itflow/libs/vendor/guzzlehttp/psr7/CHANGELOG.md

Change Log

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

3.0.0 - 2026-07-20

Added

• Add DiagnosticValue::escape() to escape controls and malformed UTF-8 in diagnostics
• Add GuzzleHttp\Psr7\Exception\TimeoutException for timed-out stream operations
• Add GuzzleHttp\Psr7\Utils::redactUserInfoInString() to redact the userinfo of a raw URI string within text
• Promote GuzzleHttp\Psr7\Rfc3986 to public API with isValid*() predicates and canonicalizeIpv6()
• Add GuzzleHttp\Psr7\UriNormalizer::CANONICALIZE_IPV6_HOST to PRESERVING_NORMALIZATIONS

Changed

• Require psr/http-message:^2.0 and add native parameter and return types
• Require psr/http-factory:^1.1
• Reject native PHP serialization of stream implementations
• Preserve request method casing, except ServerRequest::fromGlobals() still uppercases
• Reject empty arrays and non-string values as header values
• Reject invalid uploaded file trees and invalid parsed body values
• Reject uploaded file specs missing tmp_name, size, or error
• Reject non-integer and negative uploaded file error values
• Reject invalid stream/upload sizes, buffer high-water marks, and dropping-stream limits
• Rewind seekable uploaded-file streams before copying in UploadedFile::moveTo()
• Reject negative read() lengths across all stream implementations
• Detect the + flag anywhere in a mode for Stream::isReadable()/isWritable()
• Reject empty strings returned by PumpStream source callables
• Discard buffered bytes on PumpStream close and detach
• Restore the original stream position after Message::bodySummary()
• Allow null for the Message::bodySummary() truncation length to use the default
• Validate LimitStream offset/limit and track non-seekable offset by bytes skipped
• Make FnStream close and detach terminal, calling close callbacks at most once
• Suppress exceptions from FnStream close callbacks during destructor cleanup
• Make CachingStream::close() idempotent, preserving remote cleanup after detach
• Do not move the CachingStream cursor when a SEEK_END target on an unknown-size stream is rejected
• Normalize multiple leading slashes in Uri::getPath() and origin-form request targets
• Serialize authority-less file URIs with rootless paths without the // separator
• Serialize authority-less file URIs with empty paths as file: instead of the unparseable file://
• Remove dot segments above the root per RFC 3986, prefixing authority-less // paths with /.
• Return a network-path reference from UriResolver::relativize() when an empty-path target requires one
• Stop returning an empty reference from UriResolver::relativize() when it would inherit the base fragment
• Stop throwing from UriResolver::relativize() when an equal-path target's last path segment contains a colon
• Harden URI host validation (delimiters, backslashes, IPv6, embedded ports); require schemes to start with a letter
• Validate Uri::fromParts() ports instead of casting them
• Treat ports 80 and 443 as defaults for the ws and wss schemes
• Use the ws and wss default ports in UriComparator::isCrossOrigin() port comparisons
• Redact all non-empty URI userinfo in Utils::redactUserInfo()
• Rebuild server request URIs from $_SERVER by REQUEST_METHOD, using target authority before SERVER_PORT
• Remove userinfo from absolute-form REQUEST_URI targets in ServerRequest::fromGlobals()
• Reject zero-port HTTP_HOST and malformed SERVER_PORT in ServerRequest::getUriFromGlobals()
• Reject malformed REQUEST_METHOD and SERVER_PROTOCOL server values in ServerRequest::fromGlobals()
• Reject zero-port Host and normalize leading-zero ports in Message::parseRequest()
• Reject duplicate Host headers and validate present values for all request-target forms
• Reject zero-port, hostless, and userinfo absolute-form request targets in Message::parseRequest()
• Synchronize the Host header in Request::withUri() when the URI changes or Host is empty
• Include the URI port in Host headers synthesized by Message::toString()
• Validate the Host header synthesized by Message::toString() from the request URI
• Include non-default URI ports in Host headers set by Utils::modifyRequest() URI changes
• Accept OPTIONS * and CONNECT authority-form request targets in Message::parseRequest()
• Hide credential-bearing URI, server, and cookie arguments in stack traces on PHP 8.2+
• Reject malformed HTTP request/response start-lines
• Unfold obsolete HTTP/1.0 line folding for all valid request method tokens
• Reject empty and control-character request targets in Request::withRequestTarget()
• Validate iterator chunks passed to Utils::streamFor()
• Validate unsupported values passed to Query::build()
• Reject non-finite float values in Query::build() and MultipartStream contents
• Reject non-finite float values in iterator chunks passed to Utils::streamFor()
• Utils::streamFor() now rejects non-string scalar bodies
• Uri::withQueryValues() now rejects non-string values
• Reject invalid Utils::modifyRequest() change values
• Use PHP debug type names in type error messages
• Changed Utils::copyToStream() to throw when destination streams cannot make progress
• Throw TimeoutException from Stream read/write and Utils copy/hash/readLine on stream timeouts
• Throw TimeoutException from AppendStream::read(), CachingStream::read(), and Utils::tryGetContents() on stream timeouts
• Re-throw TimeoutException from InflateStream when the decoded source stream times out
• Close the compressed source stream from InflateStream::close()
• Return the number of bytes copied from Utils::copyToStream()
• Throw OverflowException when stream byte counts or offsets exceed PHP_INT_MAX
• Translate StreamWrapper runtime failures to PHP stream failure values
• Stop adding default Content-Length to multipart/form-data parts (RFC 7578 §4.8)
• Escape multipart Content-Disposition parameters and reject unsafe boundaries and part headers
• Preserve trailing whitespace in custom MultipartStream part header values
• Preserve explicit custom MultipartStream boundary '0' instead of replacing it with a generated boundary
• Made static utility classes non-instantiable
• Validate bracketed IP-literal hosts consistently between parsing and withHost(), including userinfo forms
• Percent-encode raw control bytes in userinfo before bracketed IP-literal hosts instead of parsing mutated values
• Reject invalid UTF-8 and preserve percent-sequences in userinfo before bracketed IP-literal hosts
• Normalize percent-encoded octets in the URI host to uppercase hex
• Canonicalize IPv6 hosts to RFC 5952 form in Uri construction, fromParts(), and withHost()
• Canonicalize bracketed IPv6 hosts in UriComparator::isCrossOrigin()
• Reject malformed percent-sequences and percent-encoded bytes forbidden by the URI host policy
• Extend CAPITALIZE_PERCENT_ENCODING and DECODE_UNRESERVED_CHARACTERS to userinfo and host
• Trim header list elements with only spaces, horizontal tabs, and line terminators in Header::splitList()
• Report header parameter PCRE failures explicitly in Header::parse()
• Escape controls and malformed UTF-8 consistently in generated exception messages

Removed

• Dropped support for PHP 7.2 and 7.3
• Removed the ralouphie/getallheaders dependency
• Removed deprecated Header::normalize() method

2.13.0 - 2026-07-16

Added

• Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

• Use locale-independent ASCII case folding everywhere case is normalized
• Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

2.12.5 - 2026-07-13

Fixed

• Compare header names and hosts with locale-independent ASCII lowercasing
• Compare hosts without locale sensitivity when detecting cross-origin redirects

2.12.4 - 2026-07-08

Changed

• Pass explicit trim characters ahead of the PHP 8.6 trim default change

Fixed

• Anchor server port and response start-line patterns to the true end of input
• Treat host-less origin-form request targets starting with // as paths in Message::parseRequest()
• Reject raw DEL bytes in bracketed IP-literal hosts instead of parsing a mutated host
• Reject invalid bytes after a bracketed IP-literal host instead of reparsing a different host

2.12.3 - 2026-06-23

Security

• Validate the URI host so getHost() matches the URI authority (GHSA-c2w2-prh8-qm98)

2.12.2 - 2026-06-23

Fixed

• Report URI parsing, filtering, and normalization PCRE failures explicitly
• Report HTTP message parser PCRE failures explicitly
• Fail closed when PCRE validation fails for request targets and hosts

2.12.1 - 2026-06-18

Security

• Reject CR/LF in HTTP method, protocol version, and reason phrase (GHSA-vm85-hxw5-5432)

2.12.0 - 2026-06-16

Deprecated

• Deprecated non-finite float values in Query::build() that guzzlehttp/psr7 3.0 rejects
• Deprecated non-finite float multipart contents that guzzlehttp/psr7 3.0 rejects
• Deprecated non-string scalar bodies in Utils::streamFor(); cast them to a string for 3.0
• Deprecated non-string Uri::withQueryValues() values; cast them to a string for 3.0

2.11.1 - 2026-06-12

Fixed

• Fixed non-finite float values emitting coercion warnings on PHP 8.5

2.11.0 - 2026-06-02

Changed

• Changed Utils::modifyRequest() to reject conflicting URI and Host header changes in the same call
• Changed Header::parse() to split semicolon-separated parameters without repeated regular expression lookaheads
• Changed UriComparator::isCrossOrigin() so only HTTP and HTTPS missing ports receive implicit default ports

Deprecated

• Deprecated invalid PSR-7 arguments that guzzlehttp/psr7 3.0 will require native types for
• Deprecated non-string header values that guzzlehttp/psr7 3.0 will reject
• Deprecated empty header value arrays that guzzlehttp/psr7 3.0 will reject
• Deprecated URI schemes that do not match guzzlehttp/psr7 3.0 syntax requirements
• Deprecated multipart boundary and custom part header metadata that guzzlehttp/psr7 3.0 will reject
• Deprecated reliance on automatic uppercasing of request methods; guzzlehttp/psr7 3.0 preserves method casing
• Deprecated invalid Utils::modifyRequest() change values that guzzlehttp/psr7 3.0 will reject

Fixed

• Fixed Utils::copyToStream() to retry short destination writes instead of dropping the unwritten remainder
• Fixed Header::parse() splitting of semicolon-separated parameters with escaped quotes

2.10.4 - 2026-05-29

Fixed

• Apply UriNormalizer percent-encoding normalizations to URI fragments
• Make LimitStream::getSize() return 0 for slices past the underlying stream end
• Make AppendStream::read() return an empty string when no streams are attached
• Make CachingStream::read() throw on an incomplete cache-target write instead of silently corrupting replays
• Prevent CachingStream::seek() from looping indefinitely when the remote stream makes no progress

2.10.3 - 2026-05-27

Fixed

• Fixed URI parsing for IPv6 literals containing embedded IPv4 addresses
• Fixed malformed UTF-8 URI strings being parsed as empty URIs

2.10.2 - 2026-05-25

Security

• Reject control and whitespace characters in URI host components (GHSA-hq7v-mx3g-29hw)
• Reject malformed Host values when constructing request URIs (GHSA-34xg-wgjx-8xph)

Fixed

• Make ServerRequest::fromGlobals() robust against unexpected HTTP header value types in $_SERVER

2.10.1 - 2026-05-20

Fixed

• Fix Utils::modifyRequest() with numeric header names

2.10.0 - 2026-05-19

Changed

• Harden ServerRequest::fromGlobals() against malformed $_SERVER values
• Prevent custom stream metadata from affecting internal size handling
• Throw when StreamWrapper::getResource() cannot create a resource
• Preserve custom request implementations in Utils::modifyRequest()
• Preserve custom URI implementations in UriResolver::resolve()
• Make Uri::__toString() side-effect-free

2.9.1 - 2026-05-19

Fixed

• Fix parsing of relative path references containing a colon in a non-initial path segment
• Fix CachingStream::detach() returning an incomplete resource before the decorated stream has been fully read
• Fix Message::bodySummary() returning null when truncating printable UTF-8 bodies inside a multibyte character

2.9.0 - 2026-03-10

Added

• Added nested array expansion support to MultipartStream
• Added @return static to MessageTrait methods

Changed

• Updated MIME type mappings

2.8.1 - 2026-03-10

Fixed

• Encode + signs in Uri::withQueryValue() and Uri::withQueryValues() to prevent them being interpreted as spaces

2.8.0 - 2025-08-23

Added

• Allow empty lists as header values

Changed

• PHP 8.5 support

2.7.1 - 2025-03-27

Fixed

• Fixed uppercase IPv6 addresses in URI

Changed

• Improve uploaded file error message

2.7.0 - 2024-07-18

Added

• Add Utils::redactUserInfo() method
• Add ability to encode bools as ints in Query::build

2.6.3 - 2024-07-18

Fixed

• Make StreamWrapper::stream_stat() return false if inner stream's size is null

Changed

• PHP 8.4 support

2.6.2 - 2023-12-03

Fixed

• Fixed another issue with the fact that PHP transforms numeric strings in array keys to ints

Changed

• Updated links in docs to their canonical versions
• Replaced call_user_func* with native calls

2.6.1 - 2023-08-27

Fixed

• Properly handle the fact that PHP transforms numeric strings in array keys to ints

2.6.0 - 2023-08-03

Changed

• Updated the mime type map to add some new entries, fix a couple of invalid entries, and remove an invalid entry
• Fallback to application/octet-stream if we are unable to guess the content type for a multipart file upload

2.5.1 - 2023-08-03

Fixed

• Corrected mime type for .acc files to audio/aac

Changed

• PHP 8.3 support

2.5.0 - 2023-04-17

Changed

• Adjusted psr/http-message version constraint to ^1.1 || ^2.0

2.4.5 - 2023-04-17

Fixed

• Prevent possible warnings on unset variables in ServerRequest::normalizeNestedFileSpec
• Fixed Message::bodySummary when preg_match fails
• Fixed header validation issue

2.4.4 - 2023-03-09

Changed

• Removed the need for AllowDynamicProperties in LazyOpenStream

2.4.3 - 2022-10-26

Changed

• Replaced sha1(uniqid()) by bin2hex(random_bytes(20))

2.4.2 - 2022-10-25

Fixed

• Fixed erroneous behaviour when combining host and relative path

2.4.1 - 2022-08-28

Fixed

• Rewind body before reading in Message::bodySummary

2.4.0 - 2022-06-20

Added

• Added provisional PHP 8.2 support
• Added UriComparator::isCrossOrigin method

2.3.0 - 2022-06-09

Fixed

• Added Header::splitList method
• Added Utils::tryGetContents method
• Improved Stream::getContents method
• Updated mimetype mappings

2.2.2 - 2022-06-08

Fixed

• Fix Message::parseRequestUri for numeric headers
• Re-wrap exceptions thrown in fread into runtime exceptions
• Throw an exception when multipart options is misformatted

2.2.1 - 2022-03-20

Fixed

• Correct header value validation

2.2.0 - 2022-03-20

Added

• A more compressive list of mime types
• Add JsonSerializable to Uri
• Missing return types

Fixed

• Bug MultipartStream no uri metadata
• Bug MultipartStream with filename for data:// streams
• Fixed new line handling in MultipartStream
• Reduced RAM usage when copying streams
• Updated parsing in Header::normalize()

2.1.1 - 2022-03-20

Fixed

• Validate header values properly

2.1.0 - 2021-10-06

Changed

• Attempting to create a Uri object from a malformed URI will no longer throw a generic InvalidArgumentException, but rather a MalformedUriException, which inherits from the former for backwards compatibility. Callers relying on the exception being thrown to detect invalid URIs should catch the new exception.

Fixed

• Return null in caching stream size if remote size is null

2.0.0 - 2021-06-30

Identical to the RC release.

2.0.0@RC-1 - 2021-04-29

Fixed

• Handle possibly unset url in stream_get_meta_data

2.0.0@beta-1 - 2021-03-21

Added

• PSR-17 factories
• Made classes final
• PHP7 type hints

Changed

• When building a query string, booleans are represented as 1 and 0.

Removed

• PHP < 7.2 support
• All functions in the GuzzleHttp\Psr7 namespace

1.8.1 - 2021-03-21

Fixed

• Issue parsing IPv6 URLs
• Issue modifying ServerRequest lost all its attributes

1.8.0 - 2021-03-21

Added

• Locale independent URL parsing
• Most classes got a @final annotation to prepare for 2.0

Fixed

• Issue when creating stream from php://input and curl-ext is not installed
• Broken Utils::tryFopen() on PHP 8

1.7.0 - 2020-09-30

Added

• Replaced functions by static methods

Fixed

• Converting a non-seekable stream to a string
• Handle multiple Set-Cookie correctly
• Ignore array keys in header values when merging
• Allow multibyte characters to be parsed in Message:bodySummary()

Changed

• Restored partial HHVM 3 support

[1.6.1] - 2019-07-02

Fixed

• Accept null and bool header values again

1.6.0 - 2019-06-30

Added

• Allowed version ^3.0 of ralouphie/getallheaders dependency (#244)
• Added MIME type for WEBP image format (#246)
• Added more validation of values according to PSR-7 and RFC standards, e.g. status code range (#250, #272)

Changed

• Tests don't pass with HHVM 4.0, so HHVM support got dropped. Other libraries like composer have done the same. (#262)
• Accept port number 0 to be valid (#270)

Fixed

• Fixed subsequent reads from php://input in ServerRequest (#247)
• Fixed readable/writable detection for certain stream modes (#248)
• Fixed encoding of special characters in the userInfo component of an URI (#253)

1.5.2 - 2018-12-04

Fixed

• Check body size when getting the message summary

1.5.1 - 2018-12-04

Fixed

• Get the summary of a body only if it is readable

1.5.0 - 2018-12-03

Added

• Response first-line to response string exception (fixes #145)
• A test for #129 behavior
• get_message_body_summary function in order to get the message summary
• 3gp and mkv mime types

Changed

• Clarify exception message when stream is detached

Deprecated

• Deprecated parsing folded header lines as per RFC 7230

Fixed

• Fix AppendStream::detach to not close streams
• InflateStream preserves isSeekable attribute of the underlying stream
• ServerRequest::getUriFromGlobals to support URLs in query parameters

Several other fixes and improvements.

1.4.2 - 2017-03-20

Fixed

• Reverted BC break to Uri::resolve and Uri::removeDotSegments by removing calls to trigger_error when deprecated methods are invoked.

1.4.1 - 2017-02-27

Added

• Rriggering of silenced deprecation warnings.

Fixed

• Reverted BC break by reintroducing behavior to automagically fix a URI with a relative path and an authority by adding a leading slash to the path. It's only deprecated now.

1.4.0 - 2017-02-21

Added

• Added common URI utility methods based on RFC 3986 (see documentation in the readme):
  • Uri::isDefaultPort
  • Uri::isAbsolute
  • Uri::isNetworkPathReference
  • Uri::isAbsolutePathReference
  • Uri::isRelativePathReference
  • Uri::isSameDocumentReference
  • Uri::composeComponents
  • UriNormalizer::normalize
  • UriNormalizer::isEquivalent
  • UriResolver::relativize

Changed

• Ensure ServerRequest::getUriFromGlobals returns a URI in absolute form.
• Allow parse_response to parse a response without delimiting space and reason.
• Ensure each URI modification results in a valid URI according to PSR-7 discussions. Invalid modifications will throw an exception instead of returning a wrong URI or doing some magic.
  • (new Uri)->withPath('foo')->withHost('example.com') will throw an exception because the path of a URI with an authority must start with a slash "/" or be empty
  • (new Uri())->withScheme('http') will return 'http://localhost'

Deprecated

• Uri::resolve in favor of UriResolver::resolve
• Uri::removeDotSegments in favor of UriResolver::removeDotSegments

Fixed

• Stream::read when length parameter <= 0.
• copy_to_stream reads bytes in chunks instead of maxLen into memory.
• ServerRequest::getUriFromGlobals when Host header contains port.
• Compatibility of URIs with file scheme and empty host.

1.3.1 - 2016-06-25

Fixed

• Uri::__toString for network path references, e.g. //example.org.
• Missing lowercase normalization for host.
• Handling of URI components in case they are '0' in a lot of places, e.g. as a user info password.
• Uri::withAddedHeader to correctly merge headers with different case.
• Trimming of header values in Uri::withAddedHeader. Header values may be surrounded by whitespace which should be ignored according to RFC 7230 Section 3.2.4. This does not apply to header names.
• Uri::withAddedHeader with an array of header values.
• Uri::resolve when base path has no slash and handling of fragment.
• Handling of encoding in Uri::with(out)QueryValue so one can pass the key/value both in encoded as well as decoded form to those methods. This is consistent with withPath, withQuery etc.
• ServerRequest::withoutAttribute when attribute value is null.

1.3.0 - 2016-04-13

Added

• Remaining interfaces needed for full PSR7 compatibility (ServerRequestInterface, UploadedFileInterface, etc.).
• Support for stream_for from scalars.

Changed

• Can now extend Uri.

Fixed

• A bug in validating request methods by making it more permissive.

1.2.3 - 2016-02-18

Fixed

• Support in GuzzleHttp\Psr7\CachingStream for seeking forward on remote streams, which can sometimes return fewer bytes than requested with fread.
• Handling of gzipped responses with FNAME headers.

1.2.2 - 2016-01-22

Added

• Support for URIs without any authority.
• Support for HTTP 451 'Unavailable For Legal Reasons.'
• Support for using '0' as a filename.
• Support for including non-standard ports in Host headers.

1.2.1 - 2015-11-02

Changes

• Now supporting negative offsets when seeking to SEEK_END.

1.2.0 - 2015-08-15

Changed

• Body as "0" is now properly added to a response.
• Now allowing forward seeking in CachingStream.
• Now properly parsing HTTP requests that contain proxy targets in parse_request.
• functions.php is now conditionally required.
• user-info is no longer dropped when resolving URIs.

1.1.0 - 2015-06-24

Changed

• URIs can now be relative.
• multipart/form-data headers are now overridden case-insensitively.
• URI paths no longer encode the following characters because they are allowed in URIs: "(", ")", "*", "!", "'"
• A port is no longer added to a URI when the scheme is missing and no port is present.

1.0.0 - 2015-05-19

Initial release.

Currently unsupported:

• Psr\Http\Message\ServerRequestInterface
• Psr\Http\Message\UploadedFileInterface