Skip to content

Bump guzzlehttp/guzzle from 4.2.3 to 7.12.1 - #1

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/composer/guzzlehttp/guzzle-7.12.1
Closed

Bump guzzlehttp/guzzle from 4.2.3 to 7.12.1#1
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/composer/guzzlehttp/guzzle-7.12.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 22, 2026

Copy link
Copy Markdown

Bumps guzzlehttp/guzzle from 4.2.3 to 7.12.1.

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.12.1

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.12.1

Fixed

  • Reject proxy URLs with a malformed scheme in the cURL handlers instead of letting libcurl mishandle them

Security

7.12.0

Added

  • Added RequestOptions constants for curl, retries, and stream_context

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.12
  • Constrain cURL transport sharing to safe libcurl DNS and SSL session support
  • Resolve proxy environment variables in the cURL handlers; libcurl no longer reads the environment itself
  • Ignore proxy environment variables when the proxy request option makes a decision
  • Disable proxy environment variables on Windows SAPIs other than CLI (httpoxy hardening)
  • Redact proxy credentials from cURL handler error messages, following Psr7\Utils::redactUserInfo()
  • Normalize no-proxy domain and IP literal matching across the cURL and stream handlers

Deprecated

  • Deprecated the request-level handler option, which will be ignored in 8.0
  • Deprecated raw cURL request options outside the built-in cURL handlers' allow-list
  • Deprecated the CURLOPT_PROXYTYPE cURL request option; set the proxy type via a scheme-prefixed proxy URL
  • Deprecated PHP stream context options outside the built-in stream handler allow-list
  • Deprecated passing ntlm as a built-in auth type
  • Deprecated Utils::describeType()
  • Deprecated non-finite floats in the query and form_params options; 8.0 rejects them
  • Deprecated non-string scalar values in the body option; 8.0 rejects them

Fixed

  • Fix cURL TLS and HTTP/2 capability detection using libcurl feature checks
  • Fix proxy no list matches being re-proxied through environment-configured proxies by libcurl
  • Fix no list and NO_PROXY matching to support IP CIDR ranges, matching libcurl
  • Fix the stream handler not applying scheme-less proxies and their credentials

7.11.2

Fixed

... (truncated)

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.12.1 - 2026-06-18

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.12.1

Fixed

  • Reject proxy URLs with a malformed scheme in the cURL handlers instead of letting libcurl mishandle them

Security

7.12.0 - 2026-06-16

Added

  • Added RequestOptions constants for curl, retries, and stream_context

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.12
  • Constrain cURL transport sharing to safe libcurl DNS and SSL session support
  • Resolve proxy environment variables in the cURL handlers; libcurl no longer reads the environment itself
  • Ignore proxy environment variables when the proxy request option makes a decision
  • Disable proxy environment variables on Windows SAPIs other than CLI (httpoxy hardening)
  • Redact proxy credentials from cURL handler error messages, following Psr7\Utils::redactUserInfo()
  • Normalize no-proxy domain and IP literal matching across the cURL and stream handlers

Deprecated

  • Deprecated the request-level handler option, which will be ignored in 8.0
  • Deprecated raw cURL request options outside the built-in cURL handlers' allow-list
  • Deprecated the CURLOPT_PROXYTYPE cURL request option; set the proxy type via a scheme-prefixed proxy URL
  • Deprecated PHP stream context options outside the built-in stream handler allow-list
  • Deprecated passing ntlm as a built-in auth type
  • Deprecated Utils::describeType()
  • Deprecated non-finite floats in the query and form_params options; 8.0 rejects them
  • Deprecated non-string scalar values in the body option; 8.0 rejects them

Fixed

  • Fix cURL TLS and HTTP/2 capability detection using libcurl feature checks
  • Fix proxy no list matches being re-proxied through environment-configured proxies by libcurl
  • Fix no list and NO_PROXY matching to support IP CIDR ranges, matching libcurl
  • Fix the stream handler not applying scheme-less proxies and their credentials

