Skip to content

build(deps-dev): bump the dev-dependencies group across 1 directory with 2 updates#4

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/dev-dependencies-3b1bbcac86
Open

build(deps-dev): bump the dev-dependencies group across 1 directory with 2 updates#4
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/dev-dependencies-3b1bbcac86

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 22, 2026

Copy link
Copy Markdown

Updates the requirements on guzzlehttp/guzzle and squizlabs/php_codesniffer to permit the latest version.
Updates guzzlehttp/guzzle to 8.0.0

Release notes

Sourced from guzzlehttp/guzzle's releases.

8.0.0

Added

  • Add SensitiveParameter metadata to credential-bearing parameters so PHP 8.2+ redacts their values in exception traces
  • Add HTTP/3 request support to the built-in cURL handlers when PHP 8.4+ and libcurl provide HTTP/3 support
  • Add Multiplexing::NONE support as a client, cURL multi handler, and conditional request option
  • Add generic and structured PHPDoc annotations to client request/config option, async promise, handler, middleware, pool, and mock handler APIs
  • Add ConnectTimeoutException for connect-phase timeouts, extending ConnectException
  • Add NetworkException for no-response network failures
  • Add NetworkTimeoutException for no-response transport timeouts
  • Add ResponseTransferException, with ResponseTimeoutException for response-transfer timeouts
  • Add PSR-17 request_factory, response_factory, stream_factory, and uri_factory request options
  • Add explicit close() lifecycle methods to the built-in cURL handlers and concrete cURL factory
  • Add HandlerClosedException for pending transfers rejected by CurlMultiHandler::close()
  • Add persistent transport sharing modes (TransportSharing::PERSISTENT_PREFER and TransportSharing::PERSISTENT_REQUIRE)
  • Add ProxyOptions for proxy option resolution
  • Add ResponseException for request failures with responses
  • Add auth middleware for built-in Basic and Digest authentication

Changed

  • Canonicalize IPv6 hosts in Digest challenge cache keys
  • Canonicalize IPv6 hosts in cookie domains, host-only identities, and domain matching
  • Restrict cookie domain suffix matching to valid non-literal, nonnumeric host names
  • Reject Secure cookies and insecure overlays received over insecure connections
  • Enforce the __Secure- and __Host- prefix requirements on response cookies
  • Hardened FileCookieJar and SessionCookieJar persistence against unsafe unserialization
  • Reject native PHP serialization of runtime objects
  • Restrict persisted FileCookieJar cookie files to owner-only permissions
  • Require persisted cookie data to use JSON lists and construct all records before changing the jar
  • Normalize persistent cookie JSON failures as RuntimeException
  • Moved the internal Utils time, timeout, IDN, and environment helpers to dedicated internal classes
  • Adjusted guzzlehttp/promises version constraint to ^3.0
  • Adjusted guzzlehttp/psr7 version constraint to ^3.0
  • Quote multipart Content-Type boundary parameters when required
  • Added parameter and return types to SetCookie methods
  • Added native property types to supported public cURL handler state properties
  • Added a string return type to SetCookie::__toString()
  • Validate proxy and no-proxy option types strictly across handlers
  • Match leading-dot no-proxy entries against the bare domain and split string no-proxy lists on whitespace
  • Validate force_ip_resolve, protocols, and delay ranges at the client boundary
  • Treat a matching proxy no entry as final even without a scheme-specific proxy entry
  • Validate proxy URLs in the built-in handlers and reject malformed or unsupported ones up front
  • Default a port-less proxy to 1080 in the stream handler, matching libcurl
  • Downgrade HTTP/3 requests to HTTP/2 or HTTP/1.1 when the proxy is resolved from environment variables
  • Throw RequestException, not InvalidArgumentException, for an unavailable proxy or TLS feature
  • Resolve proxy environment variables in the stream handler, consistent with the cURL handlers
  • Honor no_proxy/NO_PROXY from the environment in the stream handler, including * to disable proxying
  • Reject an environment-resolved https:// or SOCKS proxy in the stream handler, matching its proxy option behavior
  • Require cURL proxy header separation for first-class Proxy-Authorization on every route

... (truncated)

Changelog

Sourced from guzzlehttp/guzzle's changelog.

