[dependabot]

Bumps guzzlehttp/guzzle from 7.15.5 to 8.3.0.

Release notes

Sourced from guzzlehttp/guzzle's releases.

8.3.0

Changed

• Adjusted guzzlehttp/promises version constraint to ^3.1
• Adjusted guzzlehttp/psr7 version constraint to ^3.2
• Replace the deprecated Promise\Is with Promise\State for PHP 8.6
• Decode chunked stream handler bodies as they arrive, ending at the last chunk
• Reject truncated and malformed chunked stream handler bodies, like libcurl
• Reject unsupported response transfer codings, like libcurl 8.14+
• End stream handler bodies at their declared Content-Length, including 0
• Throw when a streamed body ends before its declared Content-Length
• Classify cURL errors 8 and 23 with a response as ResponseTransferException
• Reject stream handler gzip and deflate bodies with trailing data, like libcurl
• Accept raw deflate stream handler bodies, like libcurl

Fixed

• Fix streamed stream handler bodies delaying bytes that arrived with the headers

8.2.1

Fixed

• Fix PHP 8.6 notices for oversized numeric hosts
• Fix delay values over 71 minutes
• Fix CurlMultiHandler delays over 71 minutes
• Fix overlapping stream handler requests sharing a deadline
• Fix stream handler responses in Swoole coroutines on PHP 8.4+
• Fix reads of streamed gzip and deflate responses waiting for 8 KiB of decoded data
• Fix stream handler accepting corrupt gzip and deflate response bodies

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^3.1.1

8.2.0

Changed

• Allow connection caps to be combined with persistent transport sharing on libcurl 8.22.0+

8.1.0

Added

• Add PHP 8.6+ stream TLS session sharing, while persistent sharing remains cURL-only
• Add support for PHP 8.6
• Add in-transfer resends of seekable streamed uploads when PHP exposes CURLOPT_SEEKFUNCTION

Changed

• Adjusted guzzlehttp/promises version constraint to ^3.0.2
• Adjusted guzzlehttp/psr7 version constraint to ^3.1

... (truncated)

Changelog

Sourced from guzzlehttp/guzzle's changelog.

8.3.0 - 2026-10-18

Changed

• Adjusted guzzlehttp/promises version constraint to ^3.1
• Adjusted guzzlehttp/psr7 version constraint to ^3.2
• Replace the deprecated Promise\Is with Promise\State for PHP 8.6
• Decode chunked stream handler bodies as they arrive, ending at the last chunk
• Reject truncated and malformed chunked stream handler bodies, like libcurl
• Reject unsupported response transfer codings, like libcurl 8.14+
• End stream handler bodies at their declared Content-Length, including 0
• Throw when a streamed body ends before its declared Content-Length
• Classify cURL errors 8 and 23 with a response as ResponseTransferException
• Reject stream handler gzip and deflate bodies with trailing data, like libcurl
• Accept raw deflate stream handler bodies, like libcurl

Fixed

• Fix streamed stream handler bodies delaying bytes that arrived with the headers

8.2.1 - 2026-10-18

Fixed

• Fix PHP 8.6 notices for oversized numeric hosts
• Fix delay values over 71 minutes
• Fix CurlMultiHandler delays over 71 minutes
• Fix overlapping stream handler requests sharing a deadline
• Fix stream handler responses in Swoole coroutines on PHP 8.4+
• Fix reads of streamed gzip and deflate responses waiting for 8 KiB of decoded data
• Fix stream handler accepting corrupt gzip and deflate response bodies

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^3.1.1

8.2.0 - 2026-09-06

Changed

• Allow connection caps to be combined with persistent transport sharing on libcurl 8.22.0+

8.1.0 - 2026-08-24

Added

• Add PHP 8.6+ stream TLS session sharing, while persistent sharing remains cURL-only

... (truncated)

Commits

• b920e5f Release 8.3.0
• 1e0396c Decode stream handler gzip and deflate bodies like libcurl (#3972)
• e3ec346 Replace the deprecated promises Is with State (#3975)
• 1b3c5d3 List 7.16 as the maintained 7.x version (#3979)
• 453adce Raise minimum psr7 version to 3.2 (#3980)
• 546e0b9 Merge branch '8.2' into 8.3
• 1113a54 Release 8.2.1
• f3a730e Raise minimum psr7 version (#3977)
• e7d15e7 Classify cURL errors 8 and 23 with a response as ResponseTransferException (#...
• 3a16833 End stream handler response bodies at their declared Content-Length (#3970)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependências. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[mariolucasdev]

Fechando — e o motivo é concreto, não precaução.

O CI reprovou em quatro jobs, mais o lint, com:

Call to undefined method GuzzleHttp\Exception\ConnectException::getHandlerContext()
  em RetryPolicy::neverSent()

No Guzzle 8 a ConnectException é uma classe vazia e esse acessor não existe mais. É exatamente o que a PHPay\Http\RetryPolicy usa para separar "não saiu da máquina" de "deu timeout depois de enviar o corpo" — e é essa distinção que impede repetir um POST que o gateway já processou, ou seja, cobrar o cliente duas vezes. Um bump que compila e perde essa checagem é pior que não subir.

Vale registrar o que não é o problema: os jobs de versão mínima passaram. A proposta foi ^7.3 || ^8.0, então o lowest e o job do 8.1 resolvem 7.x — não é piso de PHP, é API removida.

Suportar o Guzzle 8 é trabalho de código, não bump: achar o errno do cURL na API nova, reconfirmar o caminho do .p12 no mTLS e refazer os testes da política. Isso está em #121, para não se perder. O #120 acrescenta a regra de ignore para major do Guzzle; patch e minor continuam chegando.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.