[TASK] Update guzzlehttp/psr7 to v3 - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
guzzlehttp/psr7	^1.9 || ^2.0 → ^1.9 || ^2.0 || ^3.0

---

Release Notes

guzzle/psr7 (guzzlehttp/psr7)

v3.0.0

Compare Source

Added

• Add DiagnosticValue::escape() to escape controls and malformed UTF-8 in diagnostics
• Add GuzzleHttp\Psr7\Exception\TimeoutException for timed-out stream operations
• Add GuzzleHttp\Psr7\Utils::redactUserInfoInString() to redact the userinfo of a raw URI string within text
• Promote GuzzleHttp\Psr7\Rfc3986 to public API with isValid*() predicates and canonicalizeIpv6()
• Add GuzzleHttp\Psr7\UriNormalizer::CANONICALIZE_IPV6_HOST to PRESERVING_NORMALIZATIONS

Changed

• Require psr/http-message:^2.0 and add native parameter and return types
• Require psr/http-factory:^1.1
• Reject native PHP serialization of stream implementations
• Preserve request method casing, except ServerRequest::fromGlobals() still uppercases
• Reject empty arrays and non-string values as header values
• Reject invalid uploaded file trees and invalid parsed body values
• Reject uploaded file specs missing tmp_name, size, or error
• Reject non-integer and negative uploaded file error values
• Reject invalid stream/upload sizes, buffer high-water marks, and dropping-stream limits
• Rewind seekable uploaded-file streams before copying in UploadedFile::moveTo()
• Reject negative read() lengths across all stream implementations
• Detect the + flag anywhere in a mode for Stream::isReadable()/isWritable()
• Reject empty strings returned by PumpStream source callables
• Discard buffered bytes on PumpStream close and detach
• Restore the original stream position after Message::bodySummary()
• Allow null for the Message::bodySummary() truncation length to use the default
• Validate LimitStream offset/limit and track non-seekable offset by bytes skipped
• Make FnStream close and detach terminal, calling close callbacks at most once
• Suppress exceptions from FnStream close callbacks during destructor cleanup
• Make CachingStream::close() idempotent, preserving remote cleanup after detach
• Do not move the CachingStream cursor when a SEEK_END target on an unknown-size stream is rejected
• Normalize multiple leading slashes in Uri::getPath() and origin-form request targets
• Serialize authority-less file URIs with rootless paths without the // separator
• Serialize authority-less file URIs with empty paths as file: instead of the unparseable file://
• Remove dot segments above the root per RFC 3986, prefixing authority-less // paths with /.
• Return a network-path reference from UriResolver::relativize() when an empty-path target requires one
• Stop returning an empty reference from UriResolver::relativize() when it would inherit the base fragment
• Stop throwing from UriResolver::relativize() when an equal-path target's last path segment contains a colon
• Harden URI host validation (delimiters, backslashes, IPv6, embedded ports); require schemes to start with a letter
• Validate Uri::fromParts() ports instead of casting them
• Treat ports 80 and 443 as defaults for the ws and wss schemes
• Use the ws and wss default ports in UriComparator::isCrossOrigin() port comparisons
• Redact all non-empty URI userinfo in Utils::redactUserInfo()
• Rebuild server request URIs from $_SERVER by REQUEST_METHOD, using target authority before SERVER_PORT
• Remove userinfo from absolute-form REQUEST_URI targets in ServerRequest::fromGlobals()
• Reject zero-port HTTP_HOST and malformed SERVER_PORT in ServerRequest::getUriFromGlobals()
• Reject malformed REQUEST_METHOD and SERVER_PROTOCOL server values in ServerRequest::fromGlobals()
• Reject zero-port Host and normalize leading-zero ports in Message::parseRequest()
• Reject duplicate Host headers and validate present values for all request-target forms
• Reject zero-port, hostless, and userinfo absolute-form request targets in Message::parseRequest()
• Synchronize the Host header in Request::withUri() when the URI changes or Host is empty
• Include the URI port in Host headers synthesized by Message::toString()
• Validate the Host header synthesized by Message::toString() from the request URI
• Include non-default URI ports in Host headers set by Utils::modifyRequest() URI changes
• Accept OPTIONS * and CONNECT authority-form request targets in Message::parseRequest()
• Hide credential-bearing URI, server, and cookie arguments in stack traces on PHP 8.2+
• Reject malformed HTTP request/response start-lines
• Unfold obsolete HTTP/1.0 line folding for all valid request method tokens
• Reject empty and control-character request targets in Request::withRequestTarget()
• Validate iterator chunks passed to Utils::streamFor()
• Validate unsupported values passed to Query::build()
• Reject non-finite float values in Query::build() and MultipartStream contents
• Reject non-finite float values in iterator chunks passed to Utils::streamFor()
• Utils::streamFor() now rejects non-string scalar bodies
• Uri::withQueryValues() now rejects non-string values
• Reject invalid Utils::modifyRequest() change values
• Use PHP debug type names in type error messages
• Changed Utils::copyToStream() to throw when destination streams cannot make progress
• Throw TimeoutException from Stream read/write and Utils copy/hash/readLine on stream timeouts
• Throw TimeoutException from AppendStream::read(), CachingStream::read(), and Utils::tryGetContents() on stream timeouts
• Re-throw TimeoutException from InflateStream when the decoded source stream times out
• Close the compressed source stream from InflateStream::close()
• Return the number of bytes copied from Utils::copyToStream()
• Throw OverflowException when stream byte counts or offsets exceed PHP_INT_MAX
• Translate StreamWrapper runtime failures to PHP stream failure values
• Stop adding default Content-Length to multipart/form-data parts (RFC 7578 §4.8)
• Escape multipart Content-Disposition parameters and reject unsafe boundaries and part headers
• Preserve trailing whitespace in custom MultipartStream part header values
• Preserve explicit custom MultipartStream boundary '0' instead of replacing it with a generated boundary
• Made static utility classes non-instantiable
• Validate bracketed IP-literal hosts consistently between parsing and withHost(), including userinfo forms
• Percent-encode raw control bytes in userinfo before bracketed IP-literal hosts instead of parsing mutated values
• Reject invalid UTF-8 and preserve percent-sequences in userinfo before bracketed IP-literal hosts
• Normalize percent-encoded octets in the URI host to uppercase hex
• Canonicalize IPv6 hosts to RFC 5952 form in Uri construction, fromParts(), and withHost()
• Canonicalize bracketed IPv6 hosts in UriComparator::isCrossOrigin()
• Reject malformed percent-sequences and percent-encoded bytes forbidden by the URI host policy
• Extend CAPITALIZE_PERCENT_ENCODING and DECODE_UNRESERVED_CHARACTERS to userinfo and host
• Trim header list elements with only spaces, horizontal tabs, and line terminators in Header::splitList()
• Report header parameter PCRE failures explicitly in Header::parse()
• Escape controls and malformed UTF-8 consistently in generated exception messages

Removed

• Dropped support for PHP 7.2 and 7.3
• Removed the ralouphie/getallheaders dependency
• Removed deprecated Header::normalize() method

v2.13.0

Compare Source

Added

• Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

• Use locale-independent ASCII case folding everywhere case is normalized
• Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

v2.12.5

Compare Source

Fixed

• Compare header names and hosts with locale-independent ASCII lowercasing
• Compare hosts without locale sensitivity when detecting cross-origin redirects

v2.12.4

Compare Source

Changed

• Pass explicit trim characters ahead of the PHP 8.6 trim default change

Fixed

• Anchor server port and response start-line patterns to the true end of input
• Treat host-less origin-form request targets starting with // as paths in Message::parseRequest()
• Reject raw DEL bytes in bracketed IP-literal hosts instead of parsing a mutated host
• Reject invalid bytes after a bracketed IP-literal host instead of reparsing a different host

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Monday through Friday (* * * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock

Command failed: composer update guzzlehttp/psr7:3.0.0 --with-dependencies --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins --minimal-changes
Loading composer repositories with package information
Dependency psr/http-message is also a root requirement. Package has not been listed as an update argument, so keeping locked at old version. Use --with-all-dependencies (-W) to include root dependencies.
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires guzzlehttp/psr7 ^1.9 || ^2.0 || ^3.0, found guzzlehttp/psr7[1.9.0, 1.9.1, 2.0.0, ..., 2.13.0, 3.0.0] but these were not loaded, likely because it conflicts with another require.
  Problem 2
    - guzzlehttp/guzzle is locked to version 7.15.2 and an update of this package was not requested.
    - guzzlehttp/guzzle 7.15.2 requires guzzlehttp/psr7 ^2.13 -> found guzzlehttp/psr7[2.13.0] but it conflicts with your temporary update constraint (guzzlehttp/psr7:3.0.0).

Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions.

[coveralls]

Coverage Report for CI Build 30333636381

Coverage remained the same at 97.619%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	168
Covered Lines:	164
Line Coverage:	97.62%
Coverage Strength:	2.35 hits per line

---

💛 - Coveralls