Skip to content

Bump guzzlehttp/guzzle from 6.1.1 to 7.12.1 - #6

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/composer/guzzlehttp/guzzle-7.12.1
Closed

Bump guzzlehttp/guzzle from 6.1.1 to 7.12.1#6
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/composer/guzzlehttp/guzzle-7.12.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps guzzlehttp/guzzle from 6.1.1 to 7.12.1.

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.12.1

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.12.1

Fixed

  • Reject proxy URLs with a malformed scheme in the cURL handlers instead of letting libcurl mishandle them

Security

7.12.0

Added

  • Added RequestOptions constants for curl, retries, and stream_context

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.12
  • Constrain cURL transport sharing to safe libcurl DNS and SSL session support
  • Resolve proxy environment variables in the cURL handlers; libcurl no longer reads the environment itself
  • Ignore proxy environment variables when the proxy request option makes a decision
  • Disable proxy environment variables on Windows SAPIs other than CLI (httpoxy hardening)
  • Redact proxy credentials from cURL handler error messages, following Psr7\Utils::redactUserInfo()
  • Normalize no-proxy domain and IP literal matching across the cURL and stream handlers

Deprecated

  • Deprecated the request-level handler option, which will be ignored in 8.0
  • Deprecated raw cURL request options outside the built-in cURL handlers' allow-list
  • Deprecated the CURLOPT_PROXYTYPE cURL request option; set the proxy type via a scheme-prefixed proxy URL
  • Deprecated PHP stream context options outside the built-in stream handler allow-list
  • Deprecated passing ntlm as a built-in auth type
  • Deprecated Utils::describeType()
  • Deprecated non-finite floats in the query and form_params options; 8.0 rejects them
  • Deprecated non-string scalar values in the body option; 8.0 rejects them

Fixed

  • Fix cURL TLS and HTTP/2 capability detection using libcurl feature checks
  • Fix proxy no list matches being re-proxied through environment-configured proxies by libcurl
  • Fix no list and NO_PROXY matching to support IP CIDR ranges, matching libcurl
  • Fix the stream handler not applying scheme-less proxies and their credentials

7.11.2

Fixed

... (truncated)

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.12.1 - 2026-06-18

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.12.1

Fixed

  • Reject proxy URLs with a malformed scheme in the cURL handlers instead of letting libcurl mishandle them

Security

7.12.0 - 2026-06-16

Added

  • Added RequestOptions constants for curl, retries, and stream_context

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.12
  • Constrain cURL transport sharing to safe libcurl DNS and SSL session support
  • Resolve proxy environment variables in the cURL handlers; libcurl no longer reads the environment itself
  • Ignore proxy environment variables when the proxy request option makes a decision
  • Disable proxy environment variables on Windows SAPIs other than CLI (httpoxy hardening)
  • Redact proxy credentials from cURL handler error messages, following Psr7\Utils::redactUserInfo()
  • Normalize no-proxy domain and IP literal matching across the cURL and stream handlers

Deprecated

  • Deprecated the request-level handler option, which will be ignored in 8.0
  • Deprecated raw cURL request options outside the built-in cURL handlers' allow-list
  • Deprecated the CURLOPT_PROXYTYPE cURL request option; set the proxy type via a scheme-prefixed proxy URL
  • Deprecated PHP stream context options outside the built-in stream handler allow-list
  • Deprecated passing ntlm as a built-in auth type
  • Deprecated Utils::describeType()
  • Deprecated non-finite floats in the query and form_params options; 8.0 rejects them
  • Deprecated non-string scalar values in the body option; 8.0 rejects them

Fixed

  • Fix cURL TLS and HTTP/2 capability detection using libcurl feature checks
  • Fix proxy no list matches being re-proxied through environment-configured proxies by libcurl
  • Fix no list and NO_PROXY matching to support IP CIDR ranges, matching libcurl
  • Fix the stream handler not applying scheme-less proxies and their credentials

... (truncated)

Commits
  • d346274 Release 7.12.1
  • 7f537cd Reject dot-only cookie domains (#3653)
  • 29482f2 Adjust version constraints (#3651)
  • fc70174 Reject proxy URLs with a malformed scheme in the cURL handlers (#3637)
  • 0f4da82 Reject HTTPS proxies when libcurl lacks HTTPS-proxy support (#3626)
  • eaa8159 Release 7.12.0
  • e0d3349 Adjusted guzzlehttp/psr7 version constraint and corrected links (#3646)
  • 8ca9415 Normalize scalar body request options (#3644)
  • 1a8d3aa Translate scheme-less proxies and their credentials in the stream handler (#3...
  • 751f7a5 Revert too aggressive authenticated proxy tunnel reuse mitigation (#3641)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update php code labels Jun 22, 2026
@private-packagist

private-packagist Bot commented Jun 22, 2026 •
edited
Loading

Copy link
Copy Markdown

composer.lock

Package changes

Package Operation From To About
psr/http-client add - 1.0.3 view code - License: MIT License
psr/http-factory add - 1.1.0 view code - License: MIT License
symfony/deprecation-contracts add - v3.7.1 view code - License: MIT License
symfony/polyfill-php80 add - v1.37.0 view code - License: MIT License
guzzlehttp/guzzle upgrade 6.1.1 ⚠️ 7.12.1 ✅ diff
guzzlehttp/promises upgrade 1.0.3 2.5.1 diff
guzzlehttp/psr7 upgrade 1.9.1 ⚠️ 2.13.0 ✅ diff
psr/http-message upgrade 1.1 2.0 diff

Settings · Docs · Powered by Private Packagist

@dependabot
Bump guzzlehttp/guzzle from 6.1.1 to 7.12.1
a81ede2 
Bumps [guzzlehttp/guzzle](https://github.com/guzzle/guzzle) from 6.1.1 to 7.12.1.
- [Release notes](https://github.com/guzzle/guzzle/releases)
- [Changelog](https://github.com/guzzle/guzzle/blob/7.15/CHANGELOG.md)
- [Commits](guzzle/guzzle@6.1.1...7.12.1)

---
updated-dependencies:
- dependency-name: guzzlehttp/guzzle
  dependency-version: 7.12.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/composer/guzzlehttp/guzzle-7.12.1 branch from c243a92 to a81ede2 Compare July 17, 2026 12:01
@private-packagist

private-packagist Bot commented Jul 17, 2026

Copy link
Copy Markdown

The composer.lock diff comment has been updated to reflect new changes in this PR.

@joostfaassen

joostfaassen commented Jul 17, 2026

Copy link
Copy Markdown
Member

🤖 Dependabot PR processing skill — risk assessment

Acting on behalf of Joost Faassen.

Decision

Do not merge automatically — assessed risk: high

What changed
Title Bump guzzlehttp/guzzle from 6.1.1 to 7.12.1
Semver major (6.1.1 → 7.12.1)
Files (2) composer.json, composer.lock
Diff size +425 / −50

Why this was not merged automatically

  1. This looks like a major semver jump (6.1.1 → 7.12.1).
  2. Major dependency upgrades can introduce breaking API or runtime changes.
  3. Left open for human review.

Checks considered

  • Pull request is mergeable with a clean merge state
  • No failing / timed-out / cancelled required checks observed
  • Diff inspected for manifests/lockfiles only vs unexpected paths
  • Package/path screened against sensitive dependency patterns

Automated assessment by the Dependabot PR processing skill. Detail stays in this comment; the merge commit message is kept short on purpose.

4 similar comments
@joostfaassen

joostfaassen commented Jul 17, 2026

Copy link
Copy Markdown
Member

🤖 Dependabot PR processing skill — risk assessment

Acting on behalf of Joost Faassen.

Decision

Do not merge automatically — assessed risk: high

What changed
Title Bump guzzlehttp/guzzle from 6.1.1 to 7.12.1
Semver major (6.1.1 → 7.12.1)
Files (2) composer.json, composer.lock
Diff size +425 / −50

Why this was not merged automatically

  1. This looks like a major semver jump (6.1.1 → 7.12.1).
  2. Major dependency upgrades can introduce breaking API or runtime changes.
  3. Left open for human review.

Checks considered

  • Pull request is mergeable with a clean merge state
  • No failing / timed-out / cancelled required checks observed
  • Diff inspected for manifests/lockfiles only vs unexpected paths
  • Package/path screened against sensitive dependency patterns

Automated assessment by the Dependabot PR processing skill. Detail stays in this comment; the merge commit message is kept short on purpose.

@joostfaassen

joostfaassen commented Jul 17, 2026

Copy link
Copy Markdown
Member

🤖 Dependabot PR processing skill — risk assessment

Acting on behalf of Joost Faassen.

Decision

Do not merge automatically — assessed risk: high

What changed
Title Bump guzzlehttp/guzzle from 6.1.1 to 7.12.1
Semver major (6.1.1 → 7.12.1)
Files (2) composer.json, composer.lock
Diff size +425 / −50

Why this was not merged automatically

  1. This looks like a major semver jump (6.1.1 → 7.12.1).
  2. Major dependency upgrades can introduce breaking API or runtime changes.
  3. Left open for human review.

Checks considered

  • Pull request is mergeable with a clean merge state
  • No failing / timed-out / cancelled required checks observed
  • Diff inspected for manifests/lockfiles only vs unexpected paths
  • Package/path screened against sensitive dependency patterns

Automated assessment by the Dependabot PR processing skill. Detail stays in this comment; the merge commit message is kept short on purpose.

@joostfaassen

joostfaassen commented Jul 17, 2026

Copy link
Copy Markdown
Member

🤖 Dependabot PR processing skill — risk assessment

Acting on behalf of Joost Faassen.

Decision

Do not merge automatically — assessed risk: high

What changed
Title Bump guzzlehttp/guzzle from 6.1.1 to 7.12.1
Semver major (6.1.1 → 7.12.1)
Files (2) composer.json, composer.lock
Diff size +425 / −50

Why this was not merged automatically

  1. This looks like a major semver jump (6.1.1 → 7.12.1).
  2. Major dependency upgrades can introduce breaking API or runtime changes.
  3. Left open for human review.

Checks considered

  • Pull request is mergeable with a clean merge state
  • No failing / timed-out / cancelled required checks observed
  • Diff inspected for manifests/lockfiles only vs unexpected paths
  • Package/path screened against sensitive dependency patterns

Automated assessment by the Dependabot PR processing skill. Detail stays in this comment; the merge commit message is kept short on purpose.

@joostfaassen

joostfaassen commented Jul 17, 2026

Copy link
Copy Markdown
Member

🤖 Dependabot PR processing skill — risk assessment

Acting on behalf of Joost Faassen.

Decision

Do not merge automatically — assessed risk: high

What changed
Title Bump guzzlehttp/guzzle from 6.1.1 to 7.12.1
Semver major (6.1.1 → 7.12.1)
Files (2) composer.json, composer.lock
Diff size +425 / −50

Why this was not merged automatically

  1. This looks like a major semver jump (6.1.1 → 7.12.1).
  2. Major dependency upgrades can introduce breaking API or runtime changes.
  3. Left open for human review.

Checks considered

  • Pull request is mergeable with a clean merge state
  • No failing / timed-out / cancelled required checks observed
  • Diff inspected for manifests/lockfiles only vs unexpected paths
  • Package/path screened against sensitive dependency patterns

Automated assessment by the Dependabot PR processing skill. Detail stays in this comment; the merge commit message is kept short on purpose.

@dependabot @github

dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #7.

@dependabot dependabot Bot closed this Jul 20, 2026
@dependabot
dependabot Bot deleted the dependabot/composer/guzzlehttp/guzzle-7.12.1 branch July 20, 2026 22:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file php Pull requests that update php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@joostfaassen