Skip to content

Update dependency guzzlehttp/guzzle to v8#85

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/guzzlehttp-guzzle-8.x
Open

Update dependency guzzlehttp/guzzle to v8#85
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/guzzlehttp-guzzle-8.x

Conversation

@renovate

@renovate renovate Bot commented Jul 25, 2026

Copy link
Copy Markdown

This PR contains the following updates:

Package Change Age Confidence
guzzlehttp/guzzle (source) ^6.3 → ^8.0 age confidence

Release Notes

guzzle/guzzle (guzzlehttp/guzzle)

v8.0.0

Compare Source

Added
  • Add SensitiveParameter metadata to credential-bearing parameters so PHP 8.2+ redacts their values in exception traces
  • Add HTTP/3 request support to the built-in cURL handlers when PHP 8.4+ and libcurl provide HTTP/3 support
  • Add Multiplexing::NONE support as a client, cURL multi handler, and conditional request option
  • Add generic and structured PHPDoc annotations to client request/config option, async promise, handler, middleware, pool, and mock handler APIs
  • Add ConnectTimeoutException for connect-phase timeouts, extending ConnectException
  • Add NetworkException for no-response network failures
  • Add NetworkTimeoutException for no-response transport timeouts
  • Add ResponseTransferException, with ResponseTimeoutException for response-transfer timeouts
  • Add PSR-17 request_factory, response_factory, stream_factory, and uri_factory request options
  • Add explicit close() lifecycle methods to the built-in cURL handlers and concrete cURL factory
  • Add HandlerClosedException for pending transfers rejected by CurlMultiHandler::close()
  • Add persistent transport sharing modes (TransportSharing::PERSISTENT_PREFER and TransportSharing::PERSISTENT_REQUIRE)
  • Add ProxyOptions for proxy option resolution
  • Add ResponseException for request failures with responses
  • Add auth middleware for built-in Basic and Digest authentication
Changed
  • Canonicalize IPv6 hosts in Digest challenge cache keys
  • Canonicalize IPv6 hosts in cookie domains, host-only identities, and domain matching
  • Restrict cookie domain suffix matching to valid non-literal, nonnumeric host names
  • Reject Secure cookies and insecure overlays received over insecure connections
  • Enforce the __Secure- and __Host- prefix requirements on response cookies
  • Hardened FileCookieJar and SessionCookieJar persistence against unsafe unserialization
  • Reject native PHP serialization of runtime objects
  • Restrict persisted FileCookieJar cookie files to owner-only permissions
  • Require persisted cookie data to use JSON lists and construct all records before changing the jar
  • Normalize persistent cookie JSON failures as RuntimeException
  • Moved the internal Utils time, timeout, IDN, and environment helpers to dedicated internal classes
  • Adjusted guzzlehttp/promises version constraint to ^3.0
  • Adjusted guzzlehttp/psr7 version constraint to ^3.0
  • Quote multipart Content-Type boundary parameters when required
  • Added parameter and return types to SetCookie methods
  • Added native property types to supported public cURL handler state properties
  • Added a string return type to SetCookie::__toString()
  • Validate proxy and no-proxy option types strictly across handlers
  • Match leading-dot no-proxy entries against the bare domain and split string no-proxy lists on whitespace
  • Validate force_ip_resolve, protocols, and delay ranges at the client boundary
  • Treat a matching proxy no entry as final even without a scheme-specific proxy entry
  • Validate proxy URLs in the built-in handlers and reject malformed or unsupported ones up front
  • Default a port-less proxy to 1080 in the stream handler, matching libcurl
  • Downgrade HTTP/3 requests to HTTP/2 or HTTP/1.1 when the proxy is resolved from environment variables
  • Throw RequestException, not InvalidArgumentException, for an unavailable proxy or TLS feature
  • Resolve proxy environment variables in the stream handler, consistent with the cURL handlers
  • Honor no_proxy/NO_PROXY from the environment in the stream handler, including * to disable proxying
  • Reject an environment-resolved https:// or SOCKS proxy in the stream handler, matching its proxy option behavior
  • Require cURL proxy header separation for first-class Proxy-Authorization on every route
  • Reject every first-class Proxy-Authorization field, including empty, on stream proxies
  • Reject raw CURLOPT_PROXYHEADER without proxy header separation support
  • Pass the request as the second argument to on_headers callbacks
  • Pass the Pool iterable key as a trailing argument to per-request observer callbacks
  • Declare strict types across remaining source files
  • Reject request option values that do not match their documented types
  • Reject invalid idn_conversion, retries, and built-in handler on_stats option values before use
