[dependabot]

Updates the requirements on guzzlehttp/guzzle, christian-riesen/base32, phpseclib/phpseclib, phpunit/phpunit and league/uri to permit the latest version.
Updates guzzlehttp/guzzle to 8.3.1

Release notes

Sourced from guzzlehttp/guzzle's releases.

8.3.1

Fixed

• Fix CookieJar storing already expired cookies instead of removing the stored cookie
• Fix CookieJar ignoring a same-value cookie that changes its expiry or its Discard, Secure, or HttpOnly flag
• Fix SetCookie renewing the lifetime of Max-Age cookies rebuilt from an array, so persisted cookies never expired

Changelog

Sourced from guzzlehttp/guzzle's changelog.

8.3.1 - 2026-10-25

Fixed

• Fix CookieJar storing already expired cookies instead of removing the stored cookie
• Fix CookieJar ignoring a same-value cookie that changes its expiry or its Discard, Secure, or HttpOnly flag
• Fix SetCookie renewing the lifetime of Max-Age cookies rebuilt from an array, so persisted cookies never expired

8.3.0 - 2026-10-18

Changed

• Adjusted guzzlehttp/promises version constraint to ^3.1
• Adjusted guzzlehttp/psr7 version constraint to ^3.2
• Replace the deprecated Promise\Is with Promise\State for PHP 8.6
• Decode chunked stream handler bodies as they arrive, ending at the last chunk
• Reject truncated and malformed chunked stream handler bodies, like libcurl
• Reject unsupported response transfer codings, like libcurl 8.14+
• End stream handler bodies at their declared Content-Length, including 0
• Throw when a streamed body ends before its declared Content-Length
• Classify cURL errors 8 and 23 with a response as ResponseTransferException
• Reject stream handler gzip and deflate bodies with trailing data, like libcurl
• Accept raw deflate stream handler bodies, like libcurl

Fixed

• Fix streamed stream handler bodies delaying bytes that arrived with the headers

8.2.1 - 2026-10-18

Fixed

• Fix PHP 8.6 notices for oversized numeric hosts
• Fix delay values over 71 minutes
• Fix CurlMultiHandler delays over 71 minutes
• Fix overlapping stream handler requests sharing a deadline
• Fix stream handler responses in Swoole coroutines on PHP 8.4+
• Fix reads of streamed gzip and deflate responses waiting for 8 KiB of decoded data
• Fix stream handler accepting corrupt gzip and deflate response bodies

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^3.1.1

8.2.0 - 2026-09-06

Changed

... (truncated)

Commits

• 7d9b1f4 Release 8.3.1
• 2567cb4 Time only the attach in the ticking delayed request test (#3994)
• 89f4293 Keep the stored expiry when rebuilding Max-Age cookies (#3991)
• 3236dc4 Replace same-value cookies whose expiry or flags change (#3990)
• 0b3016c Drop expired cookies instead of storing them (#3987)
• b920e5f Release 8.3.0
• 1e0396c Decode stream handler gzip and deflate bodies like libcurl (#3972)
• e3ec346 Replace the deprecated promises Is with State (#3975)
• 1b3c5d3 List 7.16 as the maintained 7.x version (#3979)
• 453adce Raise minimum psr7 version to 3.2 (#3980)
• Additional commits viewable in compare view

Updates christian-riesen/base32 to 2.0.1

Release notes

Sourced from christian-riesen/base32's releases.

2.0.1

Due to a mistake, needed to retag this release.

Changelog

Sourced from christian-riesen/base32's changelog.

Changelog

2.0.0 (unreleased)

Backward-incompatible: PHP 8.1+ required

The minimum supported PHP version is now 8.1. If you need to run on PHP 7.2 – 8.0, stay on the 1.x release line.

Backward-incompatible: strict, RFC 4648-conformant decoding

Base32::decode() and Base32Hex::decode() now reject malformed input instead of silently sanitizing it. This resolves Trail of Bits finding TOB-WIKI2FA-5 (Wikimedia Foundation 2FA review).

Previously the decoder uppercased the input and stripped every character that was not in the alphabet — including padding — which violated RFC 4648 §3.3 ("Implementations MUST reject the encoded data if it contains characters outside the base alphabet") and allowed non-canonical values to decode.

decode() now throws \InvalidArgumentException when the input:

• has a length that is not a multiple of 8 (padding is required, RFC 4648 §3.2);
• contains any character outside the alphabet (RFC 4648 §3.3);
• contains misplaced or an invalid number of = padding characters;
• is not uppercase — decoding is now case-sensitive (RFC 4648 uses the uppercase alphabet). Lowercase input is no longer accepted.
• contains non-zero trailing bits, i.e. a non-canonical encoding (RFC 4648 §3.5).

An empty string still decodes to an empty string. encode() is unchanged; it was already conformant, so any string produced by encode() still round-trips.

Migration: if you pass user-supplied Base32 (for example TOTP secrets that may be lowercase or grouped with spaces), normalize it before decoding:

$secret = strtoupper(preg_replace('/\s+/', '', $userInput));
$bytes  = Base32::decode($secret); // throws on anything still invalid

Removed

• The BASE32HEX_PATTERN protected constant (was misnamed — it held the standard Base32 pattern, not the extended-hex one) and the '=' entry in the MAPPING constant. Both were implementation details of the old lenient decoder and are no longer used.

Commits

• be07b4a Upgrade github actions
• 81ac565 Full overhaul to 8.1 minimum
• 9646693 Add additional testing
• 357cc91 Stricter validations
• 03082b9 Merge pull request #37 from MarcoRemy/patch-1
• 2cf6364 Remove composer.json from .gitattributes export-ignore to include it in dist ...
• e8b7d85 Merge pull request #32 from afk11/code-style-1
• 70d6ab3 Merge pull request #33 from georgringer/patch-1
• bdeb2c6 Use https instead of http in Readme
• d49c69f Code style: if/else instead of continue. Makes it clearer the blocks are mutu...
• See full diff in compare view

Updates phpseclib/phpseclib to 4.0.2

Release notes

Sourced from phpseclib/phpseclib's releases.

4.0.2

• PFX: accept sha512 in setHashAlgorithm (#2173)
• SSH2: throw exceptions on error instead of returning false (#2174)
• SSH2: add getDebugMessages() (debug messages aren't errors) (#2174)
• SSH2: add getRawServerIdentification() (#2174)
• SSH2: fix for low probability key exchange failures (#2176)
• PrivateKey: new keys were being encrypted with the empty string
• CMS/SignedData: don't require issuerSerial in ESSCertID(v2) (#2178)
• CMS/SignedData: make validateSignature() return false if no sigs exist (#2178)

Changelog

Sourced from phpseclib/phpseclib's changelog.

4.0.2 - 2026-10-07

• PFX: accept sha512 in setHashAlgorithm (#2173)
• SSH2: throw exceptions on error instead of returning false (#2174)
• SSH2: add getDebugMessages() (debug messages aren't errors) (#2174)
• SSH2: add getRawServerIdentification() (#2174)
• SSH2: fix for low probability key exchange failures (#2176)
• PrivateKey: new keys were being encrypted with the empty string
• CMS/SignedData: don't require issuerSerial in ESSCertID(v2) (#2178)
• CMS/SignedData: make validateSignature() return false if no sigs exist (#2178)

4.0.1 - 2026-08-26

• Curve25519/448: improve timing attack resistance (CVE-2026-84308)

4.0.0 - 2026-08-22

• split CSR / CRL / SPKAC out from X509
• add PFX / CMS support
• implement lazy loading for ASN1
• SSH2/SFTP: throw exceptions instead of returning false
• bump minimum required PHP version to 8.1.0
• namespace changed from \phpseclib3 to \phpseclib4 to facilitate a yet to be written phpseclib 3 shim (phpseclib3_compat)

3.0.57 - 2026-08-26

• ASN1: fix tag matching for tagged CHOICE children (#2158)
• RSA: fix for openssl_verify calls that error out (#2161)
• RSA/PublicKey: implement salt length discovery for PSS verification (#2164)
• BigInteger/PHP: don't return the divisor as the common residue (#2165)
• Curve25519/448: improve timing attack resistance (CVE-2026-84308)

3.0.56 - 2026-08-02

• RSA: don't use OpenSSL for PSS on OpenSSL < 3.1.0 (#2152)
• SFTP: throw TimeoutExceptions on timeout vs UnexpectedValueException (#2156)
• SFTP/Stream: use default context if one isn't explicitly provided (#2154)

3.0.55 - 2026-06-14

• RSA: signature verification with PKCS1 with failed when the parameters field was absent

3.0.54 - 2026-06-14

• X509: add setURLFetchCallback() method (CVE-2026-55599)

3.0.53 - 2026-06-09

• RSA: decryption with password protected keys didn't work with OpenSSL engine (#2140)
• ASN1: speed up OID calculations

... (truncated)

Commits

• 1fe20b9 CHANGELOG: add 4.0.2 release
• 8738262 CMS/SignedData: make validateSignature() return f if no sigs exist
• c1bb18b CS adjustments
• 1ec00bb Merge pull request #2179 from orcnd/fix/2178-esscertid-without-issuerserial
• 209b3f7 Merge branch '3.0' into 4.0
• 24922fb Merge branch '3.0' of github.com:phpseclib/phpseclib into 3.0
• 057b9f8 Merge branch '2.0' into 3.0
• ebd4164 Merge branch '1.0' into 2.0
• b1b7ddd Composer: rm squizlabs/php_codesniffer as a dep
• 4746497 ASN1: backport "fix for optional field mixup error" from 4.0
• Additional commits viewable in compare view

Updates phpunit/phpunit to 13.4.5

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 13.4.5

Fixed

• The static analysis cache directory that is automatically created in the operating system's path used for temporary files when no cache directory is configured is not used when the POSIX extension is not loaded

---

Learn how to install or update PHPUnit 13.4 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

Changelog

Sourced from phpunit/phpunit's changelog.

[13.4.5] - 2026-10-27

Fixed

• The static analysis cache directory that is automatically created in the operating system's path used for temporary files when no cache directory is configured is not used when the POSIX extension is not loaded

[13.4.4] - 2026-10-27

Fixed

• The TeamCity logger writes testSuiteFinished twice for a test class when one of its before-first-test methods errors or fails
• The TestDox output shows a less important outcome of a test that has more than one outcome, for instance the failure in tearDown() of a test that errored
• When the test run is interrupted by a signal while a test is run in process isolation, the result of the test is discarded and the test is counted as passed, and the TestDox output cannot be printed
• When no static analysis cache directory is configured, the cache directory that is automatically created in the operating system's path used for temporary files is also used when it was created by another user or can be written to by other users
• The directory in the operating system's path used for temporary files in which the temporary files for collecting code coverage for a PHPT test are created has a fixed name, and is also used when it was created by another user, who can then replace the code of the PHPT test before it is executed

[13.4.3] - 2026-10-16

Fixed

• The dependencies of a test that are listed after a dependency on a test that does not return a value, or after a dependency on a larger test, were not checked, so the test was run instead of being skipped when one of these dependencies had not passed
• Tests could not be run in process isolation when the namespace of the test class begins with a name that the code of the child process imports, for instance CodeCoverage or Facade
• A test that is run in process isolation aborts the test run when its data set or a value returned by a test it depends on cannot be serialized, for instance because it is a closure
• When a before-first-test method or an after-last-test method errors or fails, the remaining methods of the same kind are still called, and each of them that does not error or fail itself is reported with the exception of the earlier method
• When a hook method of a test, for instance a #[Before] method, skips the test, the remaining hook methods of the same kind are still called, so the test is reported as errored instead of skipped when one of them errors
• An error or failure in a before-first-test method or an after-last-test method that is called again in the child process of a test that is run in process isolation is reported twice, once for the test class and once for the test
• When a before-first-test method errors, the progress output shows one E for the test class instead of one for each of its tests, only one of its tests is counted as run, and the test that is run next is shown as an error
• When a before-first-test method fails, the progress output shows nothing for the tests of the test class and only one of them is counted as run
• The Open Test Reporting XML logfile has no start for a test that errors before it is prepared, for instance because it depends on a test that does not exist, and no end for the test that is run after a test that is skipped because a test it depends on did not pass or because one of its requirements is not met
• The Open Test Reporting XML logfile has no entry for a test that is marked as incomplete before it is prepared, for instance in setUp(), and reports the test that is run after it as aborted with the message of the incomplete test
• The Open Test Reporting XML logfile has no end for the test that is run after a test whose preparation errors, for instance because setUp() raises an exception or the global state cannot be backed up
• The Open Test Reporting XML logfile reports a test that has more than one outcome, for instance because tearDown() fails after the test errored, with its last outcome instead of its most severe one, and with more than one end when the preparation of the test errored
• The Open Test Reporting XML logfile is not well-formed when a test name, a message, the output of a test, or the string representation of an exception contains ]]>, bytes that are not valid UTF-8, or characters that are not allowed in XML, for instance the escape character of an ANSI escape sequence
• The Open Test Reporting XML logfile reports an issue that is triggered before a test is prepared, for instance in setUp(), with an empty ID before the start of the test

[13.4.2] - 2026-10-12

Fixed

• #7033: Compact printer is created although an extension replaces the progress output
• #7035: Sorting tests by duration recomputes the duration of a test suite for every comparison
• Sorting tests by size recomputes the size of a test suite for every comparison
• expectUserDeprecationMessage() and expectUserDeprecationMessageMatches() did not see the deprecations triggered by an attempt of a retried test and saw those of the previously run test instead
• The status of a test whose mock object raises an exception in its destructor is success although the test is reported as errored, so #[Retry] does not retry the test, --repeat does not skip the remaining repetitions, tearDown() sees the wrong status, and code coverage records the test as successful
• Named arguments passed to with() were matched by position instead of by name, so an expectation such as ->with(b: 7) compared the expected value with the first parameter of the method and the parameter named $b was not checked
• String keys of the parameter sets passed to withParameterSetsInOrder(), withParameterSetsInAnyOrder(), and withParameterSetsInPartialOrder() were ignored, so a parameter set such as ['b' => 7] compared the expected value with the first parameter of the method and the parameter named $b was not checked

... (truncated)

Commits

• 941457a Prepare release
• 2080b37 Merge branch '12.5' into 13.4
• 1d6dbe7 Prepare release
• ef98204 Merge branch '12.5' into 13.4
• 15fb431 Do not require the POSIX extension for using the automatically created static...
• 71b681a Prepare release
• c056074 Merge branch '12.5' into 13.4
• 191b2e0 Prepare release
• ae31c78 Create the temporary files for collecting code coverage for a PHPT test in a ...
• c4c4f06 Merge branch '12.5' into 13.4
• Additional commits viewable in compare view

Updates league/uri to 7.9.1

Release notes

Sourced from league/uri's releases.

version 7.9.1

Added

• None

Fixed

• Bump uri-interfaces requirement.

Deprecated

• None

Removed

• None

Changelog

Sourced from league/uri's changelog.

7.9.1 - 2026-10-27

Added

• None

Fixed

• Bump uri-interfaces requirement.

Deprecated

• None

Removed

• None

7.9.0 - 2026-10-16

Added

• UriTemplate extraction feature
• UriTemplate::hasVariable() method to tell if the instance contains variable or not
• UrlPattern extraction feature
• Adding Type converter feature

Fixed

• UriTemplate::expandToPsr7 method implementation was incorrect

Deprecated

• None

Removed

• None

7.8.1 - 2026-03-16

Added

• None

Fixed

• Update requirement to use uri-interfaces 7.8.1
• Simplify VariableBag implementation
• Improve template expansion based on #193 by dualfroz

... (truncated)

Commits

• 40403f5 Update CHANGELOG
• f7929c5 Prepare 7.9.1 release
• 8557ec1 Fix data URI with only base64 parameter being rejected (#225)
• fcc872a Prepare 7.9.0 release
• 33e61b4 Improve Type convertion
• 0a90c41 Remove JsonSerializable interface from extraction results
• 7cc9a78 Improve UriTemplate extraction and UrlPattern feature public API
• ca5afc5 Align extraction result public API
• 1df194a Adding Component::fromEmpty()
• 25ab40b Fix internal codebase issues for UrlPattern
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[christian-rogobete]

Closing: the three runtime majors (Guzzle 8, phpseclib 4, base32 2) stay a deliberate release decision, and PHPUnit 13 needs PHP 8.4.1 while CI covers 8.1 to 8.5.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml