[dependabot]

Bumps guzzlehttp/guzzle from 7.16.0 to 8.3.1.

Release notes

Sourced from guzzlehttp/guzzle's releases.

8.3.1

Fixed

• Fix CookieJar storing already expired cookies instead of removing the stored cookie
• Fix CookieJar ignoring a same-value cookie that changes its expiry or its Discard, Secure, or HttpOnly flag
• Fix SetCookie renewing the lifetime of Max-Age cookies rebuilt from an array, so persisted cookies never expired

8.3.0

Changed

• Adjusted guzzlehttp/promises version constraint to ^3.1
• Adjusted guzzlehttp/psr7 version constraint to ^3.2
• Replace the deprecated Promise\Is with Promise\State for PHP 8.6
• Decode chunked stream handler bodies as they arrive, ending at the last chunk
• Reject truncated and malformed chunked stream handler bodies, like libcurl
• Reject unsupported response transfer codings, like libcurl 8.14+
• End stream handler bodies at their declared Content-Length, including 0
• Throw when a streamed body ends before its declared Content-Length
• Classify cURL errors 8 and 23 with a response as ResponseTransferException
• Reject stream handler gzip and deflate bodies with trailing data, like libcurl
• Accept raw deflate stream handler bodies, like libcurl

Fixed

• Fix streamed stream handler bodies delaying bytes that arrived with the headers

8.2.1

Fixed

• Fix PHP 8.6 notices for oversized numeric hosts
• Fix delay values over 71 minutes
• Fix CurlMultiHandler delays over 71 minutes
• Fix overlapping stream handler requests sharing a deadline
• Fix stream handler responses in Swoole coroutines on PHP 8.4+
• Fix reads of streamed gzip and deflate responses waiting for 8 KiB of decoded data
• Fix stream handler accepting corrupt gzip and deflate response bodies

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^3.1.1

8.2.0

Changed

• Allow connection caps to be combined with persistent transport sharing on libcurl 8.22.0+

8.1.0

Added

• Add PHP 8.6+ stream TLS session sharing, while persistent sharing remains cURL-only

... (truncated)

Changelog

Sourced from guzzlehttp/guzzle's changelog.

8.3.1 - 2026-10-25

Fixed

• Fix CookieJar storing already expired cookies instead of removing the stored cookie
• Fix CookieJar ignoring a same-value cookie that changes its expiry or its Discard, Secure, or HttpOnly flag
• Fix SetCookie renewing the lifetime of Max-Age cookies rebuilt from an array, so persisted cookies never expired

8.3.0 - 2026-10-18

Changed

• Adjusted guzzlehttp/promises version constraint to ^3.1
• Adjusted guzzlehttp/psr7 version constraint to ^3.2
• Replace the deprecated Promise\Is with Promise\State for PHP 8.6
• Decode chunked stream handler bodies as they arrive, ending at the last chunk
• Reject truncated and malformed chunked stream handler bodies, like libcurl
• Reject unsupported response transfer codings, like libcurl 8.14+
• End stream handler bodies at their declared Content-Length, including 0
• Throw when a streamed body ends before its declared Content-Length
• Classify cURL errors 8 and 23 with a response as ResponseTransferException
• Reject stream handler gzip and deflate bodies with trailing data, like libcurl
• Accept raw deflate stream handler bodies, like libcurl

Fixed

• Fix streamed stream handler bodies delaying bytes that arrived with the headers

8.2.1 - 2026-10-18

Fixed

• Fix PHP 8.6 notices for oversized numeric hosts
• Fix delay values over 71 minutes
• Fix CurlMultiHandler delays over 71 minutes
• Fix overlapping stream handler requests sharing a deadline
• Fix stream handler responses in Swoole coroutines on PHP 8.4+
• Fix reads of streamed gzip and deflate responses waiting for 8 KiB of decoded data
• Fix stream handler accepting corrupt gzip and deflate response bodies

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^3.1.1

8.2.0 - 2026-09-06

Changed

... (truncated)

Commits

• 7d9b1f4 Release 8.3.1
• 2567cb4 Time only the attach in the ticking delayed request test (#3994)
• 89f4293 Keep the stored expiry when rebuilding Max-Age cookies (#3991)
• 3236dc4 Replace same-value cookies whose expiry or flags change (#3990)
• 0b3016c Drop expired cookies instead of storing them (#3987)
• b920e5f Release 8.3.0
• 1e0396c Decode stream handler gzip and deflate bodies like libcurl (#3972)
• e3ec346 Replace the deprecated promises Is with State (#3975)
• 1b3c5d3 List 7.16 as the maintained 7.x version (#3979)
• 453adce Raise minimum psr7 version to 3.2 (#3980)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)