  • Reject non-finite floats in the query and form_params options
  • Reject non-string scalar values in the body option
  • Apply automatic Expect: 100-Continue injection to HTTP/1.1 requests only
  • Reject invalid SetCookie constructor field types instead of coercing them
  • Validate and normalize request framing across the built-in cURL and stream handlers
  • Reject raw cURL request options outside the built-in cURL handlers' allow-list
  • Reject non-string raw cURL header-list entries before applying them
  • Reject proxy tunnels that require fresh connections when persistent transport sharing requires reuse
  • Reject PHP stream context options outside the built-in stream handler allow-list
  • Reject selected request options ignored by incompatible built-in handlers
  • Treat only null as an omitted path or name when clearing cookies
  • Validate malformed auth request option arrays
  • Reject colons in built-in Basic usernames and ASCII control characters in Basic credentials
  • Move built-in Basic and Digest authentication handling to the default auth middleware
  • Reject unchallenged Digest probes for body-bearing requests instead of replaying the request unauthenticated
  • Reject malformed Digest challenge parameter lists that libcurl's Digest parser may have tolerated
  • Reuse Digest challenges to authorize subsequent body-less requests preemptively
  • Advance the Digest nonce count when a stale challenge repeats the same nonce during the initial handshake
  • Remove first-class NTLM authentication from the auth request option
  • Stop forwarding the generic auth request option when following cross-origin redirects
  • Limit the Referer header to the origin on cross-origin redirects
  • Follow only redirect status codes 301, 302, 303, 307, and 308
  • Reject invalid HandlerStack::remove() arguments
  • Require Pool request collections to be iterable
  • Raised the built-in cURL handler floor to libcurl 7.34.0 with SSL support
  • Store response cookies without a Domain attribute as host-only cookies
  • Prefer cookie Max-Age over Expires when both attributes are present
  • Match cookie names case-sensitively in CookieJar::getCookieByName()
  • Ignore float-like or exponent Max-Age cookie values instead of truncating them
  • Tighten invalid response handling and avoid exposing response-derived cURL stats
  • Reject malformed response protocol versions and reason phrases
  • Escape controls and malformed UTF-8 when copying raw values into exception messages
  • Reject malformed or conflicting response Content-Length and combinations with Transfer-Encoding
  • Expose raw stream-handler Transfer-Encoding metadata and coalesced framing in progress on newer PHP
  • Wrap malformed redirect Location values in BadResponseException
  • Default HTTPS requests sent by the built-in cURL and stream handlers to TLS 1.2 or newer
  • Apply the stream handler crypto_method option through the SSL context so it consistently controls the minimum TLS version
  • Validate built-in handler timeout options before applying them
  • Require a request when constructing TransferException and its subclasses
  • Classify empty, malformed, or handler-unsupported request protocol versions as request exceptions
  • Classify additional cURL transport failures without a response as NetworkException
  • Classify stream connect failures as ConnectException, with connect timeouts as ConnectTimeoutException
  • Classify stream transport failures without a response as NetworkException, with timeouts as NetworkTimeoutException
  • Classify generic response-aware request failures as ResponseException
  • Classify response-aware transfer failures as ResponseTransferException
  • The stream handler returns an empty body and releases the connection at the end of the headers for HEAD and CONNECT-2xx exchanges and 1xx, 204, and 304 responses
  • The stream handler no longer writes to the sink option or reads trailing bytes for responses that cannot carry a body
  • Reject short buffered stream-handler bodies against Content-Length, including decoded gzip/deflate
  • Normalize duplicate Content-Length casings and preserve encoded values on decoded responses
  • Reject unrepresentable byte counts and response sizes requiring integer bounds as ResponseException
  • Ignore cURL informational responses other than 101 Switching Protocols before the final response
  • Treat response sink rewind failures as ResponseException and skip non-seekable sink rewinds
  • Classify redirect request-body rewind failures as ResponseException
  • Ignore stream source close failures after a complete response body transfer
  • Throw GuzzleHttp\Exception\InvalidArgumentException for invalid built-in handler options
  • Classify built-in cURL handle, sink, and HTTP/3 setup failures as RequestException
  • Throw ConnectTimeoutException for connect timeouts
  • Throw NetworkTimeoutException for cURL no-response timeout errors