... (truncated)

Commits
  • d346274 Release 7.12.1
  • 7f537cd Reject dot-only cookie domains (#3653)
  • 29482f2 Adjust version constraints (#3651)
  • fc70174 Reject proxy URLs with a malformed scheme in the cURL handlers (#3637)
  • 0f4da82 Reject HTTPS proxies when libcurl lacks HTTPS-proxy support (#3626)
  • eaa8159 Release 7.12.0
  • e0d3349 Adjusted guzzlehttp/psr7 version constraint and corrected links (#3646)
  • 8ca9415 Normalize scalar body request options (#3644)
  • 1a8d3aa Translate scheme-less proxies and their credentials in the stream handler (#3...
  • 751f7a5 Revert too aggressive authenticated proxy tunnel reuse mitigation (#3641)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump guzzlehttp/guzzle from 4.2.3 to 7.12.1
1952118 
Bumps [guzzlehttp/guzzle](https://github.com/guzzle/guzzle) from 4.2.3 to 7.12.1.
- [Release notes](https://github.com/guzzle/guzzle/releases)
- [Changelog](https://github.com/guzzle/guzzle/blob/7.12/CHANGELOG.md)
- [Commits](guzzle/guzzle@4.2.3...7.12.1)

---
updated-dependencies:
- dependency-name: guzzlehttp/guzzle
  dependency-version: 7.12.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update php code labels Jun 22, 2026
@private-packagist

private-packagist Bot commented Jun 22, 2026

Copy link
Copy Markdown

composer.lock

Package changes

Package Operation From To About
guzzlehttp/promises add - 2.5.0 view code - License: MIT License
guzzlehttp/psr7 add - 2.12.1 view code - License: MIT License
psr/http-client add - 1.0.3 view code - License: MIT License
psr/http-factory add - 1.1.0 view code - License: MIT License
psr/http-message add - 2.0 view code - License: MIT License
ralouphie/getallheaders add - 3.0.3 view code - License: MIT License
symfony/deprecation-contracts add - v3.7.0 view code - License: MIT License
symfony/polyfill-php80 add - v1.37.0 view code - License: MIT License
guzzlehttp/guzzle upgrade 4.2.3 ⚠️ 7.12.1 ✅ diff
guzzlehttp/streams remove 2.1.0 - -

Settings · Docs · Powered by Private Packagist

@joostfaassen

joostfaassen commented Jul 17, 2026

Copy link
Copy Markdown
Member

🤖 Dependabot PR processing skill — risk assessment

Acting on behalf of Joost Faassen.

Decision

Do not merge automatically — assessed risk: high

What changed
Title Bump guzzlehttp/guzzle from 4.2.3 to 7.12.1
Semver major (4.2.3 → 7.12.1)
Files (2) composer.json, composer.lock
Diff size +618 / −45

Why this was not merged automatically

  1. This looks like a major semver jump (4.2.3 → 7.12.1).
  2. Major dependency upgrades can introduce breaking API or runtime changes.
  3. Left open for human review.

Checks considered

  • Pull request is mergeable with a clean merge state
  • No failing / timed-out / cancelled required checks observed
  • Diff inspected for manifests/lockfiles only vs unexpected paths
  • Package/path screened against sensitive dependency patterns

Automated assessment by the Dependabot PR processing skill. Detail stays in this comment; the merge commit message is kept short on purpose.

4 similar comments
@joostfaassen

joostfaassen commented Jul 17, 2026

Copy link
Copy Markdown
Member

🤖 Dependabot PR processing skill — risk assessment

Acting on behalf of Joost Faassen.

Decision

Do not merge automatically — assessed risk: high

What changed
Title Bump guzzlehttp/guzzle from 4.2.3 to 7.12.1
Semver major (4.2.3 → 7.12.1)
Files (2) composer.json, composer.lock
Diff size +618 / −45

Why this was not merged automatically

  1. This looks like a major semver jump (4.2.3 → 7.12.1).
  2. Major dependency upgrades can introduce breaking API or runtime changes.
  3. Left open for human review.

Checks considered

  • Pull request is mergeable with a clean merge state
  • No failing / timed-out / cancelled required checks observed
  • Diff inspected for manifests/lockfiles only vs unexpected paths
  • Package/path screened against sensitive dependency patterns

Automated assessment by the Dependabot PR processing skill. Detail stays in this comment; the merge commit message is kept short on purpose.

@joostfaassen

joostfaassen commented Jul 17, 2026

Copy link
Copy Markdown
Member

🤖 Dependabot PR processing skill — risk assessment

Acting on behalf of Joost Faassen.

Decision

Do not merge automatically — assessed risk: high

What changed
Title Bump guzzlehttp/guzzle from 4.2.3 to 7.12.1
Semver major (4.2.3 → 7.12.1)
Files (2) composer.json, composer.lock
Diff size +618 / −45

Why this was not merged automatically

  1. This looks like a major semver jump (4.2.3 → 7.12.1).
  2. Major dependency upgrades can introduce breaking API or runtime changes.
  3. Left open for human review.

Checks considered

  • Pull request is mergeable with a clean merge state
  • No failing / timed-out / cancelled required checks observed
  • Diff inspected for manifests/lockfiles only vs unexpected paths
  • Package/path screened against sensitive dependency patterns

Automated assessment by the Dependabot PR processing skill. Detail stays in this comment; the merge commit message is kept short on purpose.

@joostfaassen

joostfaassen commented Jul 17, 2026

Copy link
Copy Markdown
Member

🤖 Dependabot PR processing skill — risk assessment

Acting on behalf of Joost Faassen.

Decision

Do not merge automatically — assessed risk: high

What changed
Title Bump guzzlehttp/guzzle from 4.2.3 to 7.12.1
Semver major (4.2.3 → 7.12.1)
Files (2) composer.json, composer.lock
Diff size +618 / −45

Why this was not merged automatically

  1. This looks like a major semver jump (4.2.3 → 7.12.1).
  2. Major dependency upgrades can introduce breaking API or runtime changes.
  3. Left open for human review.

Checks considered

  • Pull request is mergeable with a clean merge state
  • No failing / timed-out / cancelled required checks observed
  • Diff inspected for manifests/lockfiles only vs unexpected paths
  • Package/path screened against sensitive dependency patterns

Automated assessment by the Dependabot PR processing skill. Detail stays in this comment; the merge commit message is kept short on purpose.

@joostfaassen

joostfaassen commented Jul 17, 2026

Copy link
Copy Markdown
Member

🤖 Dependabot PR processing skill — risk assessment

Acting on behalf of Joost Faassen.

Decision

Do not merge automatically — assessed risk: high

What changed
Title Bump guzzlehttp/guzzle from 4.2.3 to 7.12.1
Semver major (4.2.3 → 7.12.1)
Files (2) composer.json, composer.lock
Diff size +618 / −45

Why this was not merged automatically

  1. This looks like a major semver jump (4.2.3 → 7.12.1).
  2. Major dependency upgrades can introduce breaking API or runtime changes.
  3. Left open for human review.

Checks considered

  • Pull request is mergeable with a clean merge state
  • No failing / timed-out / cancelled required checks observed
  • Diff inspected for manifests/lockfiles only vs unexpected paths
  • Package/path screened against sensitive dependency patterns

Automated assessment by the Dependabot PR processing skill. Detail stays in this comment; the merge commit message is kept short on purpose.

@dependabot @github

dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Author

Superseded by #2.

@dependabot dependabot Bot closed this Jul 20, 2026
@dependabot
dependabot Bot deleted the dependabot/composer/guzzlehttp/guzzle-7.12.1 branch July 20, 2026 22:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file php Pull requests that update php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@joostfaassen