chore(deps): Bump the composer group across 2 directories with 2 updates by dependabot[bot] · Pull Request #140 · LibreCodeCoop/profile_fields

dependabot · 2026-09-09T17:49:56Z

Bumps the composer group with 1 update in the /tests/integration directory: guzzlehttp/guzzle.
Bumps the composer group with 1 update in the /vendor-bin/phpunit directory: guzzlehttp/psr7.

Updates guzzlehttp/guzzle from 7.10.0 to 7.15.2

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.15.2

Security

Reject non-printable-ASCII and percent-escaped URI hosts and Host headers (GHSA-v5mv-p594-2x33)

Reject request URI hosts that contain a URI authority delimiter (GHSA-v5mv-p594-2x33)

Reject numeric-looking URI hosts with trailing dots, read as IPv4 addresses (GHSA-v5mv-p594-2x33)

Treat numeric-in-any-base and percent-escaped cookie domains as exact-match-only (GHSA-f7vp-7xgx-4w4r)

Regenerate a derived Host header after client URI rewrites (GHSA-v5mv-p594-2x33)

Fixed

Preserve RequestException when the stream handler rejects a request before opening a stream

7.15.1

Security

Preserve host-only cookie scope and require explicit persistence markers (GHSA-wm3w-8rrp-j577)

Bound response cookie admission and generated Cookie headers (GHSA-f283-ghqc-fg79)

Exclude URI fragments from Referer headers generated for redirects (GHSA-h95v-h523-3mw8)

7.15.0

Added

Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option

Changed

Adjusted guzzlehttp/psr7 version constraint to ^2.13

Use locale-independent ASCII folding for all case normalization and comparison

Bound cURL upload reads to the declared Content-Length

Sanitize the cURL error text exposed through exception handler context

Fail closed when a named cURL multi connection cap cannot be applied

Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured

Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles

Isolate HTTP proxy tunnels from opaque shared connection caches

Trigger runtime deprecations for previously deprecated functionality in 7.1.0

Deprecated

Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions

Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array

Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support

Fixed

Defer cURL requests created from multi callbacks until native execution unwinds

Fail synchronous waits from native cURL callbacks promptly instead of self-deadlocking

Guard cURL multi handle removal against progress callbacks re-entering the handler

Scope promise waits on the cURL multi handler to the awaited transfer

Strip Content-Length and Transfer-Encoding when redirects discard the request body

... (truncated)

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.15.2 - 2026-07-26

Security

Reject non-printable-ASCII and percent-escaped URI hosts and Host headers (GHSA-v5mv-p594-2x33)

Reject request URI hosts that contain a URI authority delimiter (GHSA-v5mv-p594-2x33)

Reject numeric-looking URI hosts with trailing dots, read as IPv4 addresses (GHSA-v5mv-p594-2x33)

Treat numeric-in-any-base and percent-escaped cookie domains as exact-match-only (GHSA-f7vp-7xgx-4w4r)

Regenerate a derived Host header after client URI rewrites (GHSA-v5mv-p594-2x33)

Fixed

Preserve RequestException when the stream handler rejects a request before opening a stream

7.15.1 - 2026-07-18

Security

Preserve host-only cookie scope and require explicit persistence markers (GHSA-wm3w-8rrp-j577)

Bound response cookie admission and generated Cookie headers (GHSA-f283-ghqc-fg79)

Exclude URI fragments from Referer headers generated for redirects (GHSA-h95v-h523-3mw8)

7.15.0 - 2026-07-17

Added

Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option

Changed

Adjusted guzzlehttp/psr7 version constraint to ^2.13

Use locale-independent ASCII folding for all case normalization and comparison

Bound cURL upload reads to the declared Content-Length

Sanitize the cURL error text exposed through exception handler context

Fail closed when a named cURL multi connection cap cannot be applied

Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured

Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles

Isolate HTTP proxy tunnels from opaque shared connection caches

Trigger runtime deprecations for previously deprecated functionality in 7.1.0

Deprecated

Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions

Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array

Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support

Fixed

... (truncated)

Commits

7441019 Security fixes 7.15 (#3907)
61443df Release 7.15.1
7b68220 Security fixes 7.15 (#3901)
90bd104 Release 7.15.0
e8c879e Require guzzlehttp/psr7 ^2.13 (#3870)
0d578f5 Trigger runtime deprecations for legacy functions and methods (#3896)
d5fcd1e Deprecate JSON utility methods (#3889)
3281fe2 Go with "guzzlehttp/test-server": "^0.7" (#3890)
ba662c9 Remove stale framing from redirected requests (#3881)
dd32f84 Bound cURL uploads to declared lengths (#3882)
Additional commits viewable in compare view

Updates guzzlehttp/psr7 from 2.9.0 to 2.13.1

Release notes

Sourced from guzzlehttp/psr7's releases.

2.12.3

Security

Validate the URI host so getHost() matches the URI authority (GHSA-c2w2-prh8-qm98)

2.12.2

Fixed

Report URI parsing, filtering, and normalization PCRE failures explicitly

Report HTTP message parser PCRE failures explicitly

Fail closed when PCRE validation fails for request targets and hosts

2.12.1

Security

Reject CR/LF in HTTP method, protocol version, and reason phrase (GHSA-vm85-hxw5-5432)

2.12.0

Deprecated

Deprecated non-finite float values in Query::build() that guzzlehttp/psr7 3.0 rejects

Deprecated non-finite float multipart contents that guzzlehttp/psr7 3.0 rejects

Deprecated non-string scalar bodies in Utils::streamFor(); cast them to a string for 3.0

Deprecated non-string Uri::withQueryValues() values; cast them to a string for 3.0

2.11.1

Fixed

Fixed non-finite float values emitting coercion warnings on PHP 8.5

2.11.0

Changed

Changed Utils::modifyRequest() to reject conflicting URI and Host header changes in the same call

Changed Header::parse() to split semicolon-separated parameters without repeated regular expression lookaheads

Changed UriComparator::isCrossOrigin() so only HTTP and HTTPS missing ports receive implicit default ports

Deprecated

Deprecated invalid PSR-7 arguments that guzzlehttp/psr7 3.0 will require native types for

Deprecated non-string header values that guzzlehttp/psr7 3.0 will reject

Deprecated empty header value arrays that guzzlehttp/psr7 3.0 will reject

Deprecated URI schemes that do not match guzzlehttp/psr7 3.0 syntax requirements

Deprecated multipart boundary and custom part header metadata that guzzlehttp/psr7 3.0 will reject

Deprecated reliance on automatic uppercasing of request methods; guzzlehttp/psr7 3.0 preserves method casing

Deprecated invalid Utils::modifyRequest() change values that guzzlehttp/psr7 3.0 will reject

Fixed

Fixed Utils::copyToStream() to retry short destination writes instead of dropping the unwritten remainder

... (truncated)

Changelog

Sourced from guzzlehttp/psr7's changelog.

2.12.3 - 2026-06-23

Security

Validate the URI host so getHost() matches the URI authority (GHSA-c2w2-prh8-qm98)

2.12.2 - 2026-06-23

Fixed

Report URI parsing, filtering, and normalization PCRE failures explicitly

Report HTTP message parser PCRE failures explicitly

Fail closed when PCRE validation fails for request targets and hosts

2.12.1 - 2026-06-18

Security

Reject CR/LF in HTTP method, protocol version, and reason phrase (GHSA-vm85-hxw5-5432)

2.12.0 - 2026-06-16

Deprecated

Deprecated non-finite float values in Query::build() that guzzlehttp/psr7 3.0 rejects

Deprecated non-finite float multipart contents that guzzlehttp/psr7 3.0 rejects

Deprecated non-string scalar bodies in Utils::streamFor(); cast them to a string for 3.0

Deprecated non-string Uri::withQueryValues() values; cast them to a string for 3.0

2.11.1 - 2026-06-12

Fixed

Fixed non-finite float values emitting coercion warnings on PHP 8.5

2.11.0 - 2026-06-02

Changed

Changed Utils::modifyRequest() to reject conflicting URI and Host header changes in the same call

Changed Header::parse() to split semicolon-separated parameters without repeated regular expression lookaheads

Changed UriComparator::isCrossOrigin() so only HTTP and HTTPS missing ports receive implicit default ports

Deprecated

Deprecated invalid PSR-7 arguments that guzzlehttp/psr7 3.0 will require native types for

Deprecated non-string header values that guzzlehttp/psr7 3.0 will reject

Deprecated empty header value arrays that guzzlehttp/psr7 3.0 will reject

Deprecated URI schemes that do not match guzzlehttp/psr7 3.0 syntax requirements

Deprecated multipart boundary and custom part header metadata that guzzlehttp/psr7 3.0 will reject

... (truncated)

Commits

7ec62dc Release 2.12.3
ddd64f1 Validate the URI host so getHost() matches the URI authority (#811)
5ec8b15 Release 2.12.2
5cfb193 Fail closed on validation PCRE errors (#803)
9e21236 Report message parser PCRE failures (#802)
45ae7e8 Report URI PCRE failures (#801)
7af66b9 Bump minimum PHP 8.0 polyfill version (#800)
172ef2f Release 2.12.1
f3f94b4 Mitigate CRLF Injection in HTTP Start-Line Serialization (#798)
9b38012 Release 2.12.0
Additional commits viewable in compare view

Updates guzzlehttp/psr7 from 2.9.0 to 2.12.3

Release notes

Sourced from guzzlehttp/psr7's releases.

2.12.3

Security

Validate the URI host so getHost() matches the URI authority (GHSA-c2w2-prh8-qm98)

2.12.2

Fixed

Report URI parsing, filtering, and normalization PCRE failures explicitly

Report HTTP message parser PCRE failures explicitly

Fail closed when PCRE validation fails for request targets and hosts

2.12.1

Security

Reject CR/LF in HTTP method, protocol version, and reason phrase (GHSA-vm85-hxw5-5432)

2.12.0

Deprecated

Deprecated non-finite float values in Query::build() that guzzlehttp/psr7 3.0 rejects

Deprecated non-finite float multipart contents that guzzlehttp/psr7 3.0 rejects

Deprecated non-string scalar bodies in Utils::streamFor(); cast them to a string for 3.0

Deprecated non-string Uri::withQueryValues() values; cast them to a string for 3.0

2.11.1

Fixed

Fixed non-finite float values emitting coercion warnings on PHP 8.5

2.11.0

Changed

Changed Utils::modifyRequest() to reject conflicting URI and Host header changes in the same call

Changed Header::parse() to split semicolon-separated parameters without repeated regular expression lookaheads

Changed UriComparator::isCrossOrigin() so only HTTP and HTTPS missing ports receive implicit default ports

Deprecated

Deprecated invalid PSR-7 arguments that guzzlehttp/psr7 3.0 will require native types for

Deprecated non-string header values that guzzlehttp/psr7 3.0 will reject

Deprecated empty header value arrays that guzzlehttp/psr7 3.0 will reject

Deprecated URI schemes that do not match guzzlehttp/psr7 3.0 syntax requirements

Deprecated multipart boundary and custom part header metadata that guzzlehttp/psr7 3.0 will reject

Deprecated reliance on automatic uppercasing of request methods; guzzlehttp/psr7 3.0 preserves method casing

Deprecated invalid Utils::modifyRequest() change values that guzzlehttp/psr7 3.0 will reject

Fixed

Fixed Utils::copyToStream() to retry short destination writes instead of dropping the unwritten remainder

... (truncated)

Changelog

Sourced from guzzlehttp/psr7's changelog.

2.12.3 - 2026-06-23

Security

Validate the URI host so getHost() matches the URI authority (GHSA-c2w2-prh8-qm98)

2.12.2 - 2026-06-23

Fixed

Report URI parsing, filtering, and normalization PCRE failures explicitly

Report HTTP message parser PCRE failures explicitly

Fail closed when PCRE validation fails for request targets and hosts

2.12.1 - 2026-06-18

Security

Reject CR/LF in HTTP method, protocol version, and reason phrase (GHSA-vm85-hxw5-5432)

2.12.0 - 2026-06-16

Deprecated

Deprecated non-finite float values in Query::build() that guzzlehttp/psr7 3.0 rejects

Deprecated non-finite float multipart contents that guzzlehttp/psr7 3.0 rejects

Deprecated non-string scalar bodies in Utils::streamFor(); cast them to a string for 3.0

Deprecated non-string Uri::withQueryValues() values; cast them to a string for 3.0

2.11.1 - 2026-06-12

Fixed

Fixed non-finite float values emitting coercion warnings on PHP 8.5

2.11.0 - 2026-06-02

Changed

Changed Utils::modifyRequest() to reject conflicting URI and Host header changes in the same call

Changed Header::parse() to split semicolon-separated parameters without repeated regular expression lookaheads

Changed UriComparator::isCrossOrigin() so only HTTP and HTTPS missing ports receive implicit default ports

Deprecated

Deprecated invalid PSR-7 arguments that guzzlehttp/psr7 3.0 will require native types for

Deprecated non-string header values that guzzlehttp/psr7 3.0 will reject

Deprecated empty header value arrays that guzzlehttp/psr7 3.0 will reject

Deprecated URI schemes that do not match guzzlehttp/psr7 3.0 syntax requirements

Deprecated multipart boundary and custom part header metadata that guzzlehttp/psr7 3.0 will reject

... (truncated)

Commits

7ec62dc Release 2.12.3
ddd64f1 Validate the URI host so getHost() matches the URI authority (#811)
5ec8b15 Release 2.12.2
5cfb193 Fail closed on validation PCRE errors (#803)
9e21236 Report message parser PCRE failures (#802)
45ae7e8 Report URI PCRE failures (#801)
7af66b9 Bump minimum PHP 8.0 polyfill version (#800)
172ef2f Release 2.12.1
f3f94b4 Mitigate CRLF Injection in HTTP Start-Line Serialization (#798)
9b38012 Release 2.12.0
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the composer group with 1 update in the /tests/integration directory: [guzzlehttp/guzzle](https://github.com/guzzle/guzzle). Bumps the composer group with 1 update in the /vendor-bin/phpunit directory: [guzzlehttp/psr7](https://github.com/guzzle/psr7). Updates `guzzlehttp/guzzle` from 7.10.0 to 7.15.2 - [Release notes](https://github.com/guzzle/guzzle/releases) - [Changelog](https://github.com/guzzle/guzzle/blob/7.15.2/CHANGELOG.md) - [Commits](guzzle/guzzle@7.10.0...7.15.2) Updates `guzzlehttp/psr7` from 2.9.0 to 2.13.1 - [Release notes](https://github.com/guzzle/psr7/releases) - [Changelog](https://github.com/guzzle/psr7/blob/3.1/CHANGELOG.md) - [Commits](guzzle/psr7@2.9.0...2.12.3) Updates `guzzlehttp/psr7` from 2.9.0 to 2.12.3 - [Release notes](https://github.com/guzzle/psr7/releases) - [Changelog](https://github.com/guzzle/psr7/blob/3.1/CHANGELOG.md) - [Commits](guzzle/psr7@2.9.0...2.12.3) --- updated-dependencies: - dependency-name: guzzlehttp/guzzle dependency-version: 7.15.2 dependency-type: direct:production dependency-group: composer - dependency-name: guzzlehttp/psr7 dependency-version: 2.13.1 dependency-type: indirect dependency-group: composer - dependency-name: guzzlehttp/psr7 dependency-version: 2.12.3 dependency-type: direct:development dependency-group: composer ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update php code labels Sep 9, 2026

vitormattos approved these changes Sep 9, 2026

View reviewed changes

vitormattos merged commit 0c14eb4 into main Sep 9, 2026
23 checks passed

vitormattos deleted the dependabot/composer/tests/integration/composer-0e3b8d63ae branch September 9, 2026 17:53

Navigation Menu

Uh oh!

chore(deps): Bump the composer group across 2 directories with 2 updates - #140

chore(deps): Bump the composer group across 2 directories with 2 updates#140
vitormattos merged 1 commit into
mainfrom
dependabot/composer/tests/integration/composer-0e3b8d63ae

dependabot Bot commented on behalf of github Sep 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 9, 2026

7.15.2

Security

Fixed

7.15.1

Security

7.15.0

Added

Changed

Deprecated

Fixed

7.15.2 - 2026-07-26

Security

Fixed

7.15.1 - 2026-07-18

Security

7.15.0 - 2026-07-17

Added

Changed

Deprecated

Fixed

2.12.3

Security

2.12.2

Fixed

2.12.1

Security

2.12.0

Deprecated

2.11.1

Fixed

2.11.0

Changed

Deprecated

Fixed

2.12.3 - 2026-06-23

Security

2.12.2 - 2026-06-23

Fixed

2.12.1 - 2026-06-18

Security

2.12.0 - 2026-06-16

Deprecated

2.11.1 - 2026-06-12

Fixed

2.11.0 - 2026-06-02

Changed

Deprecated

2.12.3

Security

2.12.2

Fixed

2.12.1

Security

2.12.0

Deprecated

2.11.1

Fixed

2.11.0

Changed

Deprecated

Fixed

2.12.3 - 2026-06-23

Security

2.12.2 - 2026-06-23

Fixed

2.12.1 - 2026-06-18

Security

2.12.0 - 2026-06-16

Deprecated

2.11.1 - 2026-06-12

Fixed

2.11.0 - 2026-06-02

Changed

Deprecated

Uh oh!

Uh oh!

Reviewers