8000 chore(deps): bump the composer group across 1 directory with 4 updates by dependabot[bot] · Pull Request #592 · affinidi/affinidi-tdk-php · GitHub
[go: up one dir, main page]
Skip to content

chore(deps): bump the composer group across 1 directory with 4 updates - #592

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/composer-7121d39bd4
Open

chore(deps): bump the composer group across 1 directory with 4 updates#592
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/composer-7121d39bd4

Conversation

@dependabot
@dependabot dependabot Bot commented on behalf of github Oct 23, 2026
Copy link
Copy Markdown

Bumps the composer group with 4 updates in the / directory: guzzlehttp/guzzle, guzzlehttp/psr7, firebase/php-jwt and phpunit/phpunit.

Updates guzzlehttp/guzzle from 7.9.2 to 7.15.2

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.15.2

Security

Fixed

  • Preserve RequestException when the stream handler rejects a request before opening a stream

7.15.1

Security

7.15.0

Added

  • Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.13
  • Use locale-independent ASCII folding for all case normalization and comparison
  • Bound cURL upload reads to the declared Content-Length
  • Sanitize the cURL error text exposed through exception handler context
  • Fail closed when a named cURL multi connection cap cannot be applied
  • Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured
  • Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles
  • Isolate HTTP proxy tunnels from opaque shared connection caches
  • Trigger runtime deprecations for previously deprecated functionality in 7.1.0

Deprecated

  • Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
  • Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array
  • Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support

Fixed

  • Defer cURL requests created from multi callbacks until native execution unwinds
  • Fail synchronous waits from native cURL callbacks promptly instead of self-deadlocking
  • Guard cURL multi handle removal against progress callbacks re-entering the handler
  • Scope promise waits on the cURL multi handler to the awaited transfer
  • Strip Content-Length and Transfer-Encoding when redirects discard the request body

... (truncated)

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.15.2 - 2026-07-26

Security

Fixed

  • Preserve RequestException when the stream handler rejects a request before opening a stream

7.15.1 - 2026-07-18

Security

7.15.0 - 2026-07-17

Added

  • Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.13
  • Use locale-independent ASCII folding for all case normalization and comparison
  • Bound cURL upload reads to the declared Content-Length
  • Sanitize the cURL error text exposed through exception handler context
  • Fail closed when a named cURL multi connection cap cannot be applied
  • Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured
  • Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles
  • Isolate HTTP proxy tunnels from opaque shared connection caches
  • Trigger runtime deprecations for previously deprecated functionality in 7.1.0

Deprecated

  • Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
  • Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array
  • Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support

Fixed

... (truncated)

Commits

Updates guzzlehttp/psr7 from 2.7.0 to 2.13.2

Release notes

Sourced from guzzlehttp/psr7's releases.

2.13.2

  • Fix StreamWrapper flushes reporting failure
  • Fix CachingStream skipping unread bytes after repeated writes

2.13.1

Added

  • Add support for PHP 8.6

Fixed

  • Prefix relative paths that begin with a colon segment with ./ instead of throwing

2.13.0

Added

  • Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

  • Use locale-independent ASCII case folding everywhere case is normalized
  • Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

2.12.5

Fixed

  • Compare header names and hosts with locale-independent ASCII lowercasing
  • Compare hosts without locale sensitivity when detecting cross-origin redirects

2.12.4

Changed

  • Pass explicit trim characters ahead of the PHP 8.6 trim default change

2.12.3

Security

2.12.2

Fixed

  • Report URI parsing, filtering, and normalization PCRE failures explicitly
  • Report HTTP message parser PCRE failures explicitly
  • Fail closed when PCRE validation fails for request targets and hosts

2.12.1

Security

... (truncated)

Changelog

Sourced from guzzlehttp/psr7's changelog.

2.13.2 - 2026-10-18

Fixed

  • Fix StreamWrapper flushes reporting failure
  • Fix CachingStream skipping unread bytes after repeated writes

2.13.1 - 2026-08-24

Added

  • Add support for PHP 8.6

Fixed

  • Prefix relative paths that begin with a colon segment with ./ instead of throwing

2.13.0 - 2026-07-16

Added

  • Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

  • Use locale-independent ASCII case folding everywhere case is normalized
  • Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

2.12.5 - 2026-07-13

Fixed

  • Compare header names and hosts with locale-independent ASCII lowercasing
  • Compare hosts without locale sensitivity when detecting cross-origin redirects

2.12.4 - 2026-07-08

Changed

  • Pass explicit trim characters ahead of the PHP 8.6 trim default change

Fixed

  • Anchor server port and response start-line patterns to the true end of input
  • Treat host-less origin-form request targets starting with // as paths in Message::parseRequest()
  • Reject raw DEL bytes in bracketed IP-literal hosts instead of parsing a mutated host
  • Reject invalid bytes after a bracketed IP-literal host instead of reparsing a different host

2.12.3 - 2026-06-23

... (truncated)

Commits
  • adee536 Release 2.13.2
  • 4dbc3d2 Fix CachingStream skipping unread bytes after repeated writes (#893)
  • 8ace0da Report successful flushes from the stream wrapper (#891)
  • 95e7828 Release 2.13.1
  • a583cbe Add PHP 8.6 to the CI matrix and version guidance (#883)
  • 93b91b0 Prefix relative paths that begin with a colon segment instead of throwing (#878)
  • 5b1264e Test that noncanonical IPv4 host spellings pass through unchanged (#874)
  • dad8962 Release 2.13.0
  • 1bc4f53 Trigger a runtime deprecation for Header::normalize() (#866)
  • a1372ea Add tests locking in no-file upload handling (#856)
  • Additional commits viewable in compare view

Updates firebase/php-jwt from 6.10.2 to 7.0.0

Release notes

Sourced from firebase/php-jwt's releases.

v7.0.0

7.0.0 (2025-12-15)

⚠️ ⚠️ ⚠️ Security Fixes ⚠️ ⚠️ ⚠️

  • add key size validation (#613) (6b80341) NOTE: This fix will cause keys with a size below the minimally allowed size to break.

Features

  • add SensitiveParameter attribute to security-critical parameters (#603) (4dbfac0)
  • store timestamp in ExpiredException (#604) (f174826)

Bug Fixes

v6.11.1

6.11.1 (2025-04-09)

Bug Fixes

v6.11.0

6.11.0 (2025-01-23)

Features

Bug Fixes

  • refactor constructor Key to use PHP 8.0 syntax (#577) (29fa2ce)
Changelog

Sourced from firebase/php-jwt's changelog.

7.0.0 (2025-12-15)

⚠️ ⚠️ ⚠️ Security Fixes ⚠️ ⚠️ ⚠️

  • add key size validation (#613) (6b80341) NOTE: This fix will cause keys with a size below the minimally allowed size to break.

Features

  • add SensitiveParameter attribute to security-critical parameters (#603) (4dbfac0)
  • store timestamp in ExpiredException (#604) (f174826)

Bug Fixes

6.11.1 (2025-04-09)

Bug Fixes

6.11.0 (2025-01-23)

Features

Bug Fixes

  • refactor constructor Key to use PHP 8.0 syntax (#577) (29fa2ce)
Commits
  • c03036f chore(main): release 7.0.0 (#614)
  • 6b80341 feat: add key size validation (#613)
  • a3edb39 chore: update release-please secret (#608)
  • f174826 feat: store timestamp in ExpiredException (#604)
  • 4dbfac0 feat: add SensitiveParameter attribute to security-critical parameters (#603)
  • 223d1b3 chore: move release please from app to github action (#606)
  • 953b2c8 fix: validate iat and nbf on payload (#568)
  • 43d70ae fix: use DateTime::ATOM instead of ISO8601 in exception message
  • d1e91ec chore(main): release 6.11.1 (#597)
  • c11113a fix: update error text for consistency (#528)
  • Additional commits viewable in compare view

Updates phpunit/phpunit from 9.6.22 to 9.6.33

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 9.6.33

Changed

  • To prevent Poisoned Pipeline Execution (PPE) attacks using prepared .coverage files in pull requests, a PHPT test will no longer be run if the temporary file for writing code coverage information already exists before the test runs

Learn how to install or update PHPUnit 9.6 in the documentation.

Keep up to date with PHPUnit:

Changelog

Sourced from phpunit/phpunit's changelog.

[9.6.33] - 2026-01-27

Changed

  • To prevent Poisoned Pipeline Execution (PPE) attacks using prepared .coverage files in pull requests, a PHPT test will no longer be run if the temporary file for writing code coverage information already exists before the test runs

[9.6.32] - 2026-01-24

Changed

  • PHPUnit\Framework\MockObject exceptions are now subtypes of PHPUnit\Exception

[9.6.31] - 2025-12-06

  • No changes; phpunit.phar rebuilt with PHP 8.4 to work around PHP-Scoper issue #1139

[9.6.30] - 2025-12-01

Changed

  • Updated list of deprecated PHP configuration settings for PHP 8.4, PHP 8.5, and PHP 8.6

[9.6.29] - 2025-09-24

  • No changes; phpunit.phar rebuilt with updated dependencies

[9.6.28] - 2025-09-23

  • No changes; phpunit.phar rebuilt with updated dependencies

[9.6.27] - 2025-09-14

Changed

  • #6366: Exclude __sleep() and __wakeup() from test double code generation on PHP >= 8.5

[9.6.26] - 2025-09-11

Changed

  • Implement __serialize() in addition to __sleep() (which will be deprecated in PHP 8.5)

[9.6.25] - 2025-08-20

Changed

  • Do not configure report_memleaks setting (which will be deprecated in PHP 8.5) for PHPT processes

[9.6.24] - 2025-08-10

... (truncated)

Commits
  • fea0625 Prepare release
  • 1a677f6 Merge branch '8.5' into 9.6
  • 1015741 Prepare release
  • 1cce5f3 Merge branch '8.5' into 9.6
  • 3141742 Do not run PHPT test when its temporary file for code coverage information ex...
  • 0b3170a We do not need to unserialize() objects here
  • 261086a Extract method
  • fdd6b86 Fix CS/WS issue
  • 492ee10 Prepare release
  • 81edce2 Merge branch '8.5' into 9.6
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the composer group across 1 directory with 4 updates
78442e5 
Bumps the composer group with 4 updates in the / directory: [guzzlehttp/guzzle](https://github.com/guzzle/guzzle), [guzzlehttp/psr7](https://github.com/guzzle/psr7), [firebase/php-jwt](https://github.com/firebase/php-jwt) and [phpunit/phpunit](https://github.com/sebastianbergmann/phpunit).


Updates `guzzlehttp/guzzle` from 7.9.2 to 7.15.2
- [Release notes](https://github.com/guzzle/guzzle/releases)
- [Changelog](https://github.com/guzzle/guzzle/blob/7.15.2/CHANGELOG.md)
- [Commits](guzzle/guzzle@7.9.2...7.15.2)

Updates `guzzlehttp/psr7` from 2.7.0 to 2.13.2
- [Release notes](https://github.com/guzzle/psr7/releases)
- [Changelog](https://github.com/guzzle/psr7/blob/2.13.2/CHANGELOG.md)
- [Commits](guzzle/psr7@2.7.0...2.13.2)

Updates `firebase/php-jwt` from 6.10.2 to 7.0.0
- [Release notes](https://github.com/firebase/php-jwt/releases)
- [Changelog](https://github.com/googleapis/php-jwt/blob/main/CHANGELOG.md)
- [Commits](googleapis/php-jwt@v6.10.2...v7.0.0)

Updates `phpunit/phpunit` from 9.6.22 to 9.6.33
- [Release notes](https://github.com/sebastianbergmann/phpunit/releases)
- [Changelog](https://github.com/sebastianbergmann/phpunit/blob/9.6.33/ChangeLog-9.6.md)
- [Commits](sebastianbergmann/phpunit@9.6.22...9.6.33)

---
updated-dependencies:
- dependency-name: guzzlehttp/guzzle
  dependency-version: 7.15.2
  dependency-type: direct:production
  dependency-group: composer
- dependency-name: guzzlehttp/psr7
  dependency-version: 2.13.2
  dependency-type: direct:production
  dependency-group: composer
- dependency-name: firebase/php-jwt
  dependency-version: 7.0.0
  dependency-type: direct:production
  dependency-group: composer
- dependency-name: phpunit/phpunit
  dependency-version: 9.6.33
  dependency-type: direct:development
  dependency-group: composer
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update php code labels Oct 23, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rbrazhnyk rbrazhnyk Awaiting requested review from rbrazhnyk rbrazhnyk is a code owner
@marat-affinidi marat-affinidi Awaiting requested review from marat-affinidi marat-affinidi is a code owner
@carlos-affinidi carlos-affinidi Awaiting requested review from carlos-affinidi carlos-affinidi is a code owner
@maindotdev maindotdev Awaiting requested review from maindotdev maindotdev is a code owner

At least 2 approving reviews are required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file php Pull requests that update php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

0