[dependabot]

Bumps azjezz/psl from 4.2.0 to 6.3.0.

Release notes

Sourced from azjezz/psl's releases.

Hevlaska 6.3.0

PSL 6.3.0

This release adds Type\numeric(), fixes HTTP header validation, and updates the documentation site.

Type System

• Type\numeric(): A new type for integers, floats, and numeric strings. It preserves the input’s type, so numeric strings remain strings. Coercion also accepts Stringable objects whose string value is numeric. (by @​gsteel in #793)

use Psl\Type;
Type\numeric()->assert(42);     // 42
Type\numeric()->assert(3.14);   // 3.14
Type\numeric()->assert('1.23'); // '1.23'

Fixes

• HTTP\Client: Validates all Transfer-Encoding response fields, including repeated fields. Invalid or unsupported transfer codings now raise a ProtocolException instead of falling back to Content-Length. Valid chunked responses still take precedence over Content-Length. (by @​azjezz in #806)
• HTTP\Client and H2: Reject conflicting Content-Length fields in HTTP/1.1 responses and HTTP/2 headers while accepting identical duplicates. (by @​azjezz in #800)
• Dict\diff(): Corrects the PHPDoc value type bound to scalar|null|resource|Stringable, matching the string conversion used for comparisons. Runtime behavior is unchanged. (by @​azjezz in #796)

Documentation

• Static pages: The documentation site now serves pre-rendered HTML pages. (by @​veewee in #782)
• Section permalinks: Added direct links to section headings (by @​erikgaal in #784), with GitHub-style anchors on hover (by @​veewee in #785).
• Deployment: Documentation builds now preserve the custom domain across deployments and rebuilds. (by @​veewee in #783)
• Iter\last_key_opt(): Corrected the description to say that the function returns the last key. (by @​klifoth in #803)
• Compression guide: Fixed heading formatting. (by @​94noni in #801)

---

Install: composer require php-standard-library/php-standard-library:^6.3

---

New Contributors

• @​erikgaal made their first contribution in php-standard-library/php-standard-library#784
• @​NickSdot made their first contribution in php-standard-library/php-standard-library#790
• @​94noni made their first contribution in php-standard-library/php-standard-library#801

Full Changelog: php-standard-library/php-standard-library@6.2.1...6.3.0

Hevlaska 6.2.1

Security Release

This release fixes a server-side HTTP/2 vulnerability in the Psl\H2 component (GHSA-pw9p-jvrm-f7rm).

... (truncated)

Changelog

Sourced from azjezz/psl's changelog.

6.3.0

features

• feat(type): add numeric type - #793 by @​gsteel

fixes

• fix(http-client): validate all Transfer-Encoding response fields and reject invalid or unsupported transfer codings instead of falling back to Content-Length - #806
• fix(type): allow interface names in Type\class_string() when no class is specified - #802

6.2.1

security

• fix(h2): validate content-length header against received DATA on server connections, preventing HTTP/2 request smuggling on Psl\H2\ServerConnection (GHSA-pw9p-jvrm-f7rm)

