Update dependency guzzlehttp/guzzle to v8 #112

Open

professeur-chen wants to merge 1 commit from renovate/guzzlehttp-guzzle-8.x into trunk

pull from: renovate/guzzlehttp-guzzle-8.x

merge into: l4p1n-bot:trunk

l4p1n-bot:trunk

l4p1n-bot:renovate/pestphp-pest-plugin-laravel-5.x

l4p1n-bot:renovate/pestphp-pest-5.x

l4p1n-bot:renovate/typescript-7.x

l4p1n-bot:renovate/major-symfony

l4p1n-bot:renovate/google-protobuf-5.x

l4p1n-bot:features/refactor-rewrite

l4p1n-bot:translations

l4p1n-bot:features/yes

l4p1n-bot:features/self-role-menu

Conversation 1 Commits 1 Files changed 1 +1 -1

professeur-chen commented 2026-07-21 06:32:10 +02:00

Collaborator

Copy link

This PR contains the following updates:

Package	Change	Age	Confidence
guzzlehttp/guzzle (source)	^7.2 → ^8.0

---

Release Notes

guzzle/guzzle (guzzlehttp/guzzle)

v8.0.1

Compare Source

Security

• Reject request URI hosts and Host header values that are not printable ASCII (GHSA-v5mv-p594-2x33)
• Reject URI hosts with a percent escape or that are not valid RFC 3986 hosts (GHSA-v5mv-p594-2x33)
• Reject numeric-looking URI hosts with trailing dots, read as IPv4 addresses (GHSA-v5mv-p594-2x33)
• Treat percent-escaped cookie domains as exact-match-only (GHSA-f7vp-7xgx-4w4r)
• Regenerate a derived Host header after client URI rewrites (GHSA-v5mv-p594-2x33)

v8.0.0

Compare Source

Added

• Add SensitiveParameter metadata to credential-bearing parameters so PHP 8.2+ redacts their values in exception traces
• Add HTTP/3 request support to the built-in cURL handlers when PHP 8.4+ and libcurl provide HTTP/3 support
• Add Multiplexing::NONE support as a client, cURL multi handler, and conditional request option
• Add generic and structured PHPDoc annotations to client request/config option, async promise, handler, middleware, pool, and mock handler APIs
• Add ConnectTimeoutException for connect-phase timeouts, extending ConnectException
• Add NetworkException for no-response network failures
• Add NetworkTimeoutException for no-response transport timeouts
• Add ResponseTransferException, with ResponseTimeoutException for response-transfer timeouts
• Add PSR-17 request_factory, response_factory, stream_factory, and uri_factory request options
• Add explicit close() lifecycle methods to the built-in cURL handlers and concrete cURL factory
• Add HandlerClosedException for pending transfers rejected by CurlMultiHandler::close()
• Add persistent transport sharing modes (TransportSharing::PERSISTENT_PREFER and TransportSharing::PERSISTENT_REQUIRE)
• Add ProxyOptions for proxy option resolution
• Add ResponseException for request failures with responses
• Add auth middleware for built-in Basic and Digest authentication

Changed

• Canonicalize IPv6 hosts in Digest challenge cache keys
• Canonicalize IPv6 hosts in cookie domains, host-only identities, and domain matching
• Restrict cookie domain suffix matching to valid non-literal, nonnumeric host names
• Reject Secure cookies and insecure overlays received over insecure connections
• Enforce the __Secure- and __Host- prefix requirements on response cookies
• Hardened FileCookieJar and SessionCookieJar persistence against unsafe unserialization
• Reject native PHP serialization of runtime objects
• Restrict persisted FileCookieJar cookie files to owner-only permissions
• Require persisted cookie data to use JSON lists and construct all records before changing the jar
• Normalize persistent cookie JSON failures as RuntimeException
• Moved the internal Utils time, timeout, IDN, and environment helpers to dedicated internal classes
• Adjusted guzzlehttp/promises version constraint to ^3.0
• Adjusted guzzlehttp/psr7 version constraint to ^3.0
• Quote multipart Content-Type boundary parameters when required
• Added parameter and return types to SetCookie methods
• Added native property types to supported public cURL handler state properties
• Added a string return type to SetCookie::__toString()
• Validate proxy and no-proxy option types strictly across handlers
• Match leading-dot no-proxy entries against the bare domain and split string no-proxy lists on whitespace
• Validate force_ip_resolve, protocols, and delay ranges at the client boundary
• Treat a matching proxy no entry as final even without a scheme-specific proxy entry
• Validate proxy URLs in the built-in handlers and reject malformed or unsupported ones up front
• Default a port-less proxy to 1080 in the stream handler, matching libcurl
• Downgrade HTTP/3 requests to HTTP/2 or HTTP/1.1 when the proxy is resolved from environment variables
• Throw RequestException, not InvalidArgumentException, for an unavailable proxy or TLS feature
• Resolve proxy environment variables in the stream handler, consistent with the cURL handlers
• Honor no_proxy/NO_PROXY from the environment in the stream handler, including * to disable proxying
• Reject an environment-resolved https:// or SOCKS proxy in the stream handler, matching its proxy option behavior
• Require cURL proxy header separation for first-class Proxy-Authorization on every route
• Reject every first-class Proxy-Authorization field, including empty, on stream proxies
• Reject raw CURLOPT_PROXYHEADER without proxy header separation support
• Pass the request as the second argument to on_headers callbacks
• Pass the Pool iterable key as a trailing argument to per-request observer callbacks
• Declare strict types across remaining source files
• Reject request option values that do not match their documented types
• Reject invalid idn_conversion, retries, and built-in handler on_stats option values before use
• Reject non-finite floats in the query and form_params options
• Reject non-string scalar values in the body option
• Apply automatic Expect: 100-Continue injection to HTTP/1.1 requests only
• Reject invalid SetCookie constructor field types instead of coercing them
• Validate and normalize request framing across the built-in cURL and stream handlers
• Reject raw cURL request options outside the built-in cURL handlers' allow-list
• Reject non-string raw cURL header-list entries before applying them
• Reject proxy tunnels that require fresh connections when persistent transport sharing requires reuse
• Reject PHP stream context options outside the built-in stream handler allow-list
• Reject selected request options ignored by incompatible built-in handlers
• Treat only null as an omitted path or name when clearing cookies
• Validate malformed auth request option arrays
• Reject colons in built-in Basic usernames and ASCII control characters in Basic credentials
• Move built-in Basic and Digest authentication handling to the default auth middleware
• Reject unchallenged Digest probes for body-bearing requests instead of replaying the request unauthenticated
• Reject malformed Digest challenge parameter lists that libcurl's Digest parser may have tolerated
• Reuse Digest challenges to authorize subsequent body-less requests preemptively
• Advance the Digest nonce count when a stale challenge repeats the same nonce during the initial handshake
• Remove first-class NTLM authentication from the auth request option
• Stop forwarding the generic auth request option when following cross-origin redirects
• Limit the Referer header to the origin on cross-origin redirects
• Follow only redirect status codes 301, 302, 303, 307, and 308
• Reject invalid HandlerStack::remove() arguments
• Require Pool request collections to be iterable
• Raised the built-in cURL handler floor to libcurl 7.34.0 with SSL support
• Store response cookies without a Domain attribute as host-only cookies
• Prefer cookie Max-Age over Expires when both attributes are present
• Match cookie names case-sensitively in CookieJar::getCookieByName()
• Ignore float-like or exponent Max-Age cookie values instead of truncating them
• Tighten invalid response handling and avoid exposing response-derived cURL stats
• Reject malformed response protocol versions and reason phrases
• Escape controls and malformed UTF-8 when copying raw values into exception messages
• Reject malformed or conflicting response Content-Length and combinations with Transfer-Encoding
• Expose raw stream-handler Transfer-Encoding metadata and coalesced framing in progress on newer PHP
• Wrap malformed redirect Location values in BadResponseException
• Default HTTPS requests sent by the built-in cURL and stream handlers to TLS 1.2 or newer
• Apply the stream handler crypto_method option through the SSL context so it consistently controls the minimum TLS version
• Validate built-in handler timeout options before applying them
• Require a request when constructing TransferException and its subclasses
• Classify empty, malformed, or handler-unsupported request protocol versions as request exceptions
• Classify additional cURL transport failures without a response as NetworkException
• Classify stream connect failures as ConnectException, with connect timeouts as ConnectTimeoutException
• Classify stream transport failures without a response as NetworkException, with timeouts as NetworkTimeoutException
• Classify generic response-aware request failures as ResponseException
• Classify response-aware transfer failures as ResponseTransferException
• The stream handler returns an empty body and releases the connection at the end of the headers for HEAD and CONNECT-2xx exchanges and 1xx, 204, and 304 responses
• The stream handler no longer writes to the sink option or reads trailing bytes for responses that cannot carry a body
• Reject short buffered stream-handler bodies against Content-Length, including decoded gzip/deflate
• Normalize duplicate Content-Length casings and preserve encoded values on decoded responses
• Reject unrepresentable byte counts and response sizes requiring integer bounds as ResponseException
• Ignore cURL informational responses other than 101 Switching Protocols before the final response
• Treat response sink rewind failures as ResponseException and skip non-seekable sink rewinds
• Classify redirect request-body rewind failures as ResponseException
• Ignore stream source close failures after a complete response body transfer
• Throw GuzzleHttp\Exception\InvalidArgumentException for invalid built-in handler options
• Classify built-in cURL handle, sink, and HTTP/3 setup failures as RequestException
• Throw ConnectTimeoutException for connect timeouts
• Throw NetworkTimeoutException for cURL no-response timeout errors
• Throw ResponseTimeoutException for response-aware transfer timeouts
• Enforce the timeout option as a total transfer deadline in the stream handler when it buffers the response
• Reject stream handler responses whose header block arrives after the timeout deadline
• Stop consulting the default_socket_timeout ini setting in the stream handler
• Treat stream handler read_timeout as an idle timeout for every request stage, defaulting to 60 seconds
• Default the cURL connect timeout to 60 seconds, with connect_timeout set to 0 disabling it
• Stop the stream handler from injecting User-Agent and From header values from the user_agent and from ini settings
• Classify request-body stream size detection, read, stringification, and rewind failures as RequestException or ResponseException by phase
• Classify cURL response sink write failures, including timeouts, as ResponseException or RequestException by phase
• Treat request method names case-sensitively in built-in handler and redirect method-specific behavior
• Treat PHP resources passed as sink as caller-owned in the built-in cURL and stream handlers
• Use the configured PSR-17 URI factory when parsing redirect Location headers
• Allow built-in cURL handler progress callbacks to abort transfers with truthy return values
• Normalize built-in handler progress callback arguments to integer byte counts
• Reject built-in cURL progress throwables with ResponseException when a response exists, otherwise RequestException
• Release built-in cURL easy handles before invoking on_stats
• Prefer CURLOPT_XFERINFOFUNCTION for built-in cURL progress callbacks when available
• Made MessageFormatter final and required Middleware::log() formatters to implement MessageFormatterInterface
• Made CurlFactory, CurlHandler, CurlMultiHandler, MockHandler, and StreamHandler final
• Made static utility classes non-instantiable and declared GuzzleHttp\Handler\Proxy final
• Pass the request to on_trailers callbacks, reject non-callable on_trailers values, and wrap on_trailers callback exceptions in ResponseException
• Wait for in-progress HTTP/2-capable connections by default (multiplex defaults to Multiplexing::WAIT)
• Require libcurl 7.65.2 or newer for HTTP/2 requests so multiplex waiting is never silently unavailable
• Require libcurl 7.54.0 for HTTPS proxies and requests tunneled through HTTP proxies
• Suppress proxy CONNECT response headers for tunneled requests
• Point rejections of the raw CURLOPT_PIPEWAIT cURL option at the multiplex request option
• Reject raw CURLMOPT_PIPELINING in favour of the multiplex cURL multi handler option
• Reject required multiplexing when the final CURLOPT_HTTPAUTH mask permits NTLM
• Reject cURL multi options that the runtime libcurl cannot apply
• Reject unknown handler constructor options
• Reject invalid select_timeout cURL multi handler option values
• Reject raw cURL multi connection cap options in favour of the named options
• Parse Set-Cookie strings with RFC 6265 whitespace trimming
• Ignore valueless Set-Cookie attributes that require a value when parsing
• Trim only the trailing CRLF from the stream handler header block
• Fail streamed uploads immediately when the body cannot be resent for an auth challenge

Removed

• Dropped support for PHP 7.2 and 7.3
• Removed Client::__call(); use the typed HTTP verb methods or request()/requestAsync()
• Removed ClientInterface::getConfig(); the concrete Client::getConfig() remains available
• Removed support for the GUZZLE_CURL_SELECT_TIMEOUT environment variable; use CurlMultiHandler's select_timeout option
• Removed support for the handler request option; configure the handler on the client
• Removed direct access to CurlMultiHandler::$_mh; pass CURLMOPT_* values through constructor options instead
• Removed RedirectMiddleware::$defaultSettings; use RedirectMiddleware::DEFAULT_SETTINGS
• Removed the deprecated RetryMiddleware::exponentialDelay() method
• Removed the deprecated RequestException::wrapException() method
• Removed the deprecated Utils::describeType() method
• Removed Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
• Removed deprecated GuzzleHttp namespace functions in favor of native or class equivalents
• Removed Utils::defaultCaBundle(); rely on the system trust store or pass a bundle path via the verify option
• Removed HandlerStack::__toString()
• Removed RequestException::getHandlerContext() and ConnectException::getHandlerContext()
• Removed response access from RequestException; use ResponseException
• Removed Utils::isHostInNoProxy(); use ProxyOptions helpers for Guzzle 8 no-proxy matching
• Removed Utils::isUriInNoProxy(); use ProxyOptions::isUriInNoProxy()
• Removed Handler\Proxy::wrapTlsFallback(); the default handler stack selects the cURL or stream handler by TLS support automatically

v7.15.2

Compare Source

Security

• Reject non-printable-ASCII and percent-escaped URI hosts and Host headers (GHSA-v5mv-p594-2x33)
• Reject request URI hosts that contain a URI authority delimiter (GHSA-v5mv-p594-2x33)
• Reject numeric-looking URI hosts with trailing dots, read as IPv4 addresses (GHSA-v5mv-p594-2x33)
• Treat numeric-in-any-base and percent-escaped cookie domains as exact-match-only (GHSA-f7vp-7xgx-4w4r)
• Regenerate a derived Host header after client URI rewrites (GHSA-v5mv-p594-2x33)

Fixed

• Preserve RequestException when the stream handler rejects a request before opening a stream

v7.15.1

Compare Source

Security

• Preserve host-only cookie scope and require explicit persistence markers (GHSA-wm3w-8rrp-j577)
• Bound response cookie admission and generated Cookie headers (GHSA-f283-ghqc-fg79)
• Exclude URI fragments from Referer headers generated for redirects (GHSA-h95v-h523-3mw8)

v7.15.0

Compare Source

Added

• Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.13
• Use locale-independent ASCII folding for all case normalization and comparison
• Bound cURL upload reads to the declared Content-Length
• Sanitize the cURL error text exposed through exception handler context
• Fail closed when a named cURL multi connection cap cannot be applied
• Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured
• Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles
• Isolate HTTP proxy tunnels from opaque shared connection caches
• Trigger runtime deprecations for previously deprecated functionality in 7.1.0

Deprecated

• Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
• Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array
• Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support

Fixed

• Defer cURL requests created from multi callbacks until native execution unwinds
• Fail synchronous waits from native cURL callbacks promptly instead of self-deadlocking
• Guard cURL multi handle removal against progress callbacks re-entering the handler
• Scope promise waits on the cURL multi handler to the awaited transfer
• Strip Content-Length and Transfer-Encoding when redirects discard the request body
• Stop re-applying the delay request option to followed redirects

v7.14.2

Compare Source

Security

• Prevent first-class and proxy URL credentials from reaching origins (GHSA-94pj-82f3-465w)

v7.14.1

Compare Source

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.12.5

Fixed

• Fail closed when a proxy tunnel isolation cURL option cannot be applied
• Normalize Stringable proxy credential values before computing connection-reuse section signatures
• Restore conservative credential redaction for unparseable proxies with multiple @ separators
• Redact request URI credentials from the stream handler connection error message
• Reject enabled response streaming (stream => true) on cap-configured stream handlers
• Distinguish CurlMultiHandler and StreamHandler outcomes in connection-cap custom-handler guidance
• Reject raw cURL options that conflict with explicit multiplexing guarantees
• Stop explicit multiplexing conflict checks faulting on non-array cURL multi options values
• Reject required multiplexing when the final CURLOPT_HTTPAUTH mask permits NTLM
• Require an integer CURLMOPT_PIPELINING when combined with explicit multiplexing
• Check the required multiplexing cleartext proxy rule against the final cURL configuration
• Bound cURL multi handler blocking selects by the earliest pending request delay
• Stop synchronous cURL multi handler waits blocking on other transfers once the target has settled
• Stop cURL multi completion processing double-settling promises canceled from completion callbacks
• Run ready promise queue tasks before sleeping for delayed cURL multi requests
• Avoid integer overflow in cURL multi delay timing on 32-bit platforms
• Roll back failed cURL multi handle attachment instead of leaving requests pending
• Release the cURL easy handle when the on_stats callback throws
• Normalize response trailer field names to lowercase with values in wire order
• Retain response trailers only when an on_trailers callback is configured
• Validate the on_trailers callback before starting a cURL transfer
• Reject the on_trailers request option on the stream handler, which cannot observe trailers
• Match cookies, proxy schemes, auth types, and header names with locale-independent ASCII folding
• Reject proxy option values that Guzzle cannot classify identically to ext-curl

v7.14.0

Compare Source

Added

• Added the on_trailers request option to expose parsed HTTP response trailers
• Added the multiplex request option with Multiplexing::* modes to control or require HTTP/2 multiplexing
• Added rejection of explicit multiplex requests when CURLMOPT_PIPELINING disables multiplexing
• Added the max_host_connections and max_total_connections client and cURL multi handler options

Changed

• Redirects that discard the request body no longer require it to be rewindable
• Synchronous cURL multi handler requests no longer wait for other queued transfers
• Section SOCKS proxy connections by credentials on libcurl before 7.69.0
• Reject request-level CURLOPT_SHARE when combined with authenticated SOCKS proxy configuration
• Redact proxy userinfo containing raw control bytes in cURL errors
• Check linked curl/libcurl NTLM support before applying NTLM auth
• Clarify that NTLM is deprecated by both Guzzle and curl/libcurl
• Remove deprecation for the raw cURL CURLOPT_CERTINFO option
• Warn when a cURL multi option cannot be applied

Deprecated

• Deprecate the raw CURLOPT_PIPEWAIT cURL option in favour of the multiplex request option
• Deprecate unknown handler constructor options
• Deprecate invalid select_timeout cURL multi handler option values
• Deprecate raw cURL multi connection cap options in favour of the named options

v7.13.3

Compare Source

Changed

• Adjusted guzzlehttp/promises version constraint to ^2.5.1
• Adjusted guzzlehttp/psr7 version constraint to ^2.12.4
• Pass explicit trim characters ahead of the PHP 8.6 trim default change

Fixed

• Stop matching cookie domains against hosts with a trailing newline
• Reject HTTP status codes and certificate type extensions with a trailing newline
• Treat PCRE engine failures as invalid cookie names during cookie validation
• Report PCRE engine failures when formatting log messages
• Report PCRE engine failures when splitting no_proxy values

v7.13.2

Compare Source

Fixed

• Stop the cURL multi handler busy-waiting on request delays shorter than one second
• Stop cURL HEAD requests with request bodies hanging on responses that declare a content length
• The cURL handler no longer transmits request bodies on HEAD requests
• Preserve response headers when a response includes HTTP trailers
• Harden cURL response header block detection when HTTP trailers are received
• Corrected the PSR-7 class names in the Pool iterator exception
• Redirect body rewind failures no longer leak a bare RuntimeException

v7.13.1

Compare Source

Fixed

• Allow middleware to rewrite partial URIs before transports validate them

v7.13.0

Compare Source

Added

• Added the crypto_method_max request option to cap the maximum TLS protocol version
• Added HTTP QUERY redirect support, preserving method and body on 301 and 302

Changed

• Section proxy tunnel connection reuse by credential so distinct credentials never share a tunnel
• Isolate concurrent foreign cURL proxy tunnels added while another owner's tunnel is active
• Route credentialed HTTP(S) proxy Proxy-Authorization headers through cURL proxy header handling
• Reject request-level CURLOPT_SHARE when combined with authenticated HTTP/HTTPS proxy tunnel configuration
• Remove deprecation for raw cURL CURLOPT_PREREQFUNCTION callbacks when defined by PHP cURL
• Route TLS 1.2 crypto_method requests to the stream handler when cURL cannot select TLS 1.2
• Reject final request URIs missing a scheme or host before transfer

Deprecated

• Deprecate invalid protocols, force_ip_resolve, delay, cookies, and allow_redirects values

v7.12.3

Compare Source

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.12.3

Security

• Treat IP and numeric cookie domains as exact-match-only (GHSA-g446-98w2-8p5w)

v7.12.2

Compare Source

Fixed

• Clamp out-of-range Max-Age so a very large value no longer overflows to an already-expired timestamp
• Use strict comparison in CookieJar conflict resolution so distinct numeric-string names don't overwrite
• Store a cookie whose Domain has a trailing dot on the origin host instead of silently discarding it
• Fix StreamHandler hard-failing on bracketed IPv6 literal hosts when force_ip_resolve is set
• Use strict cookie Path comparison so CookieJar::clear() with a numeric path keeps a distinct-path cookie
• Fixed cookie handling for falsey Domain, Max-Age, path, and name values
• Fixed decode_content handling for falsey string values
• Fixed deprecated request option values reaching built-in handlers before normalization

v7.12.1

Compare Source

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.12.1

Fixed

• Reject proxy URLs with a malformed scheme in the cURL handlers instead of letting libcurl mishandle them

Security

• Reject HTTPS proxies when the installed libcurl lacks HTTPS-proxy support (GHSA-wpwq-4j6v-78m3)
• Reject dot-only cookie Domain attributes as match-all (GHSA-cwxw-98qj-8qjx)

v7.12.0

Compare Source

Added

• Added RequestOptions constants for curl, retries, and stream_context

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.12
• Constrain cURL transport sharing to safe libcurl DNS and SSL session support
• Resolve proxy environment variables in the cURL handlers; libcurl no longer reads the environment itself
• Ignore proxy environment variables when the proxy request option makes a decision
• Disable proxy environment variables on Windows SAPIs other than CLI (httpoxy hardening)
• Redact proxy credentials from cURL handler error messages, following Psr7\Utils::redactUserInfo()
• Normalize no-proxy domain and IP literal matching across the cURL and stream handlers

Deprecated

• Deprecated the request-level handler option, which will be ignored in 8.0
• Deprecated raw cURL request options outside the built-in cURL handlers' allow-list
• Deprecated the CURLOPT_PROXYTYPE cURL request option; set the proxy type via a scheme-prefixed proxy URL
• Deprecated PHP stream context options outside the built-in stream handler allow-list
• Deprecated passing ntlm as a built-in auth type
• Deprecated Utils::describeType()
• Deprecated non-finite floats in the query and form_params options; 8.0 rejects them
• Deprecated non-string scalar values in the body option; 8.0 rejects them

Fixed

• Fix cURL TLS and HTTP/2 capability detection using libcurl feature checks
• Fix proxy no list matches being re-proxied through environment-configured proxies by libcurl
• Fix no list and NO_PROXY matching to support IP CIDR ranges, matching libcurl
• Fix the stream handler not applying scheme-less proxies and their credentials

v7.11.2

Compare Source

Fixed

• Fixed non-finite float values emitting coercion warnings on PHP 8.5

v7.11.1

Compare Source

Fixed

• Ignore request-level transport_sharing, matching other unknown request options

v7.11.0

Compare Source

Added

• Added support for providing the proxy request option's no value as a comma-delimited string
• Added the protocols request option to restrict allowed URI schemes for request transfers
• Added cert_type and ssl_key_type request options for TLS certificate and private-key file types
• Added PHP stream handler support for the ssl_key request option
• Added transport sharing via the transport_sharing client and cURL handler options

Changed

• Adjusted guzzlehttp/promises version constraint to ^2.5
• Adjusted guzzlehttp/psr7 version constraint to ^2.11
• Allowed domainless SetCookie instances to be stored without wildcard request matching
• Changed no-proxy matching to respect request ports for host-and-port rules
• Prevented CurlMultiHandler destructors from throwing during cleanup
• Improved invalid response handling across handlers

Deprecated

• Deprecated non-iterable Pool request collections, which will be rejected in 8.0
• Deprecated non-uppercase easy request methods; 8.0 preserves method casing
• Deprecated non-string headers request option values, which will be rejected in 8.0
• Deprecated empty headers request option value arrays, which will be rejected in 8.0
• Deprecated empty and malformed request protocol versions, which will be rejected in 8.0
• Deprecated conflicting raw cURL request options, including CURLOPT_SHARE, which will be rejected in 8.0
• Deprecated scalar-coerced idn_conversion request option values, which will be rejected in 8.0
• Deprecated invalid documented request option value types, which will be rejected in 8.0
• Deprecated selected request options ignored by incompatible built-in handlers, which will be rejected in 8.0
• Deprecated RequestException::wrapException(), which will be removed in 8.0
• Deprecated RetryMiddleware::exponentialDelay(), which will be removed in 8.0

v7.10.6

Compare Source

Fixed

• CurlMultiHandler now rejects the promise when CurlFactory::finish() throws, preserving sibling transfers
• SetCookie now normalizes unparseable Expires values to null instead of false
• Fix stream handler decoded gzip/deflate truncation by dropping invalid Content-Length

v7.10.5

Compare Source

Fixed

• Defer cURL multi cancellation cleanup until after progress callbacks return
• Classify additional stream handler connection failures as ConnectException

v7.10.4

Compare Source

Fixed

• Fix IPv6 literal matching in no-proxy rules
• Handle cURL multi completion messages without handles after cancelled transfers
• Fix magic client request methods such as options() to uppercase inferred HTTP methods

v7.10.3

Compare Source

Fixed

• Fail clearly when an HTTP response header line is invalid
• Remove middleware by name when the name is also a callable string
• Treat empty request protocol versions as HTTP/1.1

v7.10.2

Compare Source

Fixed

• Normalize HTTP version request options before applying them to PSR-7 requests
• Use string values for headers generated by request preparation and response decoding

v7.10.1

Compare Source

Fixed

• Fail clearly when cURL options cannot be applied
• Fail clearly when the certificate option is malformed
• Fail clearly when JSON decode depth is invalid
• Fail clearly when session cookie data is malformed
• Fail clearly when the stream progress option is not callable
• Prevent response creation failures from exposing stale cURL responses

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [guzzlehttp/guzzle](http://guzzlephp.org/) ([source](https://github.com/guzzle/guzzle)) | `^7.2` → `^8.0` |  |  | --- ### Release Notes <details> <summary>guzzle/guzzle (guzzlehttp/guzzle)</summary> ### [`v8.0.1`](https://github.com/guzzle/guzzle/blob/HEAD/CHANGELOG.md#801---2026-07-26) [Compare Source](https://github.com/guzzle/guzzle/compare/8.0.0...8.0.1) ##### Security - Reject request URI hosts and `Host` header values that are not printable ASCII (GHSA-v5mv-p594-2x33) - Reject URI hosts with a percent escape or that are not valid RFC 3986 hosts (GHSA-v5mv-p594-2x33) - Reject numeric-looking URI hosts with trailing dots, read as IPv4 addresses (GHSA-v5mv-p594-2x33) - Treat percent-escaped cookie domains as exact-match-only (GHSA-f7vp-7xgx-4w4r) - Regenerate a derived `Host` header after client URI rewrites (GHSA-v5mv-p594-2x33) ### [`v8.0.0`](https://github.com/guzzle/guzzle/blob/HEAD/CHANGELOG.md#800---2026-07-20) [Compare Source](https://github.com/guzzle/guzzle/compare/7.15.2...8.0.0) ##### Added - Add `SensitiveParameter` metadata to credential-bearing parameters so PHP 8.2+ redacts their values in exception traces - Add HTTP/3 request support to the built-in cURL handlers when PHP 8.4+ and libcurl provide HTTP/3 support - Add `Multiplexing::NONE` support as a client, cURL multi handler, and conditional request option - Add generic and structured PHPDoc annotations to client request/config option, async promise, handler, middleware, pool, and mock handler APIs - Add `ConnectTimeoutException` for connect-phase timeouts, extending `ConnectException` - Add `NetworkException` for no-response network failures - Add `NetworkTimeoutException` for no-response transport timeouts - Add `ResponseTransferException`, with `ResponseTimeoutException` for response-transfer timeouts - Add PSR-17 `request_factory`, `response_factory`, `stream_factory`, and `uri_factory` request options - Add explicit `close()` lifecycle methods to the built-in cURL handlers and concrete cURL factory - Add `HandlerClosedException` for pending transfers rejected by `CurlMultiHandler::close()` - Add persistent transport sharing modes (`TransportSharing::PERSISTENT_PREFER` and `TransportSharing::PERSISTENT_REQUIRE`) - Add `ProxyOptions` for proxy option resolution - Add `ResponseException` for request failures with responses - Add auth middleware for built-in Basic and Digest authentication ##### Changed - Canonicalize IPv6 hosts in Digest challenge cache keys - Canonicalize IPv6 hosts in cookie domains, host-only identities, and domain matching - Restrict cookie domain suffix matching to valid non-literal, nonnumeric host names - Reject Secure cookies and insecure overlays received over insecure connections - Enforce the `__Secure-` and `__Host-` prefix requirements on response cookies - Hardened `FileCookieJar` and `SessionCookieJar` persistence against unsafe unserialization - Reject native PHP serialization of runtime objects - Restrict persisted `FileCookieJar` cookie files to owner-only permissions - Require persisted cookie data to use JSON lists and construct all records before changing the jar - Normalize persistent cookie JSON failures as `RuntimeException` - Moved the internal `Utils` time, timeout, IDN, and environment helpers to dedicated internal classes - Adjusted `guzzlehttp/promises` version constraint to `^3.0` - Adjusted `guzzlehttp/psr7` version constraint to `^3.0` - Quote multipart `Content-Type` boundary parameters when required - Added parameter and return types to `SetCookie` methods - Added native property types to supported public cURL handler state properties - Added a `string` return type to `SetCookie::__toString()` - Validate proxy and no-proxy option types strictly across handlers - Match leading-dot no-proxy entries against the bare domain and split string no-proxy lists on whitespace - Validate `force_ip_resolve`, protocols, and `delay` ranges at the client boundary - Treat a matching proxy `no` entry as final even without a scheme-specific proxy entry - Validate proxy URLs in the built-in handlers and reject malformed or unsupported ones up front - Default a port-less proxy to 1080 in the stream handler, matching libcurl - Downgrade HTTP/3 requests to HTTP/2 or HTTP/1.1 when the proxy is resolved from environment variables - Throw `RequestException`, not `InvalidArgumentException`, for an unavailable proxy or TLS feature - Resolve proxy environment variables in the stream handler, consistent with the cURL handlers - Honor `no_proxy`/`NO_PROXY` from the environment in the stream handler, including `*` to disable proxying - Reject an environment-resolved `https://` or SOCKS proxy in the stream handler, matching its `proxy` option behavior - Require cURL proxy header separation for first-class `Proxy-Authorization` on every route - Reject every first-class `Proxy-Authorization` field, including empty, on stream proxies - Reject raw `CURLOPT_PROXYHEADER` without proxy header separation support - Pass the request as the second argument to `on_headers` callbacks - Pass the `Pool` iterable key as a trailing argument to per-request observer callbacks - Declare strict types across remaining source files - Reject request option values that do not match their documented types - Reject invalid `idn_conversion`, `retries`, and built-in handler `on_stats` option values before use - Reject non-finite floats in the `query` and `form_params` options - Reject non-string scalar values in the `body` option - Apply automatic `Expect: 100-Continue` injection to HTTP/1.1 requests only - Reject invalid `SetCookie` constructor field types instead of coercing them - Validate and normalize request framing across the built-in cURL and stream handlers - Reject raw cURL request options outside the built-in cURL handlers' allow-list - Reject non-string raw cURL header-list entries before applying them - Reject proxy tunnels that require fresh connections when persistent transport sharing requires reuse - Reject PHP stream context options outside the built-in stream handler allow-list - Reject selected request options ignored by incompatible built-in handlers - Treat only `null` as an omitted path or name when clearing cookies - Validate malformed `auth` request option arrays - Reject colons in built-in Basic usernames and ASCII control characters in Basic credentials - Move built-in Basic and Digest authentication handling to the default auth middleware - Reject unchallenged Digest probes for body-bearing requests instead of replaying the request unauthenticated - Reject malformed Digest challenge parameter lists that libcurl's Digest parser may have tolerated - Reuse Digest challenges to authorize subsequent body-less requests preemptively - Advance the Digest nonce count when a stale challenge repeats the same nonce during the initial handshake - Remove first-class NTLM authentication from the `auth` request option - Stop forwarding the generic `auth` request option when following cross-origin redirects - Limit the `Referer` header to the origin on cross-origin redirects - Follow only redirect status codes 301, 302, 303, 307, and 308 - Reject invalid `HandlerStack::remove()` arguments - Require `Pool` request collections to be iterable - Raised the built-in cURL handler floor to libcurl 7.34.0 with SSL support - Store response cookies without a `Domain` attribute as host-only cookies - Prefer cookie `Max-Age` over `Expires` when both attributes are present - Match cookie names case-sensitively in `CookieJar::getCookieByName()` - Ignore float-like or exponent `Max-Age` cookie values instead of truncating them - Tighten invalid response handling and avoid exposing response-derived cURL stats - Reject malformed response protocol versions and reason phrases - Escape controls and malformed UTF-8 when copying raw values into exception messages - Reject malformed or conflicting response `Content-Length` and combinations with `Transfer-Encoding` - Expose raw stream-handler `Transfer-Encoding` metadata and coalesced framing in `progress` on newer PHP - Wrap malformed redirect `Location` values in `BadResponseException` - Default HTTPS requests sent by the built-in cURL and stream handlers to TLS 1.2 or newer - Apply the stream handler `crypto_method` option through the SSL context so it consistently controls the minimum TLS version - Validate built-in handler timeout options before applying them - Require a request when constructing `TransferException` and its subclasses - Classify empty, malformed, or handler-unsupported request protocol versions as request exceptions - Classify additional cURL transport failures without a response as `NetworkException` - Classify stream connect failures as `ConnectException`, with connect timeouts as `ConnectTimeoutException` - Classify stream transport failures without a response as `NetworkException`, with timeouts as `NetworkTimeoutException` - Classify generic response-aware request failures as `ResponseException` - Classify response-aware transfer failures as `ResponseTransferException` - The stream handler returns an empty body and releases the connection at the end of the headers for HEAD and CONNECT-2xx exchanges and 1xx, 204, and 304 responses - The stream handler no longer writes to the `sink` option or reads trailing bytes for responses that cannot carry a body - Reject short buffered stream-handler bodies against `Content-Length`, including decoded gzip/deflate - Normalize duplicate `Content-Length` casings and preserve encoded values on decoded responses - Reject unrepresentable byte counts and response sizes requiring integer bounds as `ResponseException` - Ignore cURL informational responses other than `101 Switching Protocols` before the final response - Treat response sink rewind failures as `ResponseException` and skip non-seekable sink rewinds - Classify redirect request-body rewind failures as `ResponseException` - Ignore stream source close failures after a complete response body transfer - Throw `GuzzleHttp\Exception\InvalidArgumentException` for invalid built-in handler options - Classify built-in cURL handle, `sink`, and HTTP/3 setup failures as `RequestException` - Throw `ConnectTimeoutException` for connect timeouts - Throw `NetworkTimeoutException` for cURL no-response timeout errors - Throw `ResponseTimeoutException` for response-aware transfer timeouts - Enforce the `timeout` option as a total transfer deadline in the stream handler when it buffers the response - Reject stream handler responses whose header block arrives after the `timeout` deadline - Stop consulting the `default_socket_timeout` ini setting in the stream handler - Treat stream handler `read_timeout` as an idle timeout for every request stage, defaulting to 60 seconds - Default the cURL connect timeout to 60 seconds, with `connect_timeout` set to `0` disabling it - Stop the stream handler from injecting `User-Agent` and `From` header values from the `user_agent` and `from` ini settings - Classify request-body stream size detection, read, stringification, and rewind failures as `RequestException` or `ResponseException` by phase - Classify cURL response sink write failures, including timeouts, as `ResponseException` or `RequestException` by phase - Treat request method names case-sensitively in built-in handler and redirect method-specific behavior - Treat PHP resources passed as `sink` as caller-owned in the built-in cURL and stream handlers - Use the configured PSR-17 URI factory when parsing redirect `Location` headers - Allow built-in cURL handler `progress` callbacks to abort transfers with truthy return values - Normalize built-in handler `progress` callback arguments to integer byte counts - Reject built-in cURL `progress` throwables with `ResponseException` when a response exists, otherwise `RequestException` - Release built-in cURL easy handles before invoking `on_stats` - Prefer `CURLOPT_XFERINFOFUNCTION` for built-in cURL progress callbacks when available - Made `MessageFormatter` final and required `Middleware::log()` formatters to implement `MessageFormatterInterface` - Made `CurlFactory`, `CurlHandler`, `CurlMultiHandler`, `MockHandler`, and `StreamHandler` final - Made static utility classes non-instantiable and declared `GuzzleHttp\Handler\Proxy` final - Pass the request to `on_trailers` callbacks, reject non-callable `on_trailers` values, and wrap `on_trailers` callback exceptions in `ResponseException` - Wait for in-progress HTTP/2-capable connections by default (`multiplex` defaults to `Multiplexing::WAIT`) - Require libcurl 7.65.2 or newer for HTTP/2 requests so multiplex waiting is never silently unavailable - Require libcurl 7.54.0 for HTTPS proxies and requests tunneled through HTTP proxies - Suppress proxy CONNECT response headers for tunneled requests - Point rejections of the raw `CURLOPT_PIPEWAIT` cURL option at the `multiplex` request option - Reject raw `CURLMOPT_PIPELINING` in favour of the `multiplex` cURL multi handler option - Reject required multiplexing when the final `CURLOPT_HTTPAUTH` mask permits NTLM - Reject cURL multi options that the runtime libcurl cannot apply - Reject unknown handler constructor options - Reject invalid `select_timeout` cURL multi handler option values - Reject raw cURL multi connection cap options in favour of the named options - Parse `Set-Cookie` strings with RFC 6265 whitespace trimming - Ignore valueless `Set-Cookie` attributes that require a value when parsing - Trim only the trailing CRLF from the stream handler header block - Fail streamed uploads immediately when the body cannot be resent for an auth challenge ##### Removed - Dropped support for PHP 7.2 and 7.3 - Removed `Client::__call()`; use the typed HTTP verb methods or `request()`/`requestAsync()` - Removed `ClientInterface::getConfig()`; the concrete `Client::getConfig()` remains available - Removed support for the `GUZZLE_CURL_SELECT_TIMEOUT` environment variable; use `CurlMultiHandler`'s `select_timeout` option - Removed support for the `handler` request option; configure the handler on the client - Removed direct access to `CurlMultiHandler::$_mh`; pass `CURLMOPT_*` values through constructor `options` instead - Removed `RedirectMiddleware::$defaultSettings`; use `RedirectMiddleware::DEFAULT_SETTINGS` - Removed the deprecated `RetryMiddleware::exponentialDelay()` method - Removed the deprecated `RequestException::wrapException()` method - Removed the deprecated `Utils::describeType()` method - Removed `Utils::jsonDecode()` and `Utils::jsonEncode()` in favor of native JSON functions - Removed deprecated `GuzzleHttp` namespace functions in favor of native or class equivalents - Removed `Utils::defaultCaBundle()`; rely on the system trust store or pass a bundle path via the `verify` option - Removed `HandlerStack::__toString()` - Removed `RequestException::getHandlerContext()` and `ConnectException::getHandlerContext()` - Removed response access from `RequestException`; use `ResponseException` - Removed `Utils::isHostInNoProxy()`; use `ProxyOptions` helpers for Guzzle 8 no-proxy matching - Removed `Utils::isUriInNoProxy()`; use `ProxyOptions::isUriInNoProxy()` - Removed `Handler\Proxy::wrapTlsFallback()`; the default handler stack selects the cURL or stream handler by TLS support automatically ### [`v7.15.2`](https://github.com/guzzle/guzzle/releases/tag/7.15.2) [Compare Source](https://github.com/guzzle/guzzle/compare/7.15.1...7.15.2) ##### Security - Reject non-printable-ASCII and percent-escaped URI hosts and `Host` headers (GHSA-v5mv-p594-2x33) - Reject request URI hosts that contain a URI authority delimiter (GHSA-v5mv-p594-2x33) - Reject numeric-looking URI hosts with trailing dots, read as IPv4 addresses (GHSA-v5mv-p594-2x33) - Treat numeric-in-any-base and percent-escaped cookie domains as exact-match-only (GHSA-f7vp-7xgx-4w4r) - Regenerate a derived `Host` header after client URI rewrites (GHSA-v5mv-p594-2x33) ##### Fixed - Preserve `RequestException` when the stream handler rejects a request before opening a stream ### [`v7.15.1`](https://github.com/guzzle/guzzle/blob/HEAD/CHANGELOG.md#7151---2026-07-18) [Compare Source](https://github.com/guzzle/guzzle/compare/7.15.0...7.15.1) ##### Security - Preserve host-only cookie scope and require explicit persistence markers (GHSA-wm3w-8rrp-j577) - Bound response cookie admission and generated `Cookie` headers (GHSA-f283-ghqc-fg79) - Exclude URI fragments from `Referer` headers generated for redirects (GHSA-h95v-h523-3mw8) ### [`v7.15.0`](https://github.com/guzzle/guzzle/blob/HEAD/CHANGELOG.md#7150---2026-07-17) [Compare Source](https://github.com/guzzle/guzzle/compare/7.14.2...7.15.0) ##### Added - Added `Multiplexing::NONE` support as a client, cURL multi handler, and conditional request option ##### Changed - Adjusted `guzzlehttp/psr7` version constraint to `^2.13` - Use locale-independent ASCII folding for all case normalization and comparison - Bound cURL upload reads to the declared `Content-Length` - Sanitize the cURL error text exposed through exception handler context - Fail closed when a named cURL multi connection cap cannot be applied - Reject the request-level `CURLOPT_SHARE` cURL option when named connection caps are configured - Strengthen old-libcurl SOCKS isolation for raw `CURLOPT_PRE_PROXY` and opaque share handles - Isolate HTTP proxy tunnels from opaque shared connection caches - Trigger runtime deprecations for previously deprecated functionality in 7.1.0 ##### Deprecated - Deprecated `Utils::jsonDecode()` and `Utils::jsonEncode()` in favor of native JSON functions - Deprecated passing `CURLMOPT_PIPELINING` in the cURL multi handler `options` array - Deprecated passing `CURLOPT_PROXYHEADER` without cURL proxy header separation support ##### Fixed - Defer cURL requests created from multi callbacks until native execution unwinds - Fail synchronous waits from native cURL callbacks promptly instead of self-deadlocking - Guard cURL multi handle removal against progress callbacks re-entering the handler - Scope promise waits on the cURL multi handler to the awaited transfer - Strip `Content-Length` and `Transfer-Encoding` when redirects discard the request body - Stop re-applying the `delay` request option to followed redirects ### [`v7.14.2`](https://github.com/guzzle/guzzle/blob/HEAD/CHANGELOG.md#7142---2026-07-14) [Compare Source](https://github.com/guzzle/guzzle/compare/7.14.1...7.14.2) ##### Security - Prevent first-class and proxy URL credentials from reaching origins (GHSA-94pj-82f3-465w) ### [`v7.14.1`](https://github.com/guzzle/guzzle/blob/HEAD/CHANGELOG.md#7141---2026-07-13) [Compare Source](https://github.com/guzzle/guzzle/compare/7.14.0...7.14.1) ##### Changed - Adjusted `guzzlehttp/psr7` version constraint to `^2.12.5` ##### Fixed - Fail closed when a proxy tunnel isolation cURL option cannot be applied - Normalize Stringable proxy credential values before computing connection-reuse section signatures - Restore conservative credential redaction for unparseable proxies with multiple `@` separators - Redact request URI credentials from the stream handler connection error message - Reject enabled response streaming (`stream => true`) on cap-configured stream handlers - Distinguish CurlMultiHandler and StreamHandler outcomes in connection-cap custom-handler guidance - Reject raw cURL options that conflict with explicit multiplexing guarantees - Stop explicit multiplexing conflict checks faulting on non-array cURL multi `options` values - Reject required multiplexing when the final `CURLOPT_HTTPAUTH` mask permits NTLM - Require an integer `CURLMOPT_PIPELINING` when combined with explicit multiplexing - Check the required multiplexing cleartext proxy rule against the final cURL configuration - Bound cURL multi handler blocking selects by the earliest pending request delay - Stop synchronous cURL multi handler waits blocking on other transfers once the target has settled - Stop cURL multi completion processing double-settling promises canceled from completion callbacks - Run ready promise queue tasks before sleeping for delayed cURL multi requests - Avoid integer overflow in cURL multi delay timing on 32-bit platforms - Roll back failed cURL multi handle attachment instead of leaving requests pending - Release the cURL easy handle when the `on_stats` callback throws - Normalize response trailer field names to lowercase with values in wire order - Retain response trailers only when an `on_trailers` callback is configured - Validate the `on_trailers` callback before starting a cURL transfer - Reject the `on_trailers` request option on the stream handler, which cannot observe trailers - Match cookies, proxy schemes, auth types, and header names with locale-independent ASCII folding - Reject proxy option values that Guzzle cannot classify identically to ext-curl ### [`v7.14.0`](https://github.com/guzzle/guzzle/blob/HEAD/CHANGELOG.md#7140---2026-07-08) [Compare Source](https://github.com/guzzle/guzzle/compare/7.13.3...7.14.0) ##### Added - Added the `on_trailers` request option to expose parsed HTTP response trailers - Added the `multiplex` request option with `Multiplexing::*` modes to control or require HTTP/2 multiplexing - Added rejection of explicit `multiplex` requests when `CURLMOPT_PIPELINING` disables multiplexing - Added the `max_host_connections` and `max_total_connections` client and cURL multi handler options ##### Changed - Redirects that discard the request body no longer require it to be rewindable - Synchronous cURL multi handler requests no longer wait for other queued transfers - Section SOCKS proxy connections by credentials on libcurl before 7.69.0 - Reject request-level `CURLOPT_SHARE` when combined with authenticated SOCKS proxy configuration - Redact proxy userinfo containing raw control bytes in cURL errors - Check linked curl/libcurl NTLM support before applying NTLM auth - Clarify that NTLM is deprecated by both Guzzle and curl/libcurl - Remove deprecation for the raw cURL `CURLOPT_CERTINFO` option - Warn when a cURL multi option cannot be applied ##### Deprecated - Deprecate the raw `CURLOPT_PIPEWAIT` cURL option in favour of the `multiplex` request option - Deprecate unknown handler constructor options - Deprecate invalid `select_timeout` cURL multi handler option values - Deprecate raw cURL multi connection cap options in favour of the named options ### [`v7.13.3`](https://github.com/guzzle/guzzle/blob/HEAD/CHANGELOG.md#7133---2026-07-08) [Compare Source](https://github.com/guzzle/guzzle/compare/7.13.2...7.13.3) ##### Changed - Adjusted `guzzlehttp/promises` version constraint to `^2.5.1` - Adjusted `guzzlehttp/psr7` version constraint to `^2.12.4` - Pass explicit trim characters ahead of the PHP 8.6 trim default change ##### Fixed - Stop matching cookie domains against hosts with a trailing newline - Reject HTTP status codes and certificate type extensions with a trailing newline - Treat PCRE engine failures as invalid cookie names during cookie validation - Report PCRE engine failures when formatting log messages - Report PCRE engine failures when splitting `no_proxy` values ### [`v7.13.2`](https://github.com/guzzle/guzzle/blob/HEAD/CHANGELOG.md#7132---2026-07-05) [Compare Source](https://github.com/guzzle/guzzle/compare/7.13.1...7.13.2) ##### Fixed - Stop the cURL multi handler busy-waiting on request delays shorter than one second - Stop cURL HEAD requests with request bodies hanging on responses that declare a content length - The cURL handler no longer transmits request bodies on HEAD requests - Preserve response headers when a response includes HTTP trailers - Harden cURL response header block detection when HTTP trailers are received - Corrected the PSR-7 class names in the Pool iterator exception - Redirect body rewind failures no longer leak a bare `RuntimeException` ### [`v7.13.1`](https://github.com/guzzle/guzzle/blob/HEAD/CHANGELOG.md#7131---2026-06-29) [Compare Source](https://github.com/guzzle/guzzle/compare/7.13.0...7.13.1) ##### Fixed - Allow middleware to rewrite partial URIs before transports validate them ### [`v7.13.0`](https://github.com/guzzle/guzzle/blob/HEAD/CHANGELOG.md#7130---2026-06-29) [Compare Source](https://github.com/guzzle/guzzle/compare/7.12.3...7.13.0) ##### Added - Added the `crypto_method_max` request option to cap the maximum TLS protocol version - Added HTTP QUERY redirect support, preserving method and body on 301 and 302 ##### Changed - Section proxy tunnel connection reuse by credential so distinct credentials never share a tunnel - Isolate concurrent foreign cURL proxy tunnels added while another owner's tunnel is active - Route credentialed HTTP(S) proxy Proxy-Authorization headers through cURL proxy header handling - Reject request-level `CURLOPT_SHARE` when combined with authenticated HTTP/HTTPS proxy tunnel configuration - Remove deprecation for raw cURL `CURLOPT_PREREQFUNCTION` callbacks when defined by PHP cURL - Route TLS 1.2 `crypto_method` requests to the stream handler when cURL cannot select TLS 1.2 - Reject final request URIs missing a scheme or host before transfer ##### Deprecated - Deprecate invalid protocols, force\_ip\_resolve, delay, cookies, and allow\_redirects values ### [`v7.12.3`](https://github.com/guzzle/guzzle/blob/HEAD/CHANGELOG.md#7123---2026-06-23) [Compare Source](https://github.com/guzzle/guzzle/compare/7.12.2...7.12.3) ##### Changed - Adjusted `guzzlehttp/psr7` version constraint to `^2.12.3` ##### Security - Treat IP and numeric cookie domains as exact-match-only (GHSA-g446-98w2-8p5w) ### [`v7.12.2`](https://github.com/guzzle/guzzle/blob/HEAD/CHANGELOG.md#7122---2026-06-23) [Compare Source](https://github.com/guzzle/guzzle/compare/7.12.1...7.12.2) ##### Fixed - Clamp out-of-range `Max-Age` so a very large value no longer overflows to an already-expired timestamp - Use strict comparison in `CookieJar` conflict resolution so distinct numeric-string names don't overwrite - Store a cookie whose `Domain` has a trailing dot on the origin host instead of silently discarding it - Fix `StreamHandler` hard-failing on bracketed IPv6 literal hosts when `force_ip_resolve` is set - Use strict cookie `Path` comparison so `CookieJar::clear()` with a numeric path keeps a distinct-path cookie - Fixed cookie handling for falsey `Domain`, `Max-Age`, path, and name values - Fixed `decode_content` handling for falsey string values - Fixed deprecated request option values reaching built-in handlers before normalization ### [`v7.12.1`](https://github.com/guzzle/guzzle/blob/HEAD/CHANGELOG.md#7121---2026-06-18) [Compare Source](https://github.com/guzzle/guzzle/compare/7.12.0...7.12.1) ##### Changed - Adjusted `guzzlehttp/psr7` version constraint to `^2.12.1` ##### Fixed - Reject proxy URLs with a malformed scheme in the cURL handlers instead of letting libcurl mishandle them ##### Security - Reject HTTPS proxies when the installed libcurl lacks HTTPS-proxy support (GHSA-wpwq-4j6v-78m3) - Reject dot-only cookie `Domain` attributes as match-all (GHSA-cwxw-98qj-8qjx) ### [`v7.12.0`](https://github.com/guzzle/guzzle/blob/HEAD/CHANGELOG.md#7120---2026-06-16) [Compare Source](https://github.com/guzzle/guzzle/compare/7.11.2...7.12.0) ##### Added - Added `RequestOptions` constants for `curl`, `retries`, and `stream_context` ##### Changed - Adjusted `guzzlehttp/psr7` version constraint to `^2.12` - Constrain cURL transport sharing to safe libcurl DNS and SSL session support - Resolve proxy environment variables in the cURL handlers; libcurl no longer reads the environment itself - Ignore proxy environment variables when the `proxy` request option makes a decision - Disable proxy environment variables on Windows SAPIs other than CLI (httpoxy hardening) - Redact proxy credentials from cURL handler error messages, following `Psr7\Utils::redactUserInfo()` - Normalize no-proxy domain and IP literal matching across the cURL and stream handlers ##### Deprecated - Deprecated the request-level `handler` option, which will be ignored in 8.0 - Deprecated raw cURL request options outside the built-in cURL handlers' allow-list - Deprecated the `CURLOPT_PROXYTYPE` cURL request option; set the proxy type via a scheme-prefixed proxy URL - Deprecated PHP stream context options outside the built-in stream handler allow-list - Deprecated passing `ntlm` as a built-in `auth` type - Deprecated `Utils::describeType()` - Deprecated non-finite floats in the `query` and `form_params` options; 8.0 rejects them - Deprecated non-string scalar values in the `body` option; 8.0 rejects them ##### Fixed - Fix cURL TLS and HTTP/2 capability detection using libcurl feature checks - Fix proxy `no` list matches being re-proxied through environment-configured proxies by libcurl - Fix `no` list and `NO_PROXY` matching to support IP CIDR ranges, matching libcurl - Fix the stream handler not applying scheme-less proxies and their credentials ### [`v7.11.2`](https://github.com/guzzle/guzzle/blob/HEAD/CHANGELOG.md#7112---2026-06-12) [Compare Source](https://github.com/guzzle/guzzle/compare/7.11.1...7.11.2) ##### Fixed - Fixed non-finite float values emitting coercion warnings on PHP 8.5 ### [`v7.11.1`](https://github.com/guzzle/guzzle/blob/HEAD/CHANGELOG.md#7111---2026-06-07) [Compare Source](https://github.com/guzzle/guzzle/compare/7.11.0...7.11.1) ##### Fixed - Ignore request-level `transport_sharing`, matching other unknown request options ### [`v7.11.0`](https://github.com/guzzle/guzzle/blob/HEAD/CHANGELOG.md#7110---2026-06-02) [Compare Source](https://github.com/guzzle/guzzle/compare/7.10.6...7.11.0) ##### Added - Added support for providing the `proxy` request option's `no` value as a comma-delimited string - Added the `protocols` request option to restrict allowed URI schemes for request transfers - Added `cert_type` and `ssl_key_type` request options for TLS certificate and private-key file types - Added PHP stream handler support for the `ssl_key` request option - Added transport sharing via the `transport_sharing` client and cURL handler options ##### Changed - Adjusted `guzzlehttp/promises` version constraint to `^2.5` - Adjusted `guzzlehttp/psr7` version constraint to `^2.11` - Allowed domainless `SetCookie` instances to be stored without wildcard request matching - Changed no-proxy matching to respect request ports for host-and-port rules - Prevented `CurlMultiHandler` destructors from throwing during cleanup - Improved invalid response handling across handlers ##### Deprecated - Deprecated non-iterable `Pool` request collections, which will be rejected in 8.0 - Deprecated non-uppercase easy request methods; 8.0 preserves method casing - Deprecated non-string `headers` request option values, which will be rejected in 8.0 - Deprecated empty `headers` request option value arrays, which will be rejected in 8.0 - Deprecated empty and malformed request protocol versions, which will be rejected in 8.0 - Deprecated conflicting raw cURL request options, including `CURLOPT_SHARE`, which will be rejected in 8.0 - Deprecated scalar-coerced `idn_conversion` request option values, which will be rejected in 8.0 - Deprecated invalid documented request option value types, which will be rejected in 8.0 - Deprecated selected request options ignored by incompatible built-in handlers, which will be rejected in 8.0 - Deprecated `RequestException::wrapException()`, which will be removed in 8.0 - Deprecated `RetryMiddleware::exponentialDelay()`, which will be removed in 8.0 ### [`v7.10.6`](https://github.com/guzzle/guzzle/blob/HEAD/CHANGELOG.md#7106---2026-06-01) [Compare Source](https://github.com/guzzle/guzzle/compare/7.10.5...7.10.6) ##### Fixed - `CurlMultiHandler` now rejects the promise when `CurlFactory::finish()` throws, preserving sibling transfers - `SetCookie` now normalizes unparseable `Expires` values to `null` instead of `false` - Fix stream handler decoded `gzip`/`deflate` truncation by dropping invalid `Content-Length` ### [`v7.10.5`](https://github.com/guzzle/guzzle/blob/HEAD/CHANGELOG.md#7105---2026-05-27) [Compare Source](https://github.com/guzzle/guzzle/compare/7.10.4...7.10.5) ##### Fixed - Defer cURL multi cancellation cleanup until after progress callbacks return - Classify additional stream handler connection failures as `ConnectException` ### [`v7.10.4`](https://github.com/guzzle/guzzle/blob/HEAD/CHANGELOG.md#7104---2026-05-22) [Compare Source](https://github.com/guzzle/guzzle/compare/7.10.3...7.10.4) ##### Fixed - Fix IPv6 literal matching in no-proxy rules - Handle cURL multi completion messages without handles after cancelled transfers - Fix magic client request methods such as `options()` to uppercase inferred HTTP methods ### [`v7.10.3`](https://github.com/guzzle/guzzle/blob/HEAD/CHANGELOG.md#7103---2026-05-20) [Compare Source](https://github.com/guzzle/guzzle/compare/7.10.2...7.10.3) ##### Fixed - Fail clearly when an HTTP response header line is invalid - Remove middleware by name when the name is also a callable string - Treat empty request protocol versions as HTTP/1.1 ### [`v7.10.2`](https://github.com/guzzle/guzzle/blob/HEAD/CHANGELOG.md#7102---2026-05-20) [Compare Source](https://github.com/guzzle/guzzle/compare/7.10.1...7.10.2) ##### Fixed - Normalize HTTP version request options before applying them to PSR-7 requests - Use string values for headers generated by request preparation and response decoding ### [`v7.10.1`](https://github.com/guzzle/guzzle/blob/HEAD/CHANGELOG.md#7101---2026-05-19) [Compare Source](https://github.com/guzzle/guzzle/compare/7.10.0...7.10.1) ##### Fixed - Fail clearly when cURL options cannot be applied - Fail clearly when the certificate option is malformed - Fail clearly when JSON decode depth is invalid - Fail clearly when session cookie data is malformed - Fail clearly when the stream progress option is not callable - Prevent response creation failures from exposing stale cURL responses </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNDkuNSIsInVwZGF0ZWRJblZlciI6IjQ0LjQuNSIsInRhcmdldEJyYW5jaCI6InRydW5rIiwibGFiZWxzIjpbIjBUeXBlL0RlcGVuZGVuY2llcyIsIjFEZXBlbmRlbmN5L0NvbXBvc2VyIiwiMkRlcGVuZGVuY3ktSW1wYWN0L01ham9yIl19-->

professeur-chen added the

1Dependency

Composer

0Type

Dependencies

2Dependency-Impact

Major

labels 2026-07-21 06:32:10 +02:00

professeur-chen added 1 commit 2026-07-21 06:32:10 +02:00

Update dependency guzzlehttp/guzzle to v8 df64b8bf25

professeur-chen commented 2026-07-21 06:32:10 +02:00

Author

Collaborator

Copy link

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock

Command failed: composer update guzzlehttp/guzzle:8.0.0 --with-dependencies --ignore-platform-req=ext-* --ignore-platform-req=lib-* --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins --minimal-changes
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires guzzlehttp/guzzle ^8.0, found guzzlehttp/guzzle[8.0.0] but these were not loaded, likely because it conflicts with another require.
  Problem 2
    - laravel/framework is locked to version v13.4.0 and an update of this package was not requested.
    - laravel/framework v13.4.0 requires guzzlehttp/guzzle ^7.8.2 -> found guzzlehttp/guzzle[7.8.2, ..., 7.15.1] but it conflicts with your root composer.json require (^8.0).
  Problem 3
    - laravel/socialite is locked to version v5.26.1 and an update of this package was not requested.
    - laravel/socialite v5.26.1 requires guzzlehttp/guzzle ^6.0|^7.0 -> found guzzlehttp/guzzle[6.0.0, ..., 6.5.8, 7.0.0, ..., 7.15.1] but it conflicts with your root composer.json require (^8.0).
  Problem 4
    - spatie/laravel-ignition is locked to version 2.12.0 and an update of this package was not requested.
    - laravel/framework v13.4.0 requires guzzlehttp/guzzle ^7.8.2 -> found guzzlehttp/guzzle[7.8.2, ..., 7.15.1] but it conflicts with your root composer.json require (^8.0).
    - spatie/laravel-ignition 2.12.0 requires illuminate/support ^11.0|^12.0|^13.0 -> satisfiable by laravel/framework[v13.4.0].

Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions.

### ⚠️ Artifact update problem Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is. ♻ Renovate will retry this branch, including artifacts, only when one of the following happens: - any of the package files in this branch needs updating, or - the branch becomes conflicted, or - you click the rebase/retry checkbox if found above, or - you rename this PR's title to start with "rebase!" to trigger it manually The artifact failure details are included below: ##### File name: composer.lock ``` Command failed: composer update guzzlehttp/guzzle:8.0.0 --with-dependencies --ignore-platform-req=ext-* --ignore-platform-req=lib-* --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins --minimal-changes Loading composer repositories with package information Updating dependencies Your requirements could not be resolved to an installable set of packages. Problem 1 - Root composer.json requires guzzlehttp/guzzle ^8.0, found guzzlehttp/guzzle[8.0.0] but these were not loaded, likely because it conflicts with another require. Problem 2 - laravel/framework is locked to version v13.4.0 and an update of this package was not requested. - laravel/framework v13.4.0 requires guzzlehttp/guzzle ^7.8.2 -> found guzzlehttp/guzzle[7.8.2, ..., 7.15.1] but it conflicts with your root composer.json require (^8.0). Problem 3 - laravel/socialite is locked to version v5.26.1 and an update of this package was not requested. - laravel/socialite v5.26.1 requires guzzlehttp/guzzle ^6.0|^7.0 -> found guzzlehttp/guzzle[6.0.0, ..., 6.5.8, 7.0.0, ..., 7.15.1] but it conflicts with your root composer.json require (^8.0). Problem 4 - spatie/laravel-ignition is locked to version 2.12.0 and an update of this package was not requested. - laravel/framework v13.4.0 requires guzzlehttp/guzzle ^7.8.2 -> found guzzlehttp/guzzle[7.8.2, ..., 7.15.1] but it conflicts with your root composer.json require (^8.0). - spatie/laravel-ignition 2.12.0 requires illuminate/support ^11.0|^12.0|^13.0 -> satisfiable by laravel/framework[v13.4.0]. Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions. ```

Some checks failed

Hide checks

renovate/artifacts Artifact file update failure

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/guzzlehttp-guzzle-8.x:renovate/guzzlehttp-guzzle-8.x

git switch renovate/guzzlehttp-guzzle-8.x

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch trunk

git merge --no-ff renovate/guzzlehttp-guzzle-8.x

git switch renovate/guzzlehttp-guzzle-8.x

git rebase trunk

git switch trunk

git merge --ff-only renovate/guzzlehttp-guzzle-8.x

git switch renovate/guzzlehttp-guzzle-8.x

git rebase trunk

git switch trunk

git merge --no-ff renovate/guzzlehttp-guzzle-8.x

git switch trunk

git merge --squash renovate/guzzlehttp-guzzle-8.x

git switch trunk

git merge --ff-only renovate/guzzlehttp-guzzle-8.x

git switch trunk

git merge renovate/guzzlehttp-guzzle-8.x

git push origin trunk

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

0Type

Dependencies

  

1Dependency

Composer

  

1Dependency

NPM

  

2Dependency-Impact

Major

  

2Dependency-Impact

Minor

Mises à jour de dépendances mineures

  

2Dependency-Impact

Patch

Mises à jour de dépendances patch

No labels

0Type

Dependencies

1Dependency

Composer

1Dependency

NPM

2Dependency-Impact

Major

2Dependency-Impact

Minor

2Dependency-Impact

Patch

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

l4p1n-bot/website!112

No description provided.