  • Throw ResponseTimeoutException for response-aware transfer timeouts
  • Enforce the timeout option as a total transfer deadline in the stream handler when it buffers the response
  • Reject stream handler responses whose header block arrives after the timeout deadline
  • Stop consulting the default_socket_timeout ini setting in the stream handler
  • Treat stream handler read_timeout as an idle timeout for every request stage, defaulting to 60 seconds
  • Default the cURL connect timeout to 60 seconds, with connect_timeout set to 0 disabling it
  • Stop the stream handler from injecting User-Agent and From header values from the user_agent and from ini settings
  • Classify request-body stream size detection, read, stringification, and rewind failures as RequestException or ResponseException by phase
  • Classify cURL response sink write failures, including timeouts, as ResponseException or RequestException by phase
  • Treat request method names case-sensitively in built-in handler and redirect method-specific behavior
  • Treat PHP resources passed as sink as caller-owned in the built-in cURL and stream handlers
  • Use the configured PSR-17 URI factory when parsing redirect Location headers
  • Allow built-in cURL handler progress callbacks to abort transfers with truthy return values
  • Normalize built-in handler progress callback arguments to integer byte counts
  • Reject built-in cURL progress throwables with ResponseException when a response exists, otherwise RequestException
  • Release built-in cURL easy handles before invoking on_stats
  • Prefer CURLOPT_XFERINFOFUNCTION for built-in cURL progress callbacks when available
  • Made MessageFormatter final and required Middleware::log() formatters to implement MessageFormatterInterface
  • Made CurlFactory, CurlHandler, CurlMultiHandler, MockHandler, and StreamHandler final
  • Made static utility classes non-instantiable and declared GuzzleHttp\Handler\Proxy final
  • Pass the request to on_trailers callbacks, reject non-callable on_trailers values, and wrap on_trailers callback exceptions in ResponseException
  • Wait for in-progress HTTP/2-capable connections by default (multiplex defaults to Multiplexing::WAIT)
  • Require libcurl 7.65.2 or newer for HTTP/2 requests so multiplex waiting is never silently unavailable
  • Require libcurl 7.54.0 for HTTPS proxies and requests tunneled through HTTP proxies
  • Suppress proxy CONNECT response headers for tunneled requests
  • Point rejections of the raw CURLOPT_PIPEWAIT cURL option at the multiplex request option
  • Reject raw CURLMOPT_PIPELINING in favour of the multiplex cURL multi handler option
  • Reject required multiplexing when the final CURLOPT_HTTPAUTH mask permits NTLM
  • Reject cURL multi options that the runtime libcurl cannot apply
  • Reject unknown handler constructor options
  • Reject invalid select_timeout cURL multi handler option values
  • Reject raw cURL multi connection cap options in favour of the named options
  • Parse Set-Cookie strings with RFC 6265 whitespace trimming
  • Ignore valueless Set-Cookie attributes that require a value when parsing
  • Trim only the trailing CRLF from the stream handler header block
  • Fail streamed uploads immediately when the body cannot be resent for an auth challenge
Removed
  • Dropped support for PHP 7.2 and 7.3
  • Removed Client::__call(); use the typed HTTP verb methods or request()/requestAsync()
  • Removed ClientInterface::getConfig(); the concrete Client::getConfig() remains available
  • Removed support for the GUZZLE_CURL_SELECT_TIMEOUT environment variable; use CurlMultiHandler's select_timeout option
  • Removed support for the handler request option; configure the handler on the client
  • Removed direct access to CurlMultiHandler::$_mh; pass CURLMOPT_* values through constructor options instead
  • Removed RedirectMiddleware::$defaultSettings; use RedirectMiddleware::DEFAULT_SETTINGS
  • Removed the deprecated RetryMiddleware::exponentialDelay() method
  • Removed the deprecated RequestException::wrapException() method
  • Removed the deprecated Utils::describeType() method
  • Removed Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
  • Removed deprecated GuzzleHttp namespace functions in favor of native or class equivalents
  • Removed Utils::defaultCaBundle(); rely on the system trust store or pass a bundle path via the verify option
  • Removed HandlerStack::__toString()
  • Removed RequestException::getHandlerContext() and ConnectException::getHandlerContext()
  • Removed response access from RequestException; use ResponseException
  • Removed Utils::isHostInNoProxy(); use ProxyOptions helpers for Guzzle 8 no-proxy matching
  • Removed Utils::isUriInNoProxy(); use ProxyOptions::isUriInNoProxy()
  • Removed Handler\Proxy::wrapTlsFallback(); the default handler stack selects the cURL or stream handler by TLS support automatically

