.0 CI image and the executor's utopia-base:php-8.5-2.0.0 base image):

• composer test:unit: 37 tests OK
• composer analyze (PHPStan): no errors
• composer refactor:check and composer format:check: clean
• The executor's SwooleCoroutine\Server + Http stack with a /v1/health route answers GET with 200 "ok" on both rc32 and rc35. The upload hardening takes effect on rc35 and not on rc32.

The E2E suite needs a Docker socket and runtimes, so CI is the check for that.

🤖 Generated with Claude Code