chore: Require Guzzle 7.15.2 or higher

.github/workflows/phpunit.yml

@@ -8,8 +8,14 @@ jobs:
     strategy:
       matrix:
         php-versions: [ '7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5' ]
+        dependencies: [ 'highest' ]
+        include:
+          - php-versions: '7.4'
+            dependencies: 'lowest'
+          - php-versions: '8.5'
+            dependencies: 'lowest'
 
-    name: PHP ${{ matrix.php-versions }}
+    name: PHP ${{ matrix.php-versions }}${{ matrix.dependencies == 'lowest' && ' (lowest dependencies)' || '' }}
 
     runs-on: ubuntu-latest
 
@@ -26,7 +32,12 @@ jobs:
         run: php -v
 
       - name: Composer install
+        if: matrix.dependencies == 'highest'
         run: composer install --prefer-dist --no-interaction --no-progress
+
+      - name: Composer install (lowest dependencies)
+        if: matrix.dependencies == 'lowest'
+        run: composer update --prefer-lowest --prefer-dist --no-interaction --no-progress
 
       - name: Run tests
         run: vendor/bin/phpunit

README.md

@@ -262,7 +262,7 @@ This error occurs because the code you get in your redirect URL is only valid fo
 See for example: [example/example.php](example/example.php)
 
 ## Guzzle versions
-Guzzle 6 and 7 is supported starting from v3. For Guzzle 3 use [v1](https://github.com/picqer/exact-php-client/releases?q=v1&expanded=true).
+Guzzle 7.15.2 or higher is required starting from v4.8, because earlier Guzzle versions have known security vulnerabilities. For Guzzle 6 use [v4.7](https://github.com/picqer/exact-php-client/releases/tag/v4.7.0) or lower. For Guzzle 3 use [v1](https://github.com/picqer/exact-php-client/releases?q=v1&expanded=true).
 
 ## TODO
 

composer.json

@@ -17,7 +17,7 @@
     ],
     "require": {
         "php": ">=7.4.0",
-        "guzzlehttp/guzzle": "~6.0|~7.0",
+        "guzzlehttp/guzzle": "^7.15.2",
         "ext-json": "*"
     },
     "require-dev": {