6.2.0

features

• feat(either-or-both): introduce EitherOrBoth component - a three-variant disjoint union (Left / Right / Both) for values that may be present on either or both of two sides, inspired by Rust's itertools::EitherOrBoth and Haskell's Data.These. Primary use case: three-way diff of two collections (insert / delete / update events). Secondary: layered config merge, multi-source enrichment, dual-validation, snapshot comparison. Full map / mapLeft / mapRight / mapAny / swap / proceed / apply / containsLeft / containsRight surface; left() / right() / both() free constructors.
• feat(iter): add Iter\merge_join_by and Iter\merge_join_by_key - full-outer-join stream producers that yield EitherOrBoth events as a rewindable Iter\Iterator. merge_join_by is a lazy two-cursor merge over sorted inputs (O(1) memory on first traversal, Psl\Comparison\Order-returning comparator, matching Rust's itertools::merge_join_by); merge_join_by_key is a hash-based variant for keyed inputs that do not need to be pre-sorted (O(|right|) memory).
• feat(io): add IO\IterableReadHandle - a streaming ReadHandleInterface that lazily consumes an iterable<string> without buffering the entire content in memory
• feat(io): add IO\ConcatReadHandle - reads from two handles in sequence, switching to the second when the first reaches EOF
• feat(io): add IO\JoinedReadWriteHandle - joins a ReadHandleInterface and WriteHandleInterface into a single read-write handle, delegating all operations to the respective underlying handle
• feat(io): add IO\TeeWriteHandle - writes to two handles simultaneously with backpressure buffering when the second handle is slower
• feat(io): add IO\SinkWriteHandle - a /dev/null-like write handle that discards all written data
• feat(io): add IO\SinkReadHandle - a read handle that is always at EOF, unlike MemoryHandle('') which only reports EOF after the first read
• feat(io): add IO\SinkReadWriteHandle - a sink that discards writes and always reports EOF on reads
• feat(io): add IO\TruncatedReadHandle - reads up to N bytes from an underlying handle, silently reporting EOF when the limit is reached
• feat(io): add IO\BoundedReadHandle - reads up to N bytes from an underlying handle, throwing RuntimeException if the underlying handle has more data than the limit allows
• feat(io): add IO\FixedLengthReadHandle - reads exactly N bytes from an underlying handle, throwing RuntimeException on premature EOF
• feat(io): add IO\copy_chunked() and IO\copy_bidirectional_chunked() - variants of IO\copy() and IO\copy_bidirectional() that accept a custom chunk size
• feat(http-client): add SendConfiguration::$connectionTimeout - per-request maximum duration for establishing a connection (TCP + TLS handshake), using a linked cancellation token
• feat(type): support 'true'/'false' string literals in Type\bool() coercion - #735 by @​verweto
• feat(mime): introduce MIME component - comprehensive MIME toolkit implementing RFC 2045-2049 and related standards
  • Media type parsing, validation, and content negotiation (MediaType, MediaRange, MediaPreferences) per RFC 2045, RFC 6838, RFC 9110
  • MIME part construction with automatic transfer encoding (Part\Text, Part\Data) per RFC 2045
  • Streaming multipart body construction and parsing (MultiPart\Composite, MultiPart\Alternative, MultiPart\Related, MultiPart\Form, MultiPart\Parser) per RFC 2046, RFC 2387, RFC 7578
  • Immutable header collection with RFC 5322 line folding (Headers)
  • Content-Disposition parsing with safe filename extraction (ContentDisposition) per RFC 2183
  • Content-ID parsing, generation, and cid: URI support (ContentId) per RFC 2392
  • RFC 2231 parameter encoding/decoding with continuations and charset conversion (Parameters)
  • Content sniffing from bytes and seekable handles (Sniff\from_string, Sniff\from_handle)
  • S/MIME signing, verification, encryption, and decryption (SMIME\Signer, SMIME\Verifier, SMIME\Encryptor, SMIME\Decryptor) per RFC 5652, RFC 8551
  • DKIM message signing with RSA-SHA256 and Ed25519-SHA256 (DKIM\Signer) per RFC 6376, RFC 8301, RFC 8463
• feat(message): introduce Message component - RFC 5322 internet message construction, parsing, and serialization
  • Typed header fields with fluent with*() methods (Message) per RFC 5322
  • Address methods accept string|Mailbox|AddressList for convenience

... (truncated)

Commits

• 13f1ca9 release: 6.3.0 (#808)
• ce45f7e chore: update changelog (#807)
• 657c352 fix(http-client): validate all transfer-encoding response fields (#806)
• 267611a chore: update dependencies (#805)
• cc58fb9 fix last_key_opt phpdoc (#803)
• 5a8d651 fix(docs): Update header formatting in compression.md (#801)
• 525f3e4 fix(h2): reject conflicting content-length header fields (#800)
• 25e14fe chore(deps): update mago to the latest version (#799)
• 6648b7d chore(deps): update mago to the latest version (#798)
• d3bd5e1 chore(mime): remove redundant comparison (#797)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)