🚨 [Conductor] Security update guzzlehttp/psr7 to 2.11.0

[private-packagist]

This PR was automatically generated by Conductor.

The PR contains the changes generated by running the following command:

composer update guzzlehttp/psr7:2.11.0 --with-all-dependencies --minimal-changes

Changelog

guzzlehttp/psr7 (Source: GitHub Releases))

2.11.0

Changed

• Changed Utils::modifyRequest() to reject conflicting URI and Host header changes in the same call
• Changed Header::parse() to split semicolon-separated parameters without repeated regular expression lookaheads
• Changed UriComparator::isCrossOrigin() so only HTTP and HTTPS missing ports receive implicit default ports

Deprecated

• Deprecated invalid PSR-7 arguments that guzzlehttp/psr7 3.0 will require native types for
• Deprecated non-string header values that guzzlehttp/psr7 3.0 will reject
• Deprecated empty header value arrays that guzzlehttp/psr7 3.0 will reject
• Deprecated URI schemes that do not match guzzlehttp/psr7 3.0 syntax requirements
• Deprecated multipart boundary and custom part header metadata that guzzlehttp/psr7 3.0 will reject
• Deprecated reliance on automatic uppercasing of request methods; guzzlehttp/psr7 3.0 preserves method casing
• Deprecated invalid Utils::modifyRequest() change values that guzzlehttp/psr7 3.0 will reject

Fixed

• Fixed Utils::copyToStream() to retry short destination writes instead of dropping the unwritten remainder
• Fixed Header::parse() splitting of semicolon-separated parameters with escaped quotes

2.10.4

Fixed

• Apply UriNormalizer percent-encoding normalizations to URI fragments
• Make LimitStream::getSize() return 0 for slices past the underlying stream end
• Make AppendStream::read() return an empty string when no streams are attached
• Make CachingStream::read() throw on an incomplete cache-target write instead of silently corrupting replays
• Prevent CachingStream::seek() from looping indefinitely when the remote stream makes no progress

2.10.3

Fixed

• Fixed URI parsing for IPv6 literals containing embedded IPv4 addresses
• Fixed malformed UTF-8 URI strings being parsed as empty URIs

2.10.2

Security

• Reject control and whitespace characters in URI host components (GHSA-hq7v-mx3g-29hw)
• Reject malformed Host values when constructing request URIs (GHSA-34xg-wgjx-8xph)

Fixed

• Make ServerRequest::fromGlobals() robust against unexpected HTTP header value types in $_SERVER

2.10.1

Fixed

• Fix Utils::modifyRequest() with numeric header names

2.10.0

• Harden ServerRequest::fromGlobals() against malformed $_SERVER values
• Prevent custom stream metadata from affecting internal size handling
• Throw when StreamWrapper::getResource() cannot create a resource
• Preserve custom request implementations in Utils::modifyRequest()
• Preserve custom URI implementations in UriResolver::resolve()
• Make Uri::__toString() side-effect-free

2.9.1

• Fix parsing of relative path references containing a colon in a non-initial path segment
• Fix CachingStream::detach() returning an incomplete resource before the decorated stream has been fully read
• Fix Message::bodySummary() returning null when truncating printable UTF-8 bodies inside a multibyte character

2.9.0

Added

• Added nested array expansion support to MultipartStream
• Added @​return static to MessageTrait methods

Changed

• Updated MIME type mappings

See also the change log for changes.

2.8.1

Fixed

• Encode + signs in Uri::withQueryValue() and Uri::withQueryValues() to prevent them being interpreted as spaces

See also the change log for changes.

2.8.0

Added

• Allow empty lists as header values

Changed

• PHP 8.5 support

See also the change log for changes.

2.7.1

Fixed

• Fixed uppercase IPv6 addresses in URI

Changed

• Improve uploaded file error message

See also the change log for changes.

Task options

• Recreate commit - Conductor recreates the update commit and overwrites all additional changes made in this branch.
• Details
• Skip - Conductor won't attempt to update the dependency to this exact version again.
• All tasks
• Settings
• Docs

If you close the PR, the task will be skipped and Conductor will schedule the next task. Clicking the "Skip" button in the UI has the same effect. Conductor won't attempt to update the dependency to this exact version again but it will schedule updates to newer versions.

---

Powered by Private Packagist

[private-packagist]

composer.lock

Package changes

Package	Operation	From	To	About
symfony/polyfill-php80	add	-	v1.37.0	view code - License: MIT License
guzzlehttp/psr7	upgrade	2.7.0 ⚠️	2.11.0 ✅	diff

---

Settings · Docs · Powered by Private Packagist