8.0.0 - 2026-07-20

Added

  • Add SensitiveParameter metadata to credential-bearing parameters so PHP 8.2+ redacts their values in exception traces
  • Add HTTP/3 request support to the built-in cURL handlers when PHP 8.4+ and libcurl provide HTTP/3 support
  • Add Multiplexing::NONE support as a client, cURL multi handler, and conditional request option
  • Add generic and structured PHPDoc annotations to client request/config option, async promise, handler, middleware, pool, and mock handler APIs
  • Add ConnectTimeoutException for connect-phase timeouts, extending ConnectException
  • Add NetworkException for no-response network failures
  • Add NetworkTimeoutException for no-response transport timeouts
  • Add ResponseTransferException, with ResponseTimeoutException for response-transfer timeouts
  • Add PSR-17 request_factory, response_factory, stream_factory, and uri_factory request options
  • Add explicit close() lifecycle methods to the built-in cURL handlers and concrete cURL factory
  • Add HandlerClosedException for pending transfers rejected by CurlMultiHandler::close()
  • Add persistent transport sharing modes (TransportSharing::PERSISTENT_PREFER and TransportSharing::PERSISTENT_REQUIRE)
  • Add ProxyOptions for proxy option resolution
  • Add ResponseException for request failures with responses
  • Add auth middleware for built-in Basic and Digest authentication

Changed

  • Canonicalize IPv6 hosts in Digest challenge cache keys
  • Canonicalize IPv6 hosts in cookie domains, host-only identities, and domain matching
  • Restrict cookie domain suffix matching to valid non-literal, nonnumeric host names
  • Reject Secure cookies and insecure overlays received over insecure connections
  • Enforce the __Secure- and __Host- prefix requirements on response cookies
  • Hardened FileCookieJar and SessionCookieJar persistence against unsafe unserialization
  • Reject native PHP serialization of runtime objects
  • Restrict persisted FileCookieJar cookie files to owner-only permissions
  • Require persisted cookie data to use JSON lists and construct all records before changing the jar
  • Normalize persistent cookie JSON failures as RuntimeException
  • Moved the internal Utils time, timeout, IDN, and environment helpers to dedicated internal classes
  • Adjusted guzzlehttp/promises version constraint to ^3.0
  • Adjusted guzzlehttp/psr7 version constraint to ^3.0
  • Quote multipart Content-Type boundary parameters when required
  • Added parameter and return types to SetCookie methods
  • Added native property types to supported public cURL handler state properties
  • Added a string return type to SetCookie::__toString()
  • Validate proxy and no-proxy option types strictly across handlers
  • Match leading-dot no-proxy entries against the bare domain and split string no-proxy lists on whitespace
  • Validate force_ip_resolve, protocols, and delay ranges at the client boundary
  • Treat a matching proxy no entry as final even without a scheme-specific proxy entry
  • Validate proxy URLs in the built-in handlers and reject malformed or unsupported ones up front
  • Default a port-less proxy to 1080 in the stream handler, matching libcurl
  • Downgrade HTTP/3 requests to HTTP/2 or HTTP/1.1 when the proxy is resolved from environment variables
  • Throw RequestException, not InvalidArgumentException, for an unavailable proxy or TLS feature
  • Resolve proxy environment variables in the stream handler, consistent with the cURL handlers
  • Honor no_proxy/NO_PROXY from the environment in the stream handler, including * to disable proxying
  • Reject an environment-resolved https:// or SOCKS proxy in the stream handler, matching its proxy option behavior

... (truncated)

Commits

Updates squizlabs/php_codesniffer to 4.0.1

Release notes

Sourced from squizlabs/php_codesniffer's releases.

4.0.1 - 2025-11-10

This release includes all improvements and bugfixes from PHP_CodeSniffer 3.13.5.

