Changelog

BC breakCompare Unreleased

Added

• $connector->users()->summaries() and bans() take any number of Steam IDs and cut a list over 100 into requests of 100 that pool() sends concurrency at a time, 5 by default, each once. The first failure is thrown after the chunks in flight have answered, and no chunk goes out after it (#121).
• Testing\SteamFake, a Saloon MockClient faking every endpoint through the resource chain, with Testing\SteamResponse for each envelope and failure Steam sends and a factory per DTO under Testing\Factories, moved from the Laravel bridge. A new fake clears MemoryStore, and faked summaries() and bans() answer each request with the players it asks for (#120).

Changed

• BC break SteamConnector is final. A subclass moves its overrides to SteamConfig: rateLimits, rateLimitStore, sender or tooManyRequestsCooldown (#123).
• DTO constructors and fromArray(), the RequestSending, ResponseReceived and SteamSender constructors, and the exceptions’ named constructors are @internal, outside SemVer from 1.0.0. Tests build DTOs with the Testing factories, and PHPStan with bleeding edge reports a call from outside the SDK (#123).

Fixed

• A request sent without the key (SendsNoApiKey) is limited apart from a configured key, as a connector without one would limit it: it no longer spends the daily budget or is refused while the key is spent or locked, and a 429 on it locks only requests without the key, under SteamConnector:anonymous. rateLimits count it apart as well (#138).

9 October 2026BC breakRelease 0.9.0

Added

• GetServerInfoRequest (ISteamWebAPIUtil), returning Steam’s clock as a DateTimeImmutable in UTC, reached anonymously through the new WebApiResource as $connector->webApi()->serverTime() (#98).
• GetSupportedApiListRequest (ISteamWebAPIUtil) with the WebApiInterface, WebApiMethod and WebApiParameter DTOs, listing every Web API method Steam lets the caller see as $connector->webApi()->supportedApis(). It implements the new SendsOptionalApiKey contract, so the configured key goes along and adds the methods it can call, a connector without one gets the anonymous list, and a rejected key raises InvalidApiKeyException (#99).
• rateLimits on SteamConfig, a list of the rate limit plugin’s Limits that replaces the daily budget of 100 000, with a key or without; [] meters nothing locally, and a 429 from Steam still raises SteamRateLimitException. Two limits sharing a name throw the new InvalidRateLimitException as the config is built (#101).
• sender on SteamConfig, any Saloon Sender in place of the default GuzzleSender. Whatever is injected, a request Steam never answered, a PSR-18 network exception included, raises SteamConnectionException and is retried (#102).
• tooManyRequestsCooldown on SteamConfig, the seconds a 429 without Retry-After refuses requests locally, 60 by default, with a key or without and whatever rateLimits is. A Retry-After from Steam still wins, and a value under 1 throws InvalidRateLimitException as the config is built (#117).

Changed

• BC break SteamConnector::sender() returns SteamSender, which wraps the sender in use, instead of a GuzzleSender, so addMiddleware(), getHandlerStack() and getGuzzleClient() are gone from it. Callers that need Guzzle pass a GuzzleSender of their own as sender (#102).
• GitHub Actions are pinned to full commit SHAs with the version in a trailing comment, and the docs workflow runs @fkrzski/docs-schema 0.1.0 instead of the latest release. A tag can be moved to another commit after the fact, so the version tags used since 0.3.0 did not fix what runs (#103).

Fixed

• The daily budget resets at 00:00 UTC instead of 24 hours after the first request of its window. The limit is now named 100000_every_utc_midnight, so counters already held in a persistent store restart from zero once (#100).
• PlayerSummary maps the communityvisibilitystate 2 that Steam returns for friends-only profiles to the new CommunityVisibility::FriendsOnly, where it threw UnexpectedValueException and failed the whole GetPlayerSummariesRequest batch. Any other value outside 1–3 still throws (#106).

7 October 2026BC breakRelease 0.8.0

Added

• GetNewsForAppRequest (ISteamNews) with the AppNews and NewsItem DTOs, returning a page of a game’s news with Steam’s total for the filter, reached anonymously through the new NewsResource as $connector->news()->appNews(). Steam answers an app ID it does not know exactly like some apps that exist, so both raise the new AppNewsUnavailableException (#77).
• SteamConnector::onFailure(), fired once per call under send(), sendAsync() and pool() with the exception the caller gets: after the retries, as the SDK exception, and also for a request refused locally for the quota or a missing key. An exception thrown in the hook is dropped, so the caller still gets the original (#80).
• SteamConnector::onRequest() and onResponse(), fired on every attempt including under sendAsync() and pool(), with the key-free RequestSending and ResponseReceived payloads: the Steam method, the query, the attempt number and, on the response, the status and the duration in seconds. A 429 reaches onResponse before it becomes SteamRateLimitException, and an exception thrown in a hook reaches the caller (#79).
• symfony/var-dumper in suggest, because the default dumpers behind debug() need it and Composer does not surface Saloon’s own suggestion. Without it the first debugged request fails on a missing class (#78).

Changed

• BC break getPrevious() is null on SteamConnectionException and on a SteamApiException raised from a 4xx or 5xx, where 0.7.0 chained Saloon’s FatalRequestException or RequestException, so callers read the status from getCode() and the payload from response. Guzzle 7 quotes the request URI, API key included, in the exception beneath, and error trackers store every exception on the chain (#86).
• BC break ProfileNotPublicException::forSteamId(), ProfileNotPublicException::forPrivateOrMissing() and SteamUserNotFoundException::forVanity() require the Saloon Response, so callers building them by hand have to pass one. GetOwnedGamesRequest and ResolveVanityUrlRequest now do, which gives their failures a response, code 200 rather than 0 and the Steam method in the message (#90).
• BC break send(), sendAsync() and pool() raise the failure Steam reports in a 200 payload for GetOwnedGamesRequest, GetSteamLevelRequest, GetBadgesRequest, GetRecentlyPlayedGamesRequest, GetCommunityBadgeProgressRequest, ResolveVanityUrlRequest, UpToDateCheckRequest and GetServersAtAddressRequest, where they used to return the Response and leave the exception to dto(), so callers catch it around the call itself. That brings it to onFailure() and to the pool() exception handler, while the resource methods throw what they did before (#94).
• Every exception built from a Steam response, and SteamConnectionException, opens its message with the Steam method called, as in GetFriendList: Steam API request failed with HTTP 500. Classes and codes are unchanged, so only code matching on the message text is affected (#81).

Fixed

• SteamConnector::debugRequest(), and debug() through it, pass the callable a copy of the PSR request with the API key masked as key=***, while the request sent to Steam keeps it. A pasted dump or a logging callback used to leak the key (#78).
• SteamConnectionException masks the API key as key=*** in the Guzzle message it quotes (#86).
• SteamConfig marks apiKey as #[\SensitiveParameter], so an invalid timeout or retry setting no longer puts the key among the stack-trace arguments when zend.exception_ignore_args is off (#86).
• sendAsync() and pool() count a 4xx or 5xx against the daily budget and turn a 429 into SteamRateLimitException, refusing the requests after it locally, where they used to count only a 2xx and raise SteamApiException with code 429. A failed response runs the response pipeline as under send(), so debugResponse() sees it too (#85).
• sendAsync() and pool() return the promise their response pipeline settles, so a middleware throwing on a 2xx rejects the call and a Response a middleware swaps in reaches the caller. Saloon ran that pipeline on a branch it dropped, losing both (#79).

1 October 2026BC breakRelease 0.7.0

Added

• ApiKeyNotConfiguredException for a request that needs an API key sent from a config carrying none, and for a blank key handed to SteamConfig. Both are raised locally, so neither costs a round trip or a slot of the daily budget (#59).
• GetSdrConfigRequest (ISteamApps) with the SdrConfig, SdrPointOfPresence and SdrRelay DTOs, mapping the Steam Datagram Relay network a game connects through, keyed by point-of-presence code and reached anonymously as $connector->apps()->sdrConfig(). An app ID Steam does not know answers 500, which raises AppNotFoundException at once rather than being retried (#66).
• GetServersAtAddressRequest (ISteamApps) with the GameServer DTO and the ServerRegion enum, listing the game servers Steam knows at an IPv4 address, reached anonymously as $connector->apps()->serversAtAddress(); an address with none returns an empty list. An address Steam rejects raises the new InvalidServerAddressException, and any other refusal raises the root SteamApiException carrying Steam’s own message (#65).
• SteamConnectionException for a request that never reached Steam — a timeout, a DNS failure, a TLS error, a refused connection. It carries no response and a 0 code, with Saloon’s FatalRequestException on getPrevious() (#60).
• UpToDateCheckRequest (ISteamApps) with the AppVersionCheck DTO, telling whether a game server’s version is current and which one Steam requires, reached anonymously through the new AppsResource as $connector->apps()->upToDateCheck(). Steam answers an app ID it does not know exactly like a game running no versioned servers, so both raise the new AppVersionUnavailableException (#64).
• connectTimeout and requestTimeout on SteamConfig, in seconds, falling back to Saloon’s 10 and 30 when left null. 0 disables the limit and a negative value throws InvalidTimeoutException (#61).
• tries, retryInterval (in milliseconds) and exponentialBackoff on SteamConfig, defaulting to a single attempt; fewer than one try or a negative interval throws InvalidRetryException. Only a request Steam never answered or a 5xx is retried, never a 4xx or SteamRateLimitException, because every attempt spends a slot of the daily budget (#62).

Changed

• BC break SteamConfig::$apiKey is a ?string defaulting to null, which makes GetNumberOfCurrentPlayersRequest and GetGlobalAchievementPercentagesForAppRequest reachable with no key configured. Callers reading the property as a string have to handle null (#59).
• BC break Transport failures out of send(), sendAsync() and pool() surface as SteamConnectionException rather than Saloon’s FatalRequestException. Callers catching the Saloon exception have to catch the SDK one instead (#60).
• A connector without an API key meters no daily budget, because Steam bills the 100 000 requests to the key; a 429 from Steam still raises SteamRateLimitException (#59).
• InvalidApiKeyException::missing() reads “Steam received no API key” rather than “Steam API key is missing”, so Steam’s verdict no longer reads like the local configuration error (#59).
• A status the SDK gives no meaning of its own raises the root SteamApiException with Saloon’s RequestException on getPrevious(), which is what lets the retry loop see it (#62).