fix: refresh REQUEST after URI GET normalization

[rahul05ranjan]

Description

Fixes #9872. SiteURIFactory can normalize $_GET after PHP has populated $_REQUEST, leaving stale query values for getVar() and Validation::withRequest(). This follows the direction agreed on in #10587: refresh REQUEST once during URI parsing while keeping getVar()'s existing lookup behavior.

Summary

SiteURIFactory parses the normalized query
  → update GET
  → refresh only REQUEST keys derived from GET, POST, or COOKIE
  → retain unrelated or independently changed REQUEST values

Superglobals::getRequestData() provides the merged source data in PHP's configured order. Both URI parsing paths use it before and after GET normalization. No general synchronization is added to setGetArray().

Evidence

• Before: The two new SiteURI regressions fail on develop: the old query key remains in REQUEST, and code stays stale.
  After: SiteURIFactoryDetectRoutePathTest.php passes (34 tests, 42 assertions), including a withRequest() validation check and preservation of application-set values.
• SuperglobalsTest.php passes (56 tests, 115 assertions); SiteURIFactoryTest.php passes (8 tests, 32 assertions).
• File-scoped PHPStan and PHP CS Fixer checks pass on the changed PHP files. Full CI remains with GitHub Actions.

Merge Danger

Door: Two-way. Reverting the commit restores the previous request initialization behavior.

Blast Radius: Request initialization in the two SiteURIFactory URI parsing paths. An application-defined REQUEST value that is identical to its old merged source value cannot be distinguished from that source value; the refresh treats it as source-derived.

Checklist:

• Securely signed commit (verified by GitHub)
• Component PHPDoc added where it explains the merge and refresh behavior
• Unit testing with >80% coverage (focused tests pass; coverage not measured locally)
• User guide changelog updated; the existing getVar() reference remains accurate
• Conforms to style guide (file-scoped PHP CS Fixer passes)

[rahul05ranjan]

@paulbalandan The new PR's workflows are waiting for approval to run. Could you approve them when you get to this review? Here's the PHPUnit run; the focused local results are in the PR description.

[michalsn]

Overall, I think this looks good.

[michalsn]

I think this method should be marked as "internal".

[Copilot]

🟡 Changes recommended

The new tests depend on the host’s request_order, and SiteURIFactory’s PHPDoc omits its new $_REQUEST side effect.

3 open findings

• Avoid assuming GET is enabled in the request-order regression fixture · New
• Make request-order test deterministic by passing GP explicitly · New
• Update PHPDoc to document $_REQUEST mutations · New

What changed in this PR

Fixes stale $_REQUEST values after URI query normalization while preserving custom entries.

Changes:

• Adds configured GET/POST/COOKIE merging.
• Refreshes source-derived REQUEST entries during URI parsing.
• Adds regression tests and changelog documentation.

Base branch was unavailable; develop compatibility policy was applied. A focused PHP runtime probe passed; full validation remains with CI.

File	Description
system/​Superglobals.php	Adds merged request-data retrieval.
system/​HTTP/​SiteURIFactory.php	Refreshes REQUEST after GET normalization.
tests/​system/​SuperglobalsTest.php	Tests request merging semantics.
tests/​system/​HTTP/​SiteURIFactoryDetectRoutePathTest.php	Tests URI normalization regressions.
user_guide_src/​source/​changelogs/​v4.7.5.rst	Documents the fix.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.