Skip to content

Bump the composer-production-dependencies group across 1 directory with 2 updates#191

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/src/quote/composer-production-dependencies-cec58fcef1
Open

Bump the composer-production-dependencies group across 1 directory with 2 updates#191
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/src/quote/composer-production-dependencies-cec58fcef1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updates the requirements on guzzlehttp/guzzle and slim/slim to permit the latest version.
Updates guzzlehttp/guzzle to 7.12.1

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.12.1

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.12.1

Fixed

  • Reject proxy URLs with a malformed scheme in the cURL handlers instead of letting libcurl mishandle them

Security

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.12.1 - 2026-06-18

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.12.1

Fixed

  • Reject proxy URLs with a malformed scheme in the cURL handlers instead of letting libcurl mishandle them

Security

7.12.0 - 2026-06-16

Added

  • Added RequestOptions constants for curl, retries, and stream_context

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.12
  • Constrain cURL transport sharing to safe libcurl DNS and SSL session support
  • Resolve proxy environment variables in the cURL handlers; libcurl no longer reads the environment itself
  • Ignore proxy environment variables when the proxy request option makes a decision
  • Disable proxy environment variables on Windows SAPIs other than CLI (httpoxy hardening)
  • Redact proxy credentials from cURL handler error messages, following Psr7\Utils::redactUserInfo()
  • Normalize no-proxy domain and IP literal matching across the cURL and stream handlers

Deprecated

  • Deprecated the request-level handler option, which will be ignored in 8.0
  • Deprecated raw cURL request options outside the built-in cURL handlers' allow-list
  • Deprecated the CURLOPT_PROXYTYPE cURL request option; set the proxy type via a scheme-prefixed proxy URL
  • Deprecated PHP stream context options outside the built-in stream handler allow-list
  • Deprecated passing ntlm as a built-in auth type
  • Deprecated Utils::describeType()
  • Deprecated non-finite floats in the query and form_params options; 8.0 rejects them
  • Deprecated non-string scalar values in the body option; 8.0 rejects them

Fixed

  • Fix cURL TLS and HTTP/2 capability detection using libcurl feature checks
  • Fix proxy no list matches being re-proxied through environment-configured proxies by libcurl
  • Fix no list and NO_PROXY matching to support IP CIDR ranges, matching libcurl
  • Fix the stream handler not applying scheme-less proxies and their credentials

... (truncated)

Commits
  • d346274 Release 7.12.1
  • 7f537cd Reject dot-only cookie domains (#3653)
  • 29482f2 Adjust version constraints (#3651)
  • fc70174 Reject proxy URLs with a malformed scheme in the cURL handlers (#3637)
  • 0f4da82 Reject HTTPS proxies when libcurl lacks HTTPS-proxy support (#3626)
  • eaa8159 Release 7.12.0
  • e0d3349 Adjusted guzzlehttp/psr7 version constraint and corrected links (#3646)
  • 8ca9415 Normalize scalar body request options (#3644)
  • 1a8d3aa Translate scheme-less proxies and their credentials in the stream handler (#3...
  • 751f7a5 Revert too aggressive authenticated proxy tunnel reuse mitigation (#3641)
  • Additional commits viewable in compare view

Updates slim/slim to 4.15.2

Release notes

Sourced from slim/slim's releases.

4.15.2

Fixed

Full Changelog: slimphp/Slim@4.15.1...4.15.2

Changelog

Sourced from slim/slim's changelog.

4.15.2 - 2026-05-22

Fixed

  • Escape HTML entities in HtmlErrorRenderer to prevent XSS attacks (GHSA-53h4-8rc4-f539)
  • Fix static analysis suppression in RouteCollector::removeNamedRoute() (#3445)

Full Changelog: slimphp/Slim@4.15.1...4.15.2

4.15.1 - 2025-11-21

Fixed

  • Allow PHPUnit 10, 11 and 12 when testing Slim itself (#3411)

Added

  • Add support for PHP 8.5 (#3415)

Full Changelog: slimphp/Slim@4.15.0...4.15.1

4.15.0 - 2025-08-24

Fixed

  • Fix DocBlocks for callable route handlers (#3389)
  • Change class keyword to lowercase (#3346)
  • Fix tests for PHP 8.3
  • Fixes the build status badge in Readme (#3331)
  • Fix text and eol attributes for * selector in .gitattributes (#3391)
  • Deprecate setArgument/s (#3383)

Added

  • Add support for PHP 8.4
  • Add phpstan v2

Changed

  • Update http urls in composer.json (#3399)

Full Changelog: slimphp/Slim@4.14.0...4.15.0

4.14.0 - 2024-06-13

Changed

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the composer-production-dependencies group across 1 directory wi…
38219f9 
…th 2 updates

Updates the requirements on [guzzlehttp/guzzle](https://github.com/guzzle/guzzle) and [slim/slim](https://github.com/slimphp/Slim) to permit the latest version.

Updates `guzzlehttp/guzzle` to 7.12.1
- [Release notes](https://github.com/guzzle/guzzle/releases)
- [Changelog](https://github.com/guzzle/guzzle/blob/7.12/CHANGELOG.md)
- [Commits](guzzle/guzzle@7.10.0...7.12.1)

Updates `slim/slim` to 4.15.2
- [Release notes](https://github.com/slimphp/Slim/releases)
- [Changelog](https://github.com/slimphp/Slim/blob/4.x/CHANGELOG.md)
- [Commits](slimphp/Slim@4.15.1...4.15.2)

---
updated-dependencies:
- dependency-name: guzzlehttp/guzzle
  dependency-version: 7.12.1
  dependency-type: direct:production
  dependency-group: composer-production-dependencies
- dependency-name: slim/slim
  dependency-version: 4.15.2
  dependency-type: direct:production
  dependency-group: composer-production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update php code labels Jun 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file php Pull requests that update php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants