Update guzzlehttp/guzzle requirement from ^6.2 | ^7.0 to ^6.2 | ^7.0 | ^8.0

[dependabot]

Updates the requirements on guzzlehttp/guzzle to permit the latest version.

Release notes

Sourced from guzzlehttp/guzzle's releases.

8.0.0

Added

• Add SensitiveParameter metadata to credential-bearing parameters so PHP 8.2+ redacts their values in exception traces
• Add HTTP/3 request support to the built-in cURL handlers when PHP 8.4+ and libcurl provide HTTP/3 support
• Add Multiplexing::NONE support as a client, cURL multi handler, and conditional request option
• Add generic and structured PHPDoc annotations to client request/config option, async promise, handler, middleware, pool, and mock handler APIs
• Add ConnectTimeoutException for connect-phase timeouts, extending ConnectException
• Add NetworkException for no-response network failures
• Add NetworkTimeoutException for no-response transport timeouts
• Add ResponseTransferException, with ResponseTimeoutException for response-transfer timeouts
• Add PSR-17 request_factory, response_factory, stream_factory, and uri_factory request options
• Add explicit close() lifecycle methods to the built-in cURL handlers and concrete cURL factory
• Add HandlerClosedException for pending transfers rejected by CurlMultiHandler::close()
• Add persistent transport sharing modes (TransportSharing::PERSISTENT_PREFER and TransportSharing::PERSISTENT_REQUIRE)
• Add ProxyOptions for proxy option resolution
• Add ResponseException for request failures with responses
• Add auth middleware for built-in Basic and Digest authentication

Changed

• Canonicalize IPv6 hosts in Digest challenge cache keys
• Canonicalize IPv6 hosts in cookie domains, host-only identities, and domain matching
• Restrict cookie domain suffix matching to valid non-literal, nonnumeric host names
• Reject Secure cookies and insecure overlays received over insecure connections
• Enforce the __Secure- and __Host- prefix requirements on response cookies
• Hardened FileCookieJar and SessionCookieJar persistence against unsafe unserialization
• Reject native PHP serialization of runtime objects
• Restrict persisted FileCookieJar cookie files to owner-only permissions
• Require persisted cookie data to use JSON lists and construct all records before changing the jar
• Normalize persistent cookie JSON failures as RuntimeException
• Moved the internal Utils time, timeout, IDN, and environment helpers to dedicated internal classes
• Adjusted guzzlehttp/promises version constraint to ^3.0
• Adjusted guzzlehttp/psr7 version constraint to ^3.0
• Quote multipart Content-Type boundary parameters when required
• Added parameter and return types to SetCookie methods
• Added native property types to supported public cURL handler state properties
• Added a string return type to SetCookie::__toString()
• Validate proxy and no-proxy option types strictly across handlers
• Match leading-dot no-proxy entries against the bare domain and split string no-proxy lists on whitespace
• Validate force_ip_resolve, protocols, and delay ranges at the client boundary
• Treat a matching proxy no entry as final even without a scheme-specific proxy entry
• Validate proxy URLs in the built-in handlers and reject malformed or unsupported ones up front
• Default a port-less proxy to 1080 in the stream handler, matching libcurl
• Downgrade HTTP/3 requests to HTTP/2 or HTTP/1.1 when the proxy is resolved from environment variables
• Throw RequestException, not InvalidArgumentException, for an unavailable proxy or TLS feature
• Resolve proxy environment variables in the stream handler, consistent with the cURL handlers
• Honor no_proxy/NO_PROXY from the environment in the stream handler, including * to disable proxying
• Reject an environment-resolved https:// or SOCKS proxy in the stream handler, matching its proxy option behavior
• Require cURL proxy header separation for first-class Proxy-Authorization on every route

... (truncated)

Changelog

Sourced from guzzlehttp/guzzle's changelog.

8.0.0 - 2026-07-20

Added

• Add SensitiveParameter metadata to credential-bearing parameters so PHP 8.2+ redacts their values in exception traces
• Add HTTP/3 request support to the built-in cURL handlers when PHP 8.4+ and libcurl provide HTTP/3 support
• Add Multiplexing::NONE support as a client, cURL multi handler, and conditional request option
• Add generic and structured PHPDoc annotations to client request/config option, async promise, handler, middleware, pool, and mock handler APIs
• Add ConnectTimeoutException for connect-phase timeouts, extending ConnectException
• Add NetworkException for no-response network failures
• Add NetworkTimeoutException for no-response transport timeouts
• Add ResponseTransferException, with ResponseTimeoutException for response-transfer timeouts
• Add PSR-17 request_factory, response_factory, stream_factory, and uri_factory request options
• Add explicit close() lifecycle methods to the built-in cURL handlers and concrete cURL factory
• Add HandlerClosedException for pending transfers rejected by CurlMultiHandler::close()
• Add persistent transport sharing modes (TransportSharing::PERSISTENT_PREFER and TransportSharing::PERSISTENT_REQUIRE)
• Add ProxyOptions for proxy option resolution
• Add ResponseException for request failures with responses
• Add auth middleware for built-in Basic and Digest authentication

Changed

• Canonicalize IPv6 hosts in Digest challenge cache keys
• Canonicalize IPv6 hosts in cookie domains, host-only identities, and domain matching
• Restrict cookie domain suffix matching to valid non-literal, nonnumeric host names
• Reject Secure cookies and insecure overlays received over insecure connections
• Enforce the __Secure- and __Host- prefix requirements on response cookies
• Hardened FileCookieJar and SessionCookieJar persistence against unsafe unserialization
• Reject native PHP serialization of runtime objects
• Restrict persisted FileCookieJar cookie files to owner-only permissions
• Require persisted cookie data to use JSON lists and construct all records before changing the jar
• Normalize persistent cookie JSON failures as RuntimeException
• Moved the internal Utils time, timeout, IDN, and environment helpers to dedicated internal classes
• Adjusted guzzlehttp/promises version constraint to ^3.0
• Adjusted guzzlehttp/psr7 version constraint to ^3.0
• Quote multipart Content-Type boundary parameters when required
• Added parameter and return types to SetCookie methods
• Added native property types to supported public cURL handler state properties
• Added a string return type to SetCookie::__toString()
• Validate proxy and no-proxy option types strictly across handlers
• Match leading-dot no-proxy entries against the bare domain and split string no-proxy lists on whitespace
• Validate force_ip_resolve, protocols, and delay ranges at the client boundary
• Treat a matching proxy no entry as final even without a scheme-specific proxy entry
• Validate proxy URLs in the built-in handlers and reject malformed or unsupported ones up front
• Default a port-less proxy to 1080 in the stream handler, matching libcurl
• Downgrade HTTP/3 requests to HTTP/2 or HTTP/1.1 when the proxy is resolved from environment variables
• Throw RequestException, not InvalidArgumentException, for an unavailable proxy or TLS feature
• Resolve proxy environment variables in the stream handler, consistent with the cURL handlers
• Honor no_proxy/NO_PROXY from the environment in the stream handler, including * to disable proxying
• Reject an environment-resolved https:// or SOCKS proxy in the stream handler, matching its proxy option behavior

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)