v7.15.1

Compare Source

Security

v7.15.0

Compare Source

Added
  • Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option
Changed
  • Adjusted guzzlehttp/psr7 version constraint to ^2.13
  • Use locale-independent ASCII folding for all case normalization and comparison
  • Bound cURL upload reads to the declared Content-Length
  • Sanitize the cURL error text exposed through exception handler context
  • Fail closed when a named cURL multi connection cap cannot be applied
  • Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured
  • Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles
  • Isolate HTTP proxy tunnels from opaque shared connection caches
  • Trigger runtime deprecations for previously deprecated functionality in 7.1.0
Deprecated
  • Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
  • Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array
  • Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support
Fixed
  • Defer cURL requests created from multi callbacks until native execution unwinds
  • Fail synchronous waits from native cURL callbacks promptly instead of self-deadlocking
  • Guard cURL multi handle removal against progress callbacks re-entering the handler
  • Scope promise waits on the cURL multi handler to the awaited transfer
  • Strip Content-Length and Transfer-Encoding when redirects discard the request body
  • Stop re-applying the delay request option to followed redirects

v7.14.2

Compare Source

Security

v7.14.1

Compare Source

Changed
  • Adjusted guzzlehttp/psr7 version constraint to ^2.12.5
Fixed
  • Fail closed when a proxy tunnel isolation cURL option cannot be applied
  • Normalize Stringable proxy credential values before computing connection-reuse section signatures
  • Restore conservative credential redaction for unparseable proxies with multiple @ separators
  • Redact request URI credentials from the stream handler connection error message
  • Reject enabled response streaming (stream => true) on cap-configured stream handlers
  • Distinguish CurlMultiHandler and StreamHandler outcomes in connection-cap custom-handler guidance
  • Reject raw cURL options that conflict with explicit multiplexing guarantees
  • Stop explicit multiplexing conflict checks faulting on non-array cURL multi options values
  • Reject required multiplexing when the final CURLOPT_HTTPAUTH mask permits NTLM
  • Require an integer CURLMOPT_PIPELINING when combined with explicit multiplexing
  • Check the required multiplexing cleartext proxy rule against the final cURL configuration
  • Bound cURL multi handler blocking selects by the earliest pending request delay
  • Stop synchronous cURL multi handler waits blocking on other transfers once the target has settled
  • Stop cURL multi completion processing double-settling promises canceled from completion callbacks
  • Run ready promise queue tasks before sleeping for delayed cURL multi requests
  • Avoid integer overflow in cURL multi delay timing on 32-bit platforms
  • Roll back failed cURL multi handle attachment instead of leaving requests pending
  • Release the cURL easy handle when the on_stats callback throws
  • Normalize response trailer field names to lowercase with values in wire order
  • Retain response trailers only when an on_trailers callback is configured
  • Validate the on_trailers callback before starting a cURL transfer
  • Reject the on_trailers request option on the stream handler, which cannot observe trailers
  • Match cookies, proxy schemes, auth types, and header names with locale-independent ASCII folding
  • Reject proxy option values that Guzzle cannot classify identically to ext-curl

v7.14.0

Compare Source

Added
  • Added the on_trailers request option to expose parsed HTTP response trailers
  • Added the multiplex request option with Multiplexing::* modes to control or require HTTP/2 multiplexing
  • Added rejection of explicit multiplex requests when CURLMOPT_PIPELINING disables multiplexing
  • Added the max_host_connections and max_total_connections client and cURL multi handler options
Changed
  • Redirects that discard the request body no longer require it to be rewindable
  • Synchronous cURL multi handler requests no longer wait for other queued transfers
  • Section SOCKS proxy connections by credentials on libcurl before 7.69.0
  • Reject request-level CURLOPT_SHARE when combined with authenticated SOCKS proxy configuration
  • Redact proxy userinfo containing raw control bytes in cURL errors
  • Check linked curl/libcurl NTLM support before applying NTLM auth
  • Clarify that NTLM is deprecated by both Guzzle and curl/libcurl
  • Remove deprecation for the raw cURL CURLOPT_CERTINFO option
  • Warn when a cURL multi option cannot be applied
Deprecated
  • Deprecate the raw CURLOPT_PIPEWAIT cURL option in favour of the multiplex request option
  • Deprecate unknown handler constructor options
  • Deprecate invalid select_timeout cURL multi handler option values
  • Deprecate raw cURL multi connection cap options in favour of the named options

v7.13.3

Compare Source

Changed
  • Adjusted guzzlehttp/promises version constraint to ^2.5.1
  • Adjusted guzzlehttp/psr7 version constraint to ^2.12.4
  • Pass explicit trim characters ahead of the PHP 8.6 trim default change
Fixed
  • Stop matching cookie domains against hosts with a trailing newline
  • Reject HTTP status codes and certificate type extensions with a trailing newline
  • Treat PCRE engine failures as invalid cookie names during cookie validation
  • Report PCRE engine failures when formatting log messages
  • Report PCRE engine failures when splitting no_proxy values

v7.13.2

Compare Source

Fixed
  • Stop the cURL multi handler busy-waiting on request delays shorter than one second
  • Stop cURL HEAD requests with request bodies hanging on responses that declare a content length
  • The cURL handler no longer transmits request bodies on HEAD requests
  • Preserve response headers when a response includes HTTP trailers
  • Harden cURL response header block detection when HTTP trailers are received
  • Corrected the PSR-7 class names in the Pool iterator exception
  • Redirect body rewind failures no longer leak a bare RuntimeException

v7.13.1

Compare Source

Fixed
  • Allow middleware to rewrite partial URIs before transports validate them

v7.13.0

Compare Source

Added
  • Added the crypto_method_max request option to cap the maximum TLS protocol version
  • Added HTTP QUERY redirect support, preserving method and body on 301 and 302
Changed
  • Section proxy tunnel connection reuse by credential so distinct credentials never share a tunnel
  • Isolate concurrent foreign cURL proxy tunnels added while another owner's tunnel is active
  • Route credentialed HTTP(S) proxy Proxy-Authorization headers through cURL proxy header handling
  • Reject request-level CURLOPT_SHARE when combined with authenticated HTTP/HTTPS proxy tunnel configuration
  • Remove deprecation for raw cURL CURLOPT_PREREQFUNCTION callbacks when defined by PHP cURL
  • Route TLS 1.2 crypto_method requests to the stream handler when cURL cannot select TLS 1.2
  • Reject final request URIs missing a scheme or host before transfer
Deprecated
  • Deprecate invalid protocols, force_ip_resolve, delay, cookies, and allow_redirects values

v7.12.3

Compare Source

Changed
  • Adjusted guzzlehttp/psr7 version constraint to ^2.12.3
Security

v7.12.2

Compare Source

Fixed
  • Clamp out-of-range Max-Age so a very large value no longer overflows to an already-expired timestamp
  • Use strict comparison in CookieJar conflict resolution so distinct numeric-string names don't overwrite
  • Store a cookie whose Domain has a trailing dot on the origin host instead of silently discarding it
  • Fix StreamHandler hard-failing on bracketed IPv6 literal hosts when force_ip_resolve is set
  • Use strict cookie Path comparison so CookieJar::clear() with a numeric path keeps a distinct-path cookie
  • Fixed cookie handling for falsey Domain, Max-Age, path, and name values
  • Fixed decode_content handling for falsey string values
  • Fixed deprecated request option values reaching built-in handlers before normalization

v7.12.1

Compare Source

Changed
  • Adjusted guzzlehttp/psr7 version constraint to ^2.12.1
Fixed
  • Reject proxy URLs with a malformed scheme in the cURL handlers instead of letting libcurl mishandle them
Security

v7.12.0

Compare Source

Added
  • Added RequestOptions constants for curl, retries, and stream_context
Changed
  • Adjusted guzzlehttp/psr7 version constraint to ^2.12
  • Constrain cURL transport sharing to safe libcurl DNS and SSL session support
  • Resolve proxy environment variables in the cURL handlers; libcurl no longer reads the environment itself
  • Ignore proxy environment variables when the proxy request option makes a decision
  • Disable proxy environment variables on Windows SAPIs other than CLI (httpoxy hardening)
  • Redact proxy credentials from cURL handler error messages, following Psr7\Utils::redactUserInfo()
  • Normalize no-proxy domain and IP literal matching across the cURL and stream handlers
Deprecated
  • Deprecated the request-level handler option, which will be ignored in 8.0
  • Deprecated raw cURL request options outside the built-in cURL handlers' allow-list
  • Deprecated the CURLOPT_PROXYTYPE cURL request option; set the proxy type via a scheme-prefixed proxy URL
  • Deprecated PHP stream context options outside the built-in stream handler allow-list
  • Deprecated passing ntlm as a built-in auth type
  • Deprecated Utils::describeType()
  • Deprecated non-finite floats in the query and form_params options; 8.0 rejects them
  • Deprecated non-string scalar values in the body option; 8.0 rejects them
Fixed
  • Fix cURL TLS and HTTP/2 capability detection using libcurl feature checks
  • Fix proxy no list matches being re-proxied through environment-configured proxies by libcurl
  • Fix no list and NO_PROXY matching to support IP CIDR ranges, matching libcurl
  • Fix the stream handler not applying scheme-less proxies and their credentials

v7.11.2

Compare Source

Fixed
  • Fixed non-finite float values emitting coercion warnings on PHP 8.5

v7.11.1

Compare Source

Fixed
  • Ignore request-level transport_sharing, matching other unknown request options

v7.11.0

Compare Source

Added
  • Added support for providing the proxy request option's no value as a comma-delimited string
  • Added the protocols request option to restrict allowed URI schemes for request transfers
  • Added cert_type and ssl_key_type request options for TLS certificate and private-key file types
  • Added PHP stream handler support for the ssl_key request option
  • Added transport sharing via the transport_sharing client and cURL handler options
Changed
  • Adjusted guzzlehttp/promises version constraint to ^2.5
  • Adjusted guzzlehttp/psr7 version constraint to ^2.11
  • Allowed domainless SetCookie instances to be stored without wildcard request matching
  • Changed no-proxy matching to respect request ports for host-and-port rules
  • Prevented CurlMultiHandler destructors from throwing during cleanup
  • Improved invalid response handling across handlers
Deprecated
  • Deprecated non-iterable Pool request collections, which will be rejected in 8.0
  • Deprecated non-uppercase easy request methods; 8.0 preserves method casing
  • Deprecated non-string headers request option values, which will be rejected in 8.0
  • Deprecated empty headers request option value arrays, which will be rejected in 8.0
  • Deprecated empty and malformed request protocol versions, which will be rejected in 8.0
  • Deprecated conflicting raw cURL request options, including CURLOPT_SHARE, which will be rejected in 8.0
  • Deprecated scalar-coerced idn_conversion request option values, which will be rejected in 8.0
  • Deprecated invalid documented request option value types, which will be rejected in 8.0
  • Deprecated selected request options ignored by incompatible built-in handlers, which will be rejected in 8.0
  • Deprecated RequestException::wrapException(), which will be removed in 8.0
  • Deprecated RetryMiddleware::exponentialDelay(), which will be removed in 8.0

v7.10.6

Compare Source

Fixed
  • CurlMultiHandler now rejects the promise when CurlFactory::finish() throws, preserving sibling transfers
  • SetCookie now normalizes unparseable Expires values to null instead of false
  • Fix stream handler decoded gzip/deflate truncation by dropping invalid Content-Length

v7.10.5

Compare Source

Fixed
  • Defer cURL multi cancellation cleanup until after progress callbacks return
  • Classify additional stream handler connection failures as ConnectException

v7.10.4

Compare Source

Fixed
  • Fix IPv6 literal matching in no-proxy rules
  • Handle cURL multi completion messages without handles after cancelled transfers
  • Fix magic client request methods such as options() to uppercase inferred HTTP methods

v7.10.3

Compare Source

Fixed
  • Fail clearly when an HTTP response header line is invalid
  • Remove middleware by name when the name is also a callable string
  • Treat empty request protocol versions as HTTP/1.1

v7.10.2

Compare Source

Fixed
  • Normalize HTTP version request options before applying them to PSR-7 requests
  • Use string values for headers generated by request preparation and response decoding

v7.10.1

Compare Source

Fixed
  • Fail clearly when cURL options cannot be applied
  • Fail clearly when the certificate option is malformed
  • Fail clearly when JSON decode depth is invalid
  • Fail clearly when session cookie data is malformed
  • Fail clearly when the stream progress option is not callable
  • Prevent response creation failures from exposing stale cURL responses

v7.10.0

Compare Source

Added
  • Support for PHP 8.5
Changed
  • Adjusted guzzlehttp/promises version constraint to ^2.3
  • Adjusted guzzlehttp/psr7 version constraint to ^2.8

v7.9.3

Compare Source

Changed
  • Remove explicit content-length header for GET requests
  • Improve compatibility with bad servers for boolean cookie values

v7.9.2

Compare Source

Fixed
  • Adjusted handler selection to use cURL if its version is 7.21.2 or higher, rather than 7.34.0

v7.9.1

Compare Source

Fixed
  • Fix TLS 1.3 check for HTTP/2 requests

v7.9.0

Compare Source

Changed
  • Improve protocol version checks to provide feedback around unsupported protocols
  • Only select the cURL handler by default if 7.34.0 or higher is linked
  • Improved CurlMultiHandler to avoid busy wait if possible
  • Dropped support for EOL guzzlehttp/psr7 v1
  • Improved URI user info redaction in errors

v7.8.2

Compare Source

Added
  • Support for PHP 8.4

v7.8.1

Compare Source

Changed
  • Updated links in docs to their canonical versions
  • Replaced call_user_func* with native calls

v7.8.0

Compare Source

Added
  • Support for PHP 8.3
  • Added automatic closing of handles on CurlFactory object destruction

v7.7.1

Compare Source

Changed
  • Remove the need for AllowDynamicProperties in CurlMultiHandler

v7.7.0

Compare Source

Added
  • Support guzzlehttp/promises v2

v7.6.1

Compare Source

Fixed
  • Fix SetCookie::fromString MaxAge deprecation warning and skip invalid MaxAge values

v7.6.0

Compare Source

Added
  • Support for setting the minimum TLS version in a unified way
  • Apply on request the version set in options parameters

v7.5.3

Compare Source

See change log for changes.

v7.5.2

Compare Source

Fixed
  • Fixed set cookie constructor validation
  • Fixed handling of files with '0' body
Changed
  • Corrected docs and default connect timeout value to 300 seconds

v7.5.1

Compare Source

Fixed
  • Fixed NO_PROXY settings so that setting the proxy option to no overrides the env variable
Changed
  • Adjusted guzzlehttp/psr7 version constraint to ^1.9.1 || ^2.4.5

v7.5.0

Compare Source

Added
  • Support PHP 8.2
  • Add request to delay closure params

v7.4.5

Compare Source

Fixed
  • Fix change in port should be considered a change in origin
  • Fix CURLOPT_HTTPAUTH option not cleared on change of origin

v7.4.4

Compare Source

Fixed
  • Fix failure to strip Authorization header on HTTP downgrade
  • Fix failure to strip the Cookie header on change in host or HTTP downgrade

v7.4.3

Compare Source

Fixed
  • Fix cross-domain cookie leakage

v7.4.2

Compare Source

Fixed
  • Remove curl auth on cross-domain redirects to align with the Authorization HTTP header
  • Reject non-HTTP schemes in StreamHandler
  • Set a default ssl.peer_name context in StreamHandler to allow force_ip_resolve

v7.4.1

Compare Source

Changed
  • Replaced implicit URI to string coercion #​2946
  • Allow symfony/deprecation-contracts version 3 #​2961
Fixed
  • Only close curl handle if it's done #​2950

v7.4.0

Compare Source

Added
Fixed
  • Make sure we always call restore_error_handler() #​2915
  • Fix progress parameter type compatibility between the cURL and stream handlers #​2936
  • Throw InvalidArgumentException when an incorrect headers array is provided #​2916, #​2942
Changed

v7.3.0

Compare Source

Added
  • Support for DER and P12 certificates #​2413
  • Support the cURL (http://) scheme for StreamHandler proxies #​2850
  • Support for guzzlehttp/psr7:^2.0 #​2878
Fixed
  • Handle exceptions on invalid header consistently between PHP versions and handlers #​2872

v7.2.0

Compare Source

Added
Fixed
  • Handle exceptions during response creation #​2591
  • Fix CURLOPT_ENCODING not to be overwritten #​2595
  • Make sure the Request always has a body object #​2804
Changed
  • The TooManyRedirectsException has a response #​2660
  • Avoid "functions" from dependencies #​2712
Deprecated
  • Using environment variable GUZZLE_CURL_SELECT_TIMEOUT #​2786

v7.1.1

Compare Source

Fixed
  • Incorrect EOF detection for response body streams on Windows.
Changed
  • We dont connect curl sink on HEAD requests.
  • Removed some PHP 5 workarounds

v7.1.0

Compare Source

Added
  • GuzzleHttp\MessageFormatterInterface
Fixed
  • Fixed issue that caused cookies with no value not to be stored.
  • On redirects, we allow all safe methods like GET, HEAD and OPTIONS.
  • Fixed logging on empty responses.
  • Make sure MessageFormatter::format returns string
Deprecated
  • All functions in GuzzleHttp has been deprecated. Use static methods on Utils instead.
  • ClientInterface::getConfig()
  • Client::getConfig()
  • Client::__call()
  • Utils::defaultCaBundle()
  • CurlFactory::LOW_CURL_VERSION_NUMBER

v7.0.1

Compare Source

  • Fix multiply defined functions fatal error #​2699

v7.0.0

Compare Source

No changes since 7.0.0-rc1.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants