Update dependency guzzlehttp/guzzle to v6 [SECURITY] - autoclosed

[x-series-renovate]

This PR contains the following updates:

Package	Type	Update	Change
guzzlehttp/guzzle (source)	require	major	~4.0 -> ~6.0

GitHub Vulnerability Alerts

CVE-2016-5385

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.

CVE-2022-29248

Impact

Previous version of Guzzle contain a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the Set-Cookie header, allowing a malicious server to set cookies for unrelated domains. For example an attacker at www.example.com might set a session cookie for api.example.net, logging the Guzzle client into their account and retrieving private API requests from the security log of their account.

Note that our cookie middleware is disabled by default, so most library consumers will not be affected by this issue. Only those who manually add the cookie middleware to the handler stack or construct the client with ['cookies' => true] are affected. Moreover, those who do not use the same Guzzle client to call multiple domains and have disabled redirect forwarding are not affected by this vulnerability.

Patches

Affected Guzzle 7 users should upgrade to Guzzle 7.4.3 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.6 or 7.4.3.

Workarounds

If you do not need support for cookies, turn off the cookie middleware. It is already off by default, but if you have turned it on and no longer need it, turn it off.

References

• RFC6265 Section 5.3
• RFC9110 Section 15.4

For more information

If you have any questions or comments about this advisory, please get in touch with us in #guzzle on the PHP HTTP Slack. Do not report additional security advisories in that public channel, however - please follow our vulnerability reporting process.

CVE-2022-31042

Impact

Cookie headers on requests are sensitive information. On making a request using the https scheme to a server which responds with a redirect to a URI with the http scheme, or on making a request to a server which responds with a redirect to a a URI to a different host, we should not forward the Cookie header on. Prior to this fix, only cookies that were managed by our cookie middleware would be safely removed, and any Cookie header manually added to the initial request would not be stripped. We now always strip it, and allow the cookie middleware to re-add any cookies that it deems should be there.

Patches

Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4.

Workarounds

An alternative approach would be to use your own redirect middleware, rather than ours, if you are unable to upgrade. If you do not require or expect redirects to be followed, one should simply disable redirects all together.

References

• RFC9110 Section 15.4

For more information

If you have any questions or comments about this advisory, please get in touch with us in #guzzle on the PHP HTTP Slack. Do not report additional security advisories in that public channel, however - please follow our vulnerability reporting process.

CVE-2022-31043

Impact

Authorization headers on requests are sensitive information. On making a request using the https scheme to a server which responds with a redirect to a URI with the http scheme, we should not forward the Authorization header on. This is much the same as to how we don't forward on the header if the host changes. Prior to this fix, https to http downgrades did not result in the Authorization header being removed, only changes to the host.

Patches

Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4.

Workarounds

An alternative approach would be to use your own redirect middleware, rather than ours, if you are unable to upgrade. If you do not require or expect redirects to be followed, one should simply disable redirects all together.

References

• RFC9110 Section 15.4

For more information

If you have any questions or comments about this advisory, please get in touch with us in #guzzle on the PHP HTTP Slack. Do not report additional security advisories in that public channel, however - please follow our vulnerability reporting process.

CVE-2022-31090

Impact

Authorization headers on requests are sensitive information. When using our Curl handler, it is possible to use the CURLOPT_HTTPAUTH option to specify an Authorization header. On making a request which responds with a redirect to a URI with a different origin, if we choose to follow it, we should remove the CURLOPT_HTTPAUTH and CURLOPT_USERPWD options before continuing, stopping curl from appending the Authorization header to the new request. Previously, we would only consider a change in host. Now, we consider any change in host, port or scheme to be a change in origin.

Patches

Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.8 or 7.4.5. Note that a partial fix was implemented in Guzzle 7.4.2, where a change in host would trigger removal of the curl-added Authorization header, however this earlier fix did not cover change in scheme or change in port.

Workarounds

If you do not require or expect redirects to be followed, one should simply disable redirects all together. Alternatively, one can specify to use the Guzzle stream handler backend, rather than curl.

References

• RFC9110 Section 15.4
• CVE-2022-27776

For more information

If you have any questions or comments about this advisory, please get in touch with us in #guzzle on the PHP HTTP Slack. Do not report additional security advisories in that public channel, however - please follow our vulnerability reporting process.

CVE-2022-31091

Impact

Authorization and Cookie headers on requests are sensitive information. On making a request which responds with a redirect to a URI with a different port, if we choose to follow it, we should remove the Authorization and Cookie headers from the request, before containing. Previously, we would only consider a change in host or scheme downgrade. Now, we consider any change in host, port or scheme to be a change in origin.

Patches

Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.8 or 7.4.5.

Workarounds

An alternative approach would be to use your own redirect middleware, rather than ours, if you are unable to upgrade. If you do not require or expect redirects to be followed, one should simply disable redirects all together.

References

• RFC9110 Section 15.4
• CVE-2022-27776

For more information

If you have any questions or comments about this advisory, please get in touch with us in #guzzle on the PHP HTTP Slack. Do not report additional security advisories in that public channel, however please follow our vulnerability reporting process.

---

Release Notes

guzzle/guzzle (guzzlehttp/guzzle)

v6.5.8

Compare Source

See change log for changes.

v6.5.7

Compare Source

See change log for changes.

v6.5.6

Compare Source

See change log for changes.

v6.5.5

Compare Source

v6.5.4

Compare Source

v6.5.3

Compare Source

v6.5.2

Compare Source

• idn_to_ascii() fix for old PHP versions #​2489

v6.5.1

Compare Source

• Better defaults for PHP installations with old ICU lib #​2454
• IDN support for redirects #​2424

v6.5.0

Compare Source

• Improvement: Added support for reset internal queue in MockHandler. #​2143
• Improvement: Added support to pass arbitrary options to curl_multi_init. #​2287
• Fix: Gracefully handle passing null to the header option. #​2132
• Fix: RetryMiddleware did not do exponential delay between retires due unit mismatch. #​2132
• Fix: Prevent undefined offset when using array for ssl_key options. #​2348
• Deprecated ClientInterface::VERSION

v6.4.1

Compare Source

• No guzzle.phar was created in 6.4.0 due expired API token. This release will fix that
• Added parent::__construct() to FileCookieJar and SessionCookieJar

v6.4.0

Compare Source

• Improvement: Improved error messages when using curl < 7.21.2 #​2108
• Fix: Test if response is readable before returning a summary in RequestException::getResponseBodySummary() #​2081
• Fix: Add support for GUZZLE_CURL_SELECT_TIMEOUT environment variable #​2161
• Improvement: Added GuzzleHttp\Exception\InvalidArgumentException #​2163
• Improvement: Added GuzzleHttp\_current_time() to use hrtime() if that function exists. #​2242
• Improvement: Added curl's appconnect_time in TransferStats #​2284
• Improvement: Make GuzzleException extend Throwable wherever it's available #​2273
• Fix: Prevent concurrent writes to file when saving CookieJar #​2335
• Improvement: Update MockHandler so we can test transfer time #​2362

v6.3.3

Compare Source

• Fix: Default headers when decode_content is specified

v6.3.2

Compare Source

• Fix: Release process

v6.3.1

Compare Source

• Bug fix: Parsing 0 epoch expiry times in cookies #​2014
• Improvement: Better ConnectException detection #​2012
• Bug fix: Malformed domain that contains a "/" #​1999
• Bug fix: Undefined offset when a cookie has no first key-value pair #​1998
• Improvement: Support PHPUnit 6 #​1953
• Bug fix: Support empty headers #​1915
• Bug fix: Ignore case during header modifications #​1916

• Minor code cleanups, documentation fixes and clarifications.

v6.3.0

Compare Source

• Feature: force IP resolution (ipv4 or ipv6) #​1608, #​1659
• Improvement: Don't include summary in exception message when body is empty #​1621
• Improvement: Handle on_headers option in MockHandler #​1580
• Improvement: Added SUSE Linux CA path #​1609
• Improvement: Use class reference for getting the name of the class instead of using hardcoded strings #​1641
• Feature: Added read_timeout option #​1611
• Bug fix: PHP 7.x fixes #​1685, #​1686, #​1811
• Deprecation: BadResponseException instantiation without a response #​1642
• Feature: Added NTLM auth #​1569
• Feature: Track redirect HTTP status codes #​1711
• Improvement: Check handler type during construction #​1745
• Improvement: Always include the Content-Length if there's a body #​1721
• Feature: Added convenience method to access a cookie by name #​1318
• Bug fix: Fill CURLOPT_CAPATH and CURLOPT_CAINFO properly #​1684
• Improvement: Use \GuzzleHttp\Promise\rejection_for function instead of object init #​1827

• Minor code cleanups, documentation fixes and clarifications.

v6.2.3

Compare Source

• Fix deprecations with guzzle/psr7 version 1.4

v6.2.2

Compare Source

• Allow to pass nullable Response to delay callable
• Only add scheme when host is present
• Fix drain case where content-length is the literal string zero
• Obfuscate in-URL credentials in exceptions

v6.2.1

Compare Source

• Address HTTP_PROXY security vulnerability, CVE-2016-5385:
  https://httpoxy.org/
• Fixing timeout bug with StreamHandler:
  https://github.com/guzzle/guzzle/pull/14881488
• Only read up to Content-Length in PHP StreamHandler to avoid timeouts when
  a server does not honor Connection: close.
• Ignore URI fragment when sending requests.

v6.2.0

Compare Source

• Feature: added GuzzleHttp\json_encode and GuzzleHttp\json_decode.
  https://github.com/guzzle/guzzle/pull/13891389
• Bug fix: Fix sleep calculation when waiting for delayed requests.
  https://github.com/guzzle/guzzle/pull/13241324
• Feature: More flexible history containers.
  https://github.com/guzzle/guzzle/pull/13731373
• Bug fix: defer sink stream opening in StreamHandler.
  https://github.com/guzzle/guzzle/pull/13771377
• Bug fix: do not attempt to escape cookie values.
  https://github.com/guzzle/guzzle/pull/14061406
• Feature: report original content encoding and length on decoded responses.
  https://github.com/guzzle/guzzle/pull/14091409
• Bug fix: rewind seekable request bodies before dispatching to cURL.
  https://github.com/guzzle/guzzle/pull/14221422
• Bug fix: provide an empty string to http_build_query for HHVM workaround.
  https://github.com/guzzle/guzzle/pull/13671367

v6.1.1

Compare Source

• Bug fix: Proxy::wrapSync() now correctly proxies to the appropriate handler
  guzzle/guzzle@911bcbc
• Feature: HandlerStack is now more generic.
  guzzle/guzzle@f210294
• Bug fix: setting verify to false in the StreamHandler now disables peer
  verificatihttps://github.com/guzzle/guzzle/issues/12561256
• Feature: Middleware now uses an exception factory, including more error
  contehttps://github.com/guzzle/guzzle/pull/12821282
• Feature: better support for disabled functions.
  https://github.com/guzzle/guzzle/pull/12871287
• Bug fix: fixed regression where MockHandler was not using sink.
  https://github.com/guzzle/guzzle/pull/12921292

v6.1.0

Compare Source

• Feature: Added the on_stats request option to provide access to transfer
  statistics for requeshttps://github.com/guzzle/guzzle/pull/12021202
• Feature: Added the ability to persist session cookies in CookieJars.
  https://github.com/guzzle/guzzle/pull/11951195
• Feature: Some compatibility updates for Google APP Engine
  https://github.com/guzzle/guzzle/pull/12161216
• Feature: Added support for NO_PROXY to prevent the use of a proxy based on
  a simple set of rulhttps://github.com/guzzle/guzzle/pull/11971197
• Feature: Cookies can now contain square brackets.
  https://github.com/guzzle/guzzle/pull/12371237
• Bug fix: Now correctly parsing = inside of quotes in Cookies.
  https://github.com/guzzle/guzzle/pull/12321232
• Bug fix: Cusotm cURL options now correctly override curl options of the
  same nahttps://github.com/guzzle/guzzle/pull/12211221
• Bug fix: Content-Type header is now added when using an explicitly provided
  multipart bohttps://github.com/guzzle/guzzle/pull/12181218
• Bug fix: Now ignoring Set-Cookie headers that have no name.
• Bug fix: Reason phrase is no longer cast to an int in some cases in the
  cURL handlhttps://github.com/guzzle/guzzle/pull/11871187
• Bug fix: Remove the Authorization header when redirecting if the Host
  header changhttps://github.com/guzzle/guzzle/pull/12071207
• Bug fix: Cookie path matching fixes
  https://github.com/guzzle/guzzle/issues/11291129
• Bug fix: Fixing the cURL body_as_string setting
  https://github.com/guzzle/guzzle/pull/12011201
• Bug fix: quotes are no longer stripped when parsing cookies.
  https://github.com/guzzle/guzzle/issues/11721172
• Bug fix: form_params and query now always uses the & separator.
  https://github.com/guzzle/guzzle/pull/11631163
• Bug fix: Adding a Content-Length to PHP stream wrapper requests if not set.
  https://github.com/guzzle/guzzle/pull/11891189

v6.0.2

Compare Source

• Fixed a memory leak in the curl handlers in which references to callbacks
  were not being removed by curl_reset.
• Cookies are now extracted properly before redirects.
• Cookies now allow more character ranges.
• Decoded Content-Encoding responses are now modified to correctly reflect
  their state if the encoding was automatically removed by a handler. This
  means that the Content-Encoding header may be removed an the
  Content-Length modified to reflect the message size after removing the
  encoding.
• Added a more explicit error message when trying to use form_params and
  multipart in the same request.
• Several fixes for HHVM support.
• Functions are now conditionally required using an additional level of
  indirection to help with global Composer installations.

v6.0.1

Compare Source

• Fixed a bug with serializing the query request option where the &
  separator was missing.
• Added a better error message for when body is provided as an array. Please
  use form_params or multipart instead.
• Various doc fixes.

v6.0.0

Compare Source

• See the UPGRADING.md document for more information.
• Added multipart and form_params request options.
• Added synchronous request option.
• Added the on_headers request option.
• Fixed expect handling.
• No longer adding default middlewares in the client ctor. These need to be
  present on the provided handler in order to work.
• Requests are no longer initiated when sending async requests with the
  CurlMultiHandler. This prevents unexpected recursion from requests completing
  while ticking the cURL loop.
• Removed the semantics of setting default to true. This is no longer
  required now that the cURL loop is not ticked for async requests.
• Added request and response logging middleware.
• No longer allowing self signed certificates when using the StreamHandler.
• Ensuring that sink is valid if saving to a file.
• Request exceptions now include a "handler context" which provides handler
  specific contextual information.
• Added GuzzleHttp\RequestOptions to allow request options to be applied
  using constants.
• $maxHandles has been removed from CurlMultiHandler.
• MultipartPostBody is now part of the guzzlehttp/psr7 package.

v5.3.4

Compare Source

v5.3.3

Compare Source

v5.3.2

Compare Source

v5.3.1

Compare Source

v5.3.0

Compare Source

• Mock now supports save_to
• Marked AbstractRequestEvent::getTransaction() as public.
• Fixed a bug in which multiple headers using different casing would overwrite
  previous headers in the associative array.
• Added Utils::getDefaultHandler()
• Marked GuzzleHttp\Client::getDefaultUserAgent as deprecated.
• URL scheme is now always lowercased.

v5.2.0

Compare Source

• Added AppliesHeadersInterface to make applying headers to a request based
  on the body more generic and not specific to PostBodyInterface.
• Reduced the number of stack frames needed to send requests.
• Nested futures are now resolved in the client rather than the RequestFsm
• Finishing state transitions is now handled in the RequestFsm rather than the
  RingBridge.
• Added a guard in the Pool class to not use recursion for request retries.

v5.1.0

Compare Source

• Pool class no longer uses recursion when a request is intercepted.
• The size of a Pool can now be dynamically adjusted using a callback.
  https://github.com/guzzle/guzzle/pull/943/943.
• Setting a request option to null when creating a request with a client will
  ensure that the option is not set. This allows you to overwrite default
  request options on a per-request bashttps://github.com/guzzle/guzzle/pull/937zle/pull/937.
• Added the ability to limit which protocols are allowed for redirects by
  specifying a protocols array in the allow_redirects request option.
• Nested futures due to retries are now resolved when waiting for synchronous
  responses. https://github.com/guzzle/guzzle/pull/947/947.
• "0" is now an allowed URI path. See
  https://github.com/guzzle/guzzle/pull/935/935.
• Query no longer typehints on the $query argument in the constructor,
  allowing for strings and arrays.
• Exceptions thrown in the end event are now correctly wrapped with Guzzle
  specific exceptions if necessary.

v5.0.3

Compare Source

This change updates query strings so that they are treated as un-encoded values
by default where the value represents an un-encoded value to send over the
wire. A Query object then encodes the value before sending over the wire. This
means that even value query string values (e.g., ":") are url encoded. This
makes the Query class match PHP's http_build_query function. However, if you
want to send requests over the wire using valid query string characters that do
not need to be encoded, then you can provide a string to Url::setQuery() and
pass true as the second argument to specify that the query string is a raw
string that should not be parsed or encoded (unless a call to getQuery() is
subsequently made, forcing the query-string to be converted into a Query
object).

v5.0.2

Compare Source

• Added a trailing \r\n to multipart/form-data payloads. See
  https://github.com/guzzle/guzzle/pull/871/871

• Added a GuzzleHttp\Pool::send() convenience method to match the docs.

• Status codes are now returned as integers. See
  https://github.com/guzzle/guzzle/issues/881/881

• No longer overwriting an existing application/x-www-form-urlencoded header
  when sending POST requests, allowing for customized headers. https://github.com/guzzle/guzzle/issues/877sues/877

• Improved path URL serialization.

  • No longer double percent-encoding characters in the path or query string if
    they are already encoded.
  • Now properly encoding the supplied path to a URL object, instead of only
    encoding ' ' and '?'.
  • Note: This has been changed in 5.0.3 to now encode query string values by
    default unless the rawString argument is provided when setting the query
    string on a URL: Now allowing many more characters to be present in the
    query string without being percent encoded. See
    https://datatracker.ietf.org/doc/html/rfc3986#appendix-A

v5.0.1

Compare Source

Bugfix release.

• Fixed an issue where connection errors still returned response object in
  error and end events event though the response is unusable. This has been
  corrected so that a response is not returned in the getResponse method of
  these events if the response did not complehttps://github.com/guzzle/guzzle/issues/867/867
• Fixed an issue where transfer statistics were not being populated in the
  RingBridhttps://github.com/guzzle/guzzle/issues/866/866

v5.0.0

Compare Source

Adding support for non-blocking responses and some minor API cleanup.

New Features

• Added support for non-blocking responses based on guzzlehttp/guzzle-ring.
• Added a public API for creating a default HTTP adapter.
• Updated the redirect plugin to be non-blocking so that redirects are sent
  concurrently. Other plugins like this can now be updated to be non-blocking.
• Added a "progress" event so that you can get upload and download progress
  events.
• Added GuzzleHttp\Pool which implements FutureInterface and transfers
  requests concurrently using a capped pool size as efficiently as possible.
• Added hasListeners() to EmitterInterface.
• Removed GuzzleHttp\ClientInterface::sendAll and marked
  GuzzleHttp\Client::sendAll as deprecated (it's still there, just not the
  recommended way).

Breaking changes

The breaking changes in this release are relatively minor. The biggest thing to
look out for is that request and response objects no longer implement fluent
interfaces.

• Removed the fluent interfaces (i.e., return $this) from requests,
  responses, GuzzleHttp\Collection, GuzzleHttp\Url,
  GuzzleHttp\Query, GuzzleHttp\Post\PostBody, and
  GuzzleHttp\Cookie\SetCookie. This blog post provides a good outline of
  why I did this: https://ocramius.github.io/blog/fluent-interfaces-are-evil/.
  This also makes the Guzzle message interfaces compatible with the current
  PSR-7 message proposal.
• Removed "functions.php", so that Guzzle is truly PSR-4 compliant. Except
  for the HTTP request functions from function.php, these functions are now
  implemented in GuzzleHttp\Utils using camelCase. GuzzleHttp\json_decode
  moved to GuzzleHttp\Utils::jsonDecode. GuzzleHttp\get_path moved to
  GuzzleHttp\Utils::getPath. GuzzleHttp\set_path moved to
  GuzzleHttp\Utils::setPath. GuzzleHttp\batch should now be
  GuzzleHttp\Pool::batch, which returns an objectStorage. Using functions.php
  caused problems for many users: they aren't PSR-4 compliant, require an
  explicit include, and needed an if-guard to ensure that the functions are not
  declared multiple times.
• Rewrote adapter layer.
  • Removing all classes from GuzzleHttp\Adapter, these are now
    implemented as callables that are stored in GuzzleHttp\Ring\Client.
  • Removed the concept of "parallel adapters". Sending requests serially or
    concurrently is now handled using a single adapter.
  • Moved GuzzleHttp\Adapter\Transaction to GuzzleHttp\Transaction. The
    Transaction object now exposes the request, response, and client as public
    properties. The getters and setters have been removed.
• Removed the "headers" event. This event was only useful for changing the
  body a response once the headers of the response were known. You can implement
  a similar behavior in a number of ways. One example might be to use a
  FnStream that has access to the transaction being sent. For example, when the
  first byte is written, you could check if the response headers match your
  expectations, and if so, change the actual stream body that is being
  written to.
• Removed the asArray parameter from
  GuzzleHttp\Message\MessageInterface::getHeader. If you want to get a header
  value as an array, then use the newly added getHeaderAsArray() method of
  MessageInterface. This change makes the Guzzle interfaces compatible with
  the PSR-7 interfaces.
• GuzzleHttp\Message\MessageFactory no longer allows subclasses to add
  custom request options using double-dispatch (this was an implementation
  detail). Instead, you should now provide an associative array to the
  constructor which is a mapping of the request option name mapping to a
  function that applies the option value to a request.
• Removed the concept of "throwImmediately" from exceptions and error events.
  This control mechanism was used to stop a transfer of concurrent requests
  from completing. This can now be handled by throwing the exception or by
  cancelling a pool of requests or each outstanding future request individually.
• Updated to "GuzzleHttp\Streams" 3.0.
  • GuzzleHttp\Stream\StreamInterface::getContents() no longer accepts a
    maxLen parameter. This update makes the Guzzle streams project
    compatible with the current PSR-7 proposal.
  • GuzzleHttp\Stream\Stream::__construct,
    GuzzleHttp\Stream\Stream::factory, and
    GuzzleHttp\Stream\Utils::create no longer accept a size in the second
    argument. They now accept an associative array of options, including the
    "size" key and "metadata" key which can be used to provide custom metadata.

v4.2.4

Compare Source

v4.2.3

Compare Source

v4.2.2

Compare Source

• Fixed a memory leak in the CurlAdapter when reusing cURL handles.
• No longer using request_fulluri in stream adapter proxies.
• Relative redirects are now based on the last response, not the first response.

v4.2.1

Compare Source

• Ensuring that the StreamAdapter does not always add a Content-Type header
• Adding automated github releases with a phar and zip

v4.2.0

Compare Source

• Now merging in default options using a case-insensitive comparison.
  Clohttps://github.com/guzzle/guzzle/issues/767/767
• Added the ability to automatically decode Content-Encoding response bodies
  using the decode_content request option. This is set to true by default
  to decode the response body if it comes over the wire with a
  Content-Encoding. Set this value to false to disable decoding the
  response content, and pass a string to provide a request Accept-Encoding
  header and turn on automatic response decoding. This feature now allows you
  to pass an Accept-Encoding header in the headers of a request but still
  disable automatic response decoding.
  https://github.com/guzzle/guzzle/issues/764sues/764
• Added the ability to throw an exception immediately when transferring
  requests in parallel. Clohttps://github.com/guzzle/guzzle/issues/760/760
• Updating guzzlehttp/streams dependency to ~2.1
• No longer utilizing the now deprecated namespaced methods from the stream
  package.

v4.1.8

Compare Source

• Fixed an issue in the CurlFactory that caused setting the stream=false
  request option to throw an exception.
  https://github.com/guzzle/guzzle/issues/769sues/769
• TransactionIterator now calls rewind on the inner iterator.
  Shttps://github.com/guzzle/guzzle/pull/765/765
• You can now set the Content-Type header to multipart/form-data
  when creating POST requests to force multipart bodies.
  https://github.com/guzzle/guzzle/issues/768sues/768

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[x-series-renovate]

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock

Command failed: composer update guzzlehttp/guzzle:6.5.8 --with-dependencies --ignore-platform-reqs --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins
Deprecation warning: Your package name Vend/Phoneduty is invalid, it should not contain uppercase characters. We suggest using vend/phoneduty instead. Make sure you fix this as Composer 2.0 will error.
Package "guzzlehttp/guzzle:6.5.8" listed for update is not installed. Ignoring.
Loading composer repositories with package information
������������������������������������������������������                                                      ������������������������������������������������������Warning from https://repo.packagist.org: Support for Composer 1 is deprecated and some packages will not be available. You should upgrade to Composer 2. See https://blog.packagist.com/deprecating-composer-1-support/
Updating dependencies (including require-dev)
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - The requested package guzzlehttp/guzzle (locked at 4.1.7, required as ~6.0) is satisfiable by guzzlehttp/guzzle[4.1.7] but these conflict with your requirements or minimum-stability.