Skip to content

build(deps): bump the composer group across 1 directory with 4 updates - #109

Merged
mschlachter merged 1 commit into
masterfrom
dependabot/composer/composer-763e6974e0
Jun 19, 2026
Merged

build(deps): bump the composer group across 1 directory with 4 updates#109
mschlachter merged 1 commit into
masterfrom
dependabot/composer/composer-763e6974e0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 19, 2026

Copy link
Copy Markdown
Contributor

Bumps the composer group with 2 updates in the / directory: guzzlehttp/guzzle and laravel/framework.

Updates guzzlehttp/guzzle from 7.10.0 to 7.12.1

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.12.1

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.12.1

Fixed

  • Reject proxy URLs with a malformed scheme in the cURL handlers instead of letting libcurl mishandle them

Security

7.12.0

Added

  • Added RequestOptions constants for curl, retries, and stream_context

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.12
  • Constrain cURL transport sharing to safe libcurl DNS and SSL session support
  • Resolve proxy environment variables in the cURL handlers; libcurl no longer reads the environment itself
  • Ignore proxy environment variables when the proxy request option makes a decision
  • Disable proxy environment variables on Windows SAPIs other than CLI (httpoxy hardening)
  • Redact proxy credentials from cURL handler error messages, following Psr7\Utils::redactUserInfo()
  • Normalize no-proxy domain and IP literal matching across the cURL and stream handlers

Deprecated

  • Deprecated the request-level handler option, which will be ignored in 8.0
  • Deprecated raw cURL request options outside the built-in cURL handlers' allow-list
  • Deprecated the CURLOPT_PROXYTYPE cURL request option; set the proxy type via a scheme-prefixed proxy URL
  • Deprecated PHP stream context options outside the built-in stream handler allow-list
  • Deprecated passing ntlm as a built-in auth type
  • Deprecated Utils::describeType()
  • Deprecated non-finite floats in the query and form_params options; 8.0 rejects them
  • Deprecated non-string scalar values in the body option; 8.0 rejects them

Fixed

  • Fix cURL TLS and HTTP/2 capability detection using libcurl feature checks
  • Fix proxy no list matches being re-proxied through environment-configured proxies by libcurl
  • Fix no list and NO_PROXY matching to support IP CIDR ranges, matching libcurl
  • Fix the stream handler not applying scheme-less proxies and their credentials

7.11.2

Fixed

... (truncated)

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.12.1 - 2026-06-18

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.12.1

Fixed

  • Reject proxy URLs with a malformed scheme in the cURL handlers instead of letting libcurl mishandle them

Security

7.12.0 - 2026-06-16

Added

  • Added RequestOptions constants for curl, retries, and stream_context

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.12
  • Constrain cURL transport sharing to safe libcurl DNS and SSL session support
  • Resolve proxy environment variables in the cURL handlers; libcurl no longer reads the environment itself
  • Ignore proxy environment variables when the proxy request option makes a decision
  • Disable proxy environment variables on Windows SAPIs other than CLI (httpoxy hardening)
  • Redact proxy credentials from cURL handler error messages, following Psr7\Utils::redactUserInfo()
  • Normalize no-proxy domain and IP literal matching across the cURL and stream handlers

Deprecated

  • Deprecated the request-level handler option, which will be ignored in 8.0
  • Deprecated raw cURL request options outside the built-in cURL handlers' allow-list
  • Deprecated the CURLOPT_PROXYTYPE cURL request option; set the proxy type via a scheme-prefixed proxy URL
  • Deprecated PHP stream context options outside the built-in stream handler allow-list
  • Deprecated passing ntlm as a built-in auth type
  • Deprecated Utils::describeType()
  • Deprecated non-finite floats in the query and form_params options; 8.0 rejects them
  • Deprecated non-string scalar values in the body option; 8.0 rejects them

Fixed

  • Fix cURL TLS and HTTP/2 capability detection using libcurl feature checks
  • Fix proxy no list matches being re-proxied through environment-configured proxies by libcurl
  • Fix no list and NO_PROXY matching to support IP CIDR ranges, matching libcurl
  • Fix the stream handler not applying scheme-less proxies and their credentials

... (truncated)

Commits
  • d346274 Release 7.12.1
  • 7f537cd Reject dot-only cookie domains (#3653)
  • 29482f2 Adjust version constraints (#3651)
  • fc70174 Reject proxy URLs with a malformed scheme in the cURL handlers (#3637)
  • 0f4da82 Reject HTTPS proxies when libcurl lacks HTTPS-proxy support (#3626)
  • eaa8159 Release 7.12.0
  • e0d3349 Adjusted guzzlehttp/psr7 version constraint and corrected links (#3646)
  • 8ca9415 Normalize scalar body request options (#3644)
  • 1a8d3aa Translate scheme-less proxies and their credentials in the stream handler (#3...
  • 751f7a5 Revert too aggressive authenticated proxy tunnel reuse mitigation (#3641)
  • Additional commits viewable in compare view

Updates laravel/framework from 12.39.0 to 12.61.1

Release notes

Sourced from laravel/framework's releases.

v12.61.1

v12.61.0

v12.60.2

v12.60.1

v12.60.0

v12.59.0

v12.58.0

v12.57.0

... (truncated)

Commits
  • e8472ca Update version to v12.61.1
  • 61d5557 [12.x] Ensure config is bound before trying to log deprecation notice (#60376)
  • 12df688 [12.x] Ensure path seperators aren't encoded in LocalFilesystemAdapter (#60350)
  • 33afd1e [12.x] Fix Number::pairs() infinite loop when $by is zero or negative (#60324)
  • e854b8c Fix FIFO queue name normalization in Cloud managed queues (#60316)
  • 55d9fb8 fix(Number): return INF/NAN as-is in trim() (#60322)
  • c76283c Fix regex typo in Env::addVariableToEnvContents that prevented quoting values...
  • 6730281 Fix @​params typo in Fluent and MessageBag toPrettyJson() docblocks (#60313)
  • b8f2341 Preserve empty HTTP attach contents (#60291)
  • 3438371 Update CHANGELOG
  • Additional commits viewable in compare view

Updates guzzlehttp/psr7 from 2.11.0 to 2.12.1

Release notes

Sourced from guzzlehttp/psr7's releases.

2.12.1

Security

2.12.0

Deprecated

  • Deprecated non-finite float values in Query::build() that guzzlehttp/psr7 3.0 rejects
  • Deprecated non-finite float multipart contents that guzzlehttp/psr7 3.0 rejects
  • Deprecated non-string scalar bodies in Utils::streamFor(); cast them to a string for 3.0
  • Deprecated non-string Uri::withQueryValues() values; cast them to a string for 3.0

2.11.1

Fixed

  • Fixed non-finite float values emitting coercion warnings on PHP 8.5
Changelog

Sourced from guzzlehttp/psr7's changelog.

2.12.1 - 2026-06-18

Security

2.12.0 - 2026-06-16

Deprecated

  • Deprecated non-finite float values in Query::build() that guzzlehttp/psr7 3.0 rejects
  • Deprecated non-finite float multipart contents that guzzlehttp/psr7 3.0 rejects
  • Deprecated non-string scalar bodies in Utils::streamFor(); cast them to a string for 3.0
  • Deprecated non-string Uri::withQueryValues() values; cast them to a string for 3.0

2.11.1 - 2026-06-12

Fixed

  • Fixed non-finite float values emitting coercion warnings on PHP 8.5
Commits

Updates symfony/http-foundation from 7.3.7 to 7.4.13

Release notes

Sourced from symfony/http-foundation's releases.

v7.4.13

Changelog (symfony/http-foundation@v7.4.7...v7.4.13)

v7.4.8

Changelog (symfony/http-foundation@v7.4.7...v7.4.8)

  • no significant changes

v7.4.7

Changelog (symfony/http-foundation@v7.4.6...v7.4.7)

v7.4.6

Changelog (symfony/http-foundation@v7.4.5...v7.4.6)

v7.4.5

Changelog (symfony/http-foundation@v7.4.4...v7.4.5)

v7.4.4

Changelog (symfony/http-foundation@v7.4.3...v7.4.4)

v7.4.3

Changelog (symfony/http-foundation@v7.4.2...v7.4.3)

v7.4.1

Changelog (symfony/http-foundation@v7.4.0...v7.4.1)

v7.4.0

Changelog (symfony/http-foundation@v7.4.0-RC3...v7.4.0)

  • no significant changes

v7.4.0-RC1

... (truncated)

Changelog

Sourced from symfony/http-foundation's changelog.

CHANGELOG

8.1

  • Add BinaryFileResponse::shouldDeleteFileAfterSend()
  • Deprecate setting public properties of Request and Response objects directly; use setters or constructor arguments instead
  • Add SessionHasFlashMessage test constraint
  • Response::__construct() now accepts a ResponseHeaderBag as its third argument
  • ParameterBag::getInt() and ParameterBag::getBoolean() now throw UnexpectedValueException instead of silently returning 0/false when the value cannot be converted

8.0

  • Drop HTTP method override support for methods GET, HEAD, CONNECT and TRACE
  • Add argument $subtypeFallback to Request::getFormat()
  • Remove the following deprecated session options from NativeSessionStorage: referer_check, use_only_cookies, use_trans_sid, sid_length, sid_bits_per_character, trans_sid_hosts, trans_sid_tags
  • Trigger PHP warning when using Request::sendHeaders() after headers have already been sent; use a StreamedResponse instead
  • Add arguments $v4Bytes and $v6Bytes to IpUtils::anonymize()
  • Add argument $partitioned to ResponseHeaderBag::clearCookie()
  • Add argument $expiration to UriSigner::sign()
  • Remove Request::get(), use properties ->attributes, query or request directly instead
  • Remove accepting null $format argument to Request::setFormat()

7.4

  • Add #[WithHttpStatus] to define status codes: 404 for SignedUriException and 403 for ExpiredSignedUriException
  • Add support for the QUERY HTTP method
  • Add support for structured MIME suffix
  • Add Request::set/getAllowedHttpMethodOverride() to list which HTTP methods can be overridden
  • Deprecate using Request::sendHeaders() after headers have already been sent; use a StreamedResponse instead
  • Deprecate method Request::get(), use properties ->attributes, query or request directly instead
  • Make Request::createFromGlobals() parse the body of PUT, DELETE, PATCH and QUERY requests
  • Deprecate HTTP method override for methods GET, HEAD, CONNECT and TRACE; it will be ignored in Symfony 8.0
  • Deprecate accepting null $format argument to Request::setFormat()

7.3

  • Add support for iterable of string in StreamedResponse
  • Add EventStreamResponse and ServerEvent classes to streamline server event streaming
  • Add support for valkey: / valkeys: schemes for sessions
  • Request::getPreferredLanguage() now favors a more preferred language above exactly matching a locale
  • Allow UriSigner to use a ClockInterface
  • Add UriSigner::verify()

7.2

... (truncated)

Commits
  • bc354f4 Merge branch '6.4' into 7.4
  • 48d76c2 security #cve-2026-48736 [HttpFoundation] Block IPv6 transition forms in IpUt...
  • fda5ebe Merge branch '6.4' into 7.4
  • 5979ae8 Ignore Doctrine DBAL deprecations that can't be worked around
  • 10d5daa [HttpFoundation] Fix tests for PHP 8.6: session.cookie_samesite=Lax
  • 3ebc78a [HttpFoundation] Block IPv6 transition forms in IpUtils::PRIVATE_SUBNETS
  • 051a962 Merge branch '6.4' into 7.4
  • 5402ad1 Remove wrong documentation
  • c38f205 [7.4] Remove usages of named arguments in tests
  • a762b60 Update XSD references in phpunit.xml.dist files
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump the composer group across 1 directory with 4 updates
b5e12cd 
Bumps the composer group with 2 updates in the / directory: [guzzlehttp/guzzle](https://github.com/guzzle/guzzle) and [laravel/framework](https://github.com/laravel/framework).


Updates `guzzlehttp/guzzle` from 7.10.0 to 7.12.1
- [Release notes](https://github.com/guzzle/guzzle/releases)
- [Changelog](https://github.com/guzzle/guzzle/blob/7.12/CHANGELOG.md)
- [Commits](guzzle/guzzle@7.10.0...7.12.1)

Updates `laravel/framework` from 12.39.0 to 12.61.1
- [Release notes](https://github.com/laravel/framework/releases)
- [Changelog](https://github.com/laravel/framework/blob/13.x/CHANGELOG.md)
- [Commits](laravel/framework@v12.39.0...v12.61.1)

Updates `guzzlehttp/psr7` from 2.11.0 to 2.12.1
- [Release notes](https://github.com/guzzle/psr7/releases)
- [Changelog](https://github.com/guzzle/psr7/blob/2.12/CHANGELOG.md)
- [Commits](guzzle/psr7@2.11.0...2.12.1)

Updates `symfony/http-foundation` from 7.3.7 to 7.4.13
- [Release notes](https://github.com/symfony/http-foundation/releases)
- [Changelog](https://github.com/symfony/http-foundation/blob/8.2/CHANGELOG.md)
- [Commits](symfony/http-foundation@v7.3.7...v7.4.13)

---
updated-dependencies:
- dependency-name: guzzlehttp/guzzle
  dependency-version: 7.12.1
  dependency-type: direct:production
  dependency-group: composer
- dependency-name: laravel/framework
  dependency-version: 12.61.1
  dependency-type: direct:production
  dependency-group: composer
- dependency-name: guzzlehttp/psr7
  dependency-version: 2.12.1
  dependency-type: indirect
  dependency-group: composer
- dependency-name: symfony/http-foundation
  dependency-version: 7.4.13
  dependency-type: indirect
  dependency-group: composer
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update Php code labels Jun 19, 2026
@mschlachter
mschlachter merged commit f214e75 into master Jun 19, 2026
1 check passed
@mschlachter
mschlachter deleted the dependabot/composer/composer-763e6974e0 branch June 19, 2026 22:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mschlachter mschlachter mschlachter approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file php Pull requests that update Php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mschlachter