Added

  • Runtime support for PHP 8.5. All known PHP 8.5 deprecation notices have been fixed.
    • Syntax support for new PHP 8.5 features will follow in a future release.
    • If you find any PHP 8.5 deprecation notices which were missed, please report them.

Changed

  • The Squiz.ControlStructures.SwitchDeclaration sniff will now flag a PHP close tag as a "wrong opener" and will auto-fix this by inserting a colon. #1316
  • Various housekeeping, including improvements to the tests and documentation.

Fixed

  • 4.x regression #1277: bring back whitespace tolerance in phpcs:ignore comma-separated rule reference lists.
    • Note: this bug did not affect phpcs:disable/phpcs:enable ignore annotations.
  • Fixed bug #968: Generic.WhiteSpace.ScopeIndent was reporting false positives - and making incorrect fixes - for lines following a line containing an arrow function.
  • Fixed bug #1216: Tokenizer/PHP: added more defensive coding to prevent PHP 8.5 "Using null as an array offset" deprecation notices.
  • Fixed bug #1279: Tokenizer/PHP: on PHP < 8.0, an unclosed attribute (parse error) could end up removing some tokens from the token stream.
    • This could lead to false positives and false negative from sniffs, but could also lead to incorrect fixes being made mangling the file under scan.
  • Fixed bug #1315: Squiz.ControlStructures.SwitchDeclaration: a number of the fixers would get into fixer conflicts with each other if the code under scan contained multiple statements on a line within a switch.
    • The sniff will now forbid - and auto-fix - multiple statements on one line for case/default and "case breaking" statements.
  • Fixed bug #1316: Tokenizer/PHP: a PHP close tag after a switch case condition or after a default keyword, was not regarded as a "scope_opener" for the case/default body.
  • Fixed bug #1316: PSR2.ControlStructures.SwitchDeclaration: the WrongOpener error is now also auto-fixable if the wrong opener is a PHP close tag.
  • Fixed bug #1316: Squiz.PHP.NonExecutableCode would throw false positives when code within a switch control structure would move in and out of PHP.

New Contributors

The PHP_CodeSniffer project is happy to welcome the following new contributors: @​andrewnicols, @​Soh1121

Statistics

Closed: 2 issues Merged: 8 pull requests

Follow @​phpcs on Mastodon or @​PHP_CodeSniffer on X to stay informed.

Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!

Changelog

Sourced from squizlabs/php_codesniffer's changelog.

[4.0.1] - 2025-11-10

This release includes all improvements and bugfixes from PHP_CodeSniffer 3.13.5.

Added

  • Runtime support for PHP 8.5. All known PHP 8.5 deprecation notices have been fixed.
    • Syntax support for new PHP 8.5 features will follow in a future release.
    • If you find any PHP 8.5 deprecation notices which were missed, please report them.

Changed

  • The Squiz.ControlStructures.SwitchDeclaration sniff will now flag a PHP close tag as a "wrong opener" and will auto-fix this by inserting a colon. #1316
  • Various housekeeping, including improvements to the tests and documentation.

Fixed

  • 4.x regression #1277: bring back whitespace tolerance in phpcs:ignore comma-separated rule reference lists.
    • Note: this bug did not affect phpcs:disable/phpcs:enable ignore annotations.
  • Fixed bug #968: Generic.WhiteSpace.ScopeIndent was reporting false positives - and making incorrect fixes - for lines following a line containing an arrow function.
  • Fixed bug #1216: Tokenizer/PHP: added more defensive coding to prevent PHP 8.5 "Using null as an array offset" deprecation notices.
  • Fixed bug #1279: Tokenizer/PHP: on PHP < 8.0, an unclosed attribute (parse error) could end up removing some tokens from the token stream.
    • This could lead to false positives and false negative from sniffs, but could also lead to incorrect fixes being made mangling the file under scan.
  • Fixed bug #1315: Squiz.ControlStructures.SwitchDeclaration: a number of the fixers would get into fixer conflicts with each other if the code under scan contained multiple statements on a line within a switch.
    • The sniff will now forbid - and auto-fix - multiple statements on one line for case/default and "case breaking" statements.
  • Fixed bug #1316: Tokenizer/PHP: a PHP close tag after a switch case condition or after a default keyword, was not regarded as a "scope_opener" for the case/default body.
  • Fixed bug #1316: PSR2.ControlStructures.SwitchDeclaration: the WrongOpener error is now also auto-fixable if the wrong opener is a PHP close tag.
  • Fixed bug #1316: Squiz.PHP.NonExecutableCode would throw false positives when code within a switch control structure would move in and out of PHP.

#968: PHPCSStandards/PHP_CodeSniffer#968 #1216: PHPCSStandards/PHP_CodeSniffer#1216 #1277: PHPCSStandards/PHP_CodeSniffer#1277 #1279: PHPCSStandards/PHP_CodeSniffer#1279 #1315: PHPCSStandards/PHP_CodeSniffer#1315 #1316: PHPCSStandards/PHP_CodeSniffer#1316

[4.0.0] - 2025-09-16

This release contains breaking changes.

Upgrade guides for both [ruleset maintainers/end-users][wiki-upgrade-4.0-end-users], as well as for [sniff developers and integrators][wiki-upgrade-4.0-extenders], have been published to the Wiki.

You are strongly encouraged to read the upgrade guide applicable to your situation before upgrading.

This release includes all improvements and bugfixes from PHP_CodeSniffer [4.0.0-beta1], [4.0.0-RC1], [3.13.3] and [3.13.4].

Changed

  • Tokenizer/PHP: fully qualified exit/die/true/false/null will be tokenized as the keyword token and the token 'content' will include the leading backslash. #1201

... (truncated)

Commits
  • 0525c73 Merge pull request #1318 from PHPCSStandards/feature/changelog-4.0.1
  • 4c09fb4 Changelog for the 4.0.1 release
  • 7ed8ea2 Merge pull request #1316 from PHPCSStandards/feature/tokenizer-php-switch-cas...
  • b80dc24 Various sniffs: update tests to safeguard handling of case/default with P...
  • 6bd0af6 Squiz/NonExecutableCode: bug fix - false positive with PHP close tag after ca...
  • 6d61496 Squiz/SwitchDeclaration: make implied semicolon via close tag auto-fixable
  • 21c0e80 PSR2/SwitchDeclaration: make implied semicolon via close tag auto-fixable
  • 6327f77 Tokenizer/PHP: PHP close tag should be regarded as scope opener for switch ca...
  • 9397930 Squiz/SwitchDeclaration: bug fix - fixer conflict for single line code (#1315)
  • 2c13a90 Merge pull request #1308 from Soh1121/issue-968/fix-wrong-indentation-with-ar...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps-dev): bump the dev-dependencies group across 1 directory w…
66edead 
…ith 2 updates

Updates the requirements on [guzzlehttp/guzzle](https://github.com/guzzle/guzzle) and [squizlabs/php_codesniffer](https://github.com/PHPCSStandards/PHP_CodeSniffer) to permit the latest version.

Updates `guzzlehttp/guzzle` to 8.0.0
- [Release notes](https://github.com/guzzle/guzzle/releases)
- [Changelog](https://github.com/guzzle/guzzle/blob/8.0/CHANGELOG.md)
- [Commits](guzzle/guzzle@7.12.1...8.0.0)

Updates `squizlabs/php_codesniffer` to 4.0.1
- [Release notes](https://github.com/PHPCSStandards/PHP_CodeSniffer/releases)
- [Changelog](https://github.com/PHPCSStandards/PHP_CodeSniffer/blob/4.x/CHANGELOG-4.x.md)
- [Commits](PHPCSStandards/PHP_CodeSniffer@3.7.0...4.0.1)

---
updated-dependencies:
- dependency-name: guzzlehttp/guzzle
  dependency-version: 8.0.0
  dependency-type: direct:development
  dependency-group: dev-dependencies
- dependency-name: squizlabs/php_codesniffer
  dependency-version: 4.0.1
  dependency-type: direct:development
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update php code labels Jul 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file php Pull requests that update php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants