chore(deps): bump guzzlehttp/guzzle from 7.15.2 to 8.1.0

[dependabot]

Bumps guzzlehttp/guzzle from 7.15.2 to 8.1.0.

Release notes

Sourced from guzzlehttp/guzzle's releases.

8.1.0

Added

• Add PHP 8.6+ stream TLS session sharing, while persistent sharing remains cURL-only
• Add support for PHP 8.6
• Add in-transfer resends of seekable streamed uploads when PHP exposes CURLOPT_SEEKFUNCTION

Changed

• Adjusted guzzlehttp/promises version constraint to ^3.0.2
• Adjusted guzzlehttp/psr7 version constraint to ^3.1
• Classify stream handler transport failures using PHP 8.6+ structured stream error codes
• Hide URI credentials, queries, and fragments in automatic exception messages
• Match no_proxy rules against IPv4 hosts written in the shorthand a transport reads as an address
• Hold the cURL easy handle out of the reuse pool until a silent retry has been dispatched
• Treat a deferred resolved with a pending retry promise as progress when waiting on cURL transfers

8.0.3

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^3.0.1

8.0.2

Changed

• Adjusted guzzlehttp/promises version constraint to ^3.0.1

Fixed

• Fail a cURL multi handler wait with an attributable error when the transfer is no longer tracked
• Fix StreamHandler resolving numeric IPv4 hosts differently from cURL handlers on macOS and Windows
• Fix StreamHandler TLS peer names and proxy authorities for numeric IPv4 hosts on all platforms
• Settle a cURL multi handler transfer displaced by a request reusing its native handle ID

8.0.1

Security

• Reject request URI hosts and Host header values that are not printable ASCII (GHSA-v5mv-p594-2x33)
• Reject URI hosts with a percent escape or that are not valid RFC 3986 hosts (GHSA-v5mv-p594-2x33)
• Reject numeric-looking URI hosts with trailing dots, read as IPv4 addresses (GHSA-v5mv-p594-2x33)
• Treat percent-escaped cookie domains as exact-match-only (GHSA-f7vp-7xgx-4w4r)
• Regenerate a derived Host header after client URI rewrites (GHSA-v5mv-p594-2x33)

8.0.0

Added

• Add SensitiveParameter metadata to credential-bearing parameters so PHP 8.2+ redacts their values in exception traces
• Add HTTP/3 request support to the built-in cURL handlers when PHP 8.4+ and libcurl provide HTTP/3 support
• Add Multiplexing::NONE support as a client, cURL multi handler, and conditional request option
• Add generic and structured PHPDoc annotations to client request/config option, async promise, handler, middleware, pool, and mock handler APIs

... (truncated)

Changelog

Sourced from guzzlehttp/guzzle's changelog.

8.1.0 - Upcoming

Added

• Add PHP 8.6+ stream TLS session sharing, while persistent sharing remains cURL-only
• Add support for PHP 8.6
• Add in-transfer resends of seekable streamed uploads when PHP exposes CURLOPT_SEEKFUNCTION

Changed

• Adjusted guzzlehttp/promises version constraint to ^3.0.2
• Adjusted guzzlehttp/psr7 version constraint to ^3.1
• Classify stream handler transport failures using PHP 8.6+ structured stream error codes
• Hide URI credentials, queries, and fragments in automatic exception messages
• Match no_proxy rules against IPv4 hosts written in the shorthand a transport reads as an address
• Hold the cURL easy handle out of the reuse pool until a silent retry has been dispatched
• Treat a deferred resolved with a pending retry promise as progress when waiting on cURL transfers

8.0.3 - 2026-08-24

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^3.0.1

8.0.2 - 2026-08-05

Changed

• Adjusted guzzlehttp/promises version constraint to ^3.0.1

Fixed

• Fail a cURL multi handler wait with an attributable error when the transfer is no longer tracked
• Fix StreamHandler resolving numeric IPv4 hosts differently from cURL handlers on macOS and Windows
• Fix StreamHandler TLS peer names and proxy authorities for numeric IPv4 hosts on all platforms
• Settle a cURL multi handler transfer displaced by a request reusing its native handle ID

8.0.1 - 2026-07-26

Security

• Reject request URI hosts and Host header values that are not printable ASCII (GHSA-v5mv-p594-2x33)
• Reject URI hosts with a percent escape or that are not valid RFC 3986 hosts (GHSA-v5mv-p594-2x33)
• Reject numeric-looking URI hosts with trailing dots, read as IPv4 addresses (GHSA-v5mv-p594-2x33)
• Treat percent-escaped cookie domains as exact-match-only (GHSA-f7vp-7xgx-4w4r)
• Regenerate a derived Host header after client URI rewrites (GHSA-v5mv-p594-2x33)

... (truncated)

Commits

• 2cdae51 Bump versions (#3930)
• 2c2660b Merge remote-tracking branch 'origin/8.0' into 8.1
• b690be7 Release 8.0.3
• 3ffe68d Adjusted guzzlehttp/psr7 version constraint to ^3.0.1 (#3929)
• 450b9a5 Add PHP 8.6 to the supported versions and version guidance (#3927)
• 31d536d Treat a deferred resolved with a pending retry promise as wait progress (#3925)
• a43bf79 Invoke the static TLS range assertion without an object for PHP 8.6 (#3926)
• 67c1b87 Bump psr7 references in the docs (#3922)
• 494e06a Harden automatic URI diagnostics (#3916)
• 6c48c8f Merge branch '8.0' into 8.1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Quality Report — ConductionNL/integriq @ 3431cc7

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	❌
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
build		✅
check-specs		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 145/145
npm			✅	✅ 538/538
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					✅
Playwright					🚨 NO VERDICT — enabled but never ran
Hydra gates					✅

---

Quality workflow — 2026-08-30 23:03 UTC

Download the full PDF report from the workflow artifacts.

[rubenvdlinde]

Closing: guzzlehttp/guzzle@8 cannot resolve on its own, verified in a PHP container rather than assumed.

- Root composer.json requires guzzlehttp/guzzle ^8.1.0 -> satisfiable by guzzlehttp/guzzle[8.1.0].
- guzzlehttp/guzzle 8.1.0 requires guzzlehttp/promises ^3.0.2
    -> found guzzlehttp/promises[3.0.2] but the package is fixed to 2.5.1 (lock file)

Guzzle 8 requires guzzlehttp/promises ^3, and this lock pins promises at 2.5.1. They are a pair and must move together; bumping guzzle alone leaves the tree unsatisfiable, so composer install fails and every PHP job fails with it.

That is the same shape that broke eight apps on the npm side tonight: a major merged without the peer that has to move with it, each one looking harmless on its own.

Adopting guzzle 8 here means bumping guzzlehttp/promises to ^3 in the same change, and checking the two call sites that use promise APIs. That is a deliberate piece of work, not a dependency bump.

Dependabot will reopen this when it can group the pair.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.