Skip to content

chore: Require Guzzle 7.15.2 or higher - #698

Merged
stephangroen merged 1 commit into
mainfrom
chore/require-patched-guzzle
Sep 23, 2026
Merged

stephangroen merged 1 commit into
mainfrom
chore/require-patched-guzzle

Conversation

@stephangroen

Copy link
Copy Markdown
Member

Summary

  • Require guzzlehttp/guzzle: ^7.15.2 instead of ~6.0|~7.0.
    • Guzzle 6 and Guzzle 7 below 7.15.2 have known security advisories. These are the 9 open Dependabot alerts: 1 high, 8 medium.
    • Modern Composer already refuses to install any Guzzle 6 version, because of the security advisories. Guzzle 6 support was untested and effectively unusable.
    • Guzzle 7.15.2 still supports PHP 7.4, so the supported PHP versions don't change.
  • CI now also runs the tests with --prefer-lowest on PHP 7.4 and 8.5, so the minimum versions are actually tested. The existing job names (PHP 7.4 … PHP 8.5) stay the same, so the required status checks keep working.
  • The README's "Guzzle versions" section points Guzzle 6 users to v4.7.

Intended for v4.8.0. Users still on Guzzle 6 or an older Guzzle 7 can keep using v4.7.

Test plan

  • Lowest dependencies (Guzzle 7.15.2, psr7 2.13.0): 592 tests pass, composer audit finds no advisories
  • Highest dependencies: 592 tests pass
  • CI passes, including the new "lowest dependencies" jobs

🤖 Generated with Claude Code

Guzzle 6 and Guzzle 7 below 7.15.2 have known security vulnerabilities.
Composer blocks installing all Guzzle 6 versions by default, so Guzzle 6
support was already untested and effectively unusable. Guzzle 7.15.2 still
supports PHP 7.4, so the supported PHP versions don't change.

CI now also runs the tests with the lowest allowed dependencies on PHP 7.4
and 8.5, so the minimum versions are actually tested.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@stephangroen
stephangroen merged commit 99be207 into main Sep 23, 2026
21 checks passed
@stephangroen
stephangroen deleted the chore/require-patched-guzzle branch September 23, 2026 12:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant