feat: add Saloon v4 support (CVE-2026-33182, CVE-2026-33183)

composer.json

@@ -22,9 +22,9 @@
         "php": "^8.2",
         "guzzlehttp/guzzle": "^7.9",
         "kelunik/link-header-rfc5988": "^1.0",
-        "saloonphp/pagination-plugin": "^2.2",
-        "saloonphp/rate-limit-plugin": "^2.0",
-        "saloonphp/saloon": "^3.10"
+        "saloonphp/pagination-plugin": "^2.2|^2.3",
+        "saloonphp/rate-limit-plugin": "^2.0|^2.5",
+        "saloonphp/saloon": "^3.10|^4.0"
     },
     "require-dev": {
         "laravel/pint": "^1.17",

src/Api/Administrations/GetAdministrationRequest.php

@@ -16,12 +16,12 @@ public function __construct(
     }
 
     /**
-     * Returns the full URL to bypass the connector's base URL.
-     * The Administrations endpoint does not use an administration ID in the path.
+     * The Administrations endpoint does not use an administration ID in the path,
+     * so we navigate up from the connector's base URL (which includes the admin ID).
      */
     public function resolveEndpoint(): string
     {
-        return 'https://moneybird.com/api/v2/administrations/'.$this->id;
+        return '/../administrations/'.$this->id;
     }
 
     public function createDtoFromResponse(Response $response): Administration

src/Api/Administrations/GetAdministrationsRequest.php

@@ -10,12 +10,12 @@
 class GetAdministrationsRequest extends BaseJsonGetRequest
 {
     /**
-     * Returns the full URL to bypass the connector's base URL.
-     * The Administrations endpoint does not use an administration ID in the path.
+     * The Administrations endpoint does not use an administration ID in the path,
+     * so we navigate up from the connector's base URL (which includes the admin ID).
      */
     public function resolveEndpoint(): string
     {
-        return 'https://moneybird.com/api/v2/administrations';
+        return '/../administrations';
     }
 
     public function createDtoFromResponse(Response $response): Administration

src/Api/Support/BaseEndpoint.php

@@ -4,6 +4,8 @@
 
 namespace Sandorian\Moneybird\Api\Support;
 
+use Saloon\Exceptions\Request\FatalRequestException;
+use Saloon\Exceptions\Request\RequestException;
 use Saloon\Http\Request;
 use Saloon\PaginationPlugin\Paginator;
 use Sandorian\Moneybird\Api\MoneybirdApiClient;
@@ -17,8 +19,8 @@ public function __construct(
     /**
      * @return mixed
      *
-     * @throws \Saloon\Exceptions\Request\FatalRequestException
-     * @throws \Saloon\Exceptions\Request\RequestException
+     * @throws FatalRequestException
+     * @throws RequestException
      */
     public function create(array $data): BaseDto
     {