← All breaking-change reports

PayPal 2.0.0 breaking change: controller methods switched from positional parameters to a single options object

paypal · breaking · 2025-11-06 · upstream source

What changed

controller methods switched from positional parameters to a single options object

From the upstream announcement:

Automated commit message

Who is affected

Every controller method call must wrap its positional arguments into a single options object whose keys follow the documented parameter names in order (body first, then the paypal* header options, then requestOptions).

To find out whether your repo is hit — file and line number, no code leaving your machine:

npx mendapi sync  # the one network call: fetch the change feed
npx mendapi scan --repo .  # local scan, nothing leaves your machine

How to fix it

mendapi ships a deterministic migration pack for this change (paypal-server-sdk-v2-options-object). Preview the patch locally (dry-run is the default; nothing is modified without --apply):

npx mendapi fix --repo . --migration paypal-server-sdk-v2-options-object

The pack is idempotent, gold-regression tested, and safe on partially migrated code.

What the migration does:

Every controller method call must wrap its positional arguments into a single options object whose keys follow the documented parameter names in order (body first, then the paypal* header options, then requestOptions). For the common single-argument case the rewrite is trivial ( fn(body) becomes fn({ body }) ) and safely regex-able; multi-argument calls need argument-position-to-key mapping, which is AST-codemod territory (b-track) but fully deterministic since the parameter order is documented per method. Confidence medium because the safe automated coverage is the dominant single-argument form.

Before:

await client.ordersController.createOrder(orderRequest, undefined, requestId);

After:

await client.ordersController.createOrder({ body: orderRequest, paypalRequestId: requestId });

Detected and tracked by mendapi — Dependabot for every API you depend on. Scans run locally; your code never leaves your machine.

Related

Change data is recorded from upstream provider releases, changelogs and OpenAPI spec diffs; every article names its source.