[dependabot]

Bumps guzzlehttp/psr7 from 2.13.1 to 3.1.0.

Release notes

Sourced from guzzlehttp/psr7's releases.

3.1.0

Added

• Add Utils::redactUriForMessage() and Utils::redactUriStringForMessage() for URI diagnostics
• Add support for PHP 8.6

Changed

• Omit rejected header values and sensitive URI components from automatic exception messages

3.0.1

Fixed

• Prefix relative paths that begin with a colon segment with ./ instead of throwing
• Apply the /. prefix for authority-less // paths to percent-encoding normalizations as well
• Keep colon-leading first path segments when reading the paths of scheme-less non-native URIs
• Stop throwing when removing the default file host strands a // path, prefixing it with /.

3.0.0

Added

• Add DiagnosticValue::escape() to escape controls and malformed UTF-8 in diagnostics
• Add GuzzleHttp\Psr7\Exception\TimeoutException for timed-out stream operations
• Add GuzzleHttp\Psr7\Utils::redactUserInfoInString() to redact the userinfo of a raw URI string within text
• Promote GuzzleHttp\Psr7\Rfc3986 to public API with isValid*() predicates and canonicalizeIpv6()
• Add GuzzleHttp\Psr7\UriNormalizer::CANONICALIZE_IPV6_HOST to PRESERVING_NORMALIZATIONS

Changed

• Require psr/http-message:^2.0 and add native parameter and return types
• Require psr/http-factory:^1.1
• Reject native PHP serialization of stream implementations
• Preserve request method casing, except ServerRequest::fromGlobals() still uppercases
• Reject empty arrays and non-string values as header values
• Reject invalid uploaded file trees and invalid parsed body values
• Reject uploaded file specs missing tmp_name, size, or error
• Reject non-integer and negative uploaded file error values
• Reject invalid stream/upload sizes, buffer high-water marks, and dropping-stream limits
• Rewind seekable uploaded-file streams before copying in UploadedFile::moveTo()
• Reject negative read() lengths across all stream implementations
• Detect the + flag anywhere in a mode for Stream::isReadable()/isWritable()
• Reject empty strings returned by PumpStream source callables
• Discard buffered bytes on PumpStream close and detach
• Restore the original stream position after Message::bodySummary()
• Allow null for the Message::bodySummary() truncation length to use the default
• Validate LimitStream offset/limit and track non-seekable offset by bytes skipped
• Make FnStream close and detach terminal, calling close callbacks at most once
• Suppress exceptions from FnStream close callbacks during destructor cleanup
• Make CachingStream::close() idempotent, preserving remote cleanup after detach
• Do not move the CachingStream cursor when a SEEK_END target on an unknown-size stream is rejected

... (truncated)

Changelog

Sourced from guzzlehttp/psr7's changelog.

3.1.0 - 2026-08-24

Added

• Add Utils::redactUriForMessage() and Utils::redactUriStringForMessage() for URI diagnostics
• Add support for PHP 8.6

Changed

• Omit rejected header values and sensitive URI components from automatic exception messages

3.0.1 - 2026-08-24

Fixed

• Prefix relative paths that begin with a colon segment with ./ instead of throwing
• Apply the /. prefix for authority-less // paths to percent-encoding normalizations as well
• Keep colon-leading first path segments when reading the paths of scheme-less non-native URIs
• Stop throwing when removing the default file host strands a // path, prefixing it with /.

3.0.0 - 2026-07-20

Added

• Add DiagnosticValue::escape() to escape controls and malformed UTF-8 in diagnostics
• Add GuzzleHttp\Psr7\Exception\TimeoutException for timed-out stream operations
• Add GuzzleHttp\Psr7\Utils::redactUserInfoInString() to redact the userinfo of a raw URI string within text
• Promote GuzzleHttp\Psr7\Rfc3986 to public API with isValid*() predicates and canonicalizeIpv6()
• Add GuzzleHttp\Psr7\UriNormalizer::CANONICALIZE_IPV6_HOST to PRESERVING_NORMALIZATIONS

Changed

• Require psr/http-message:^2.0 and add native parameter and return types
• Require psr/http-factory:^1.1
• Reject native PHP serialization of stream implementations
• Preserve request method casing, except ServerRequest::fromGlobals() still uppercases
• Reject empty arrays and non-string values as header values
• Reject invalid uploaded file trees and invalid parsed body values
• Reject uploaded file specs missing tmp_name, size, or error
• Reject non-integer and negative uploaded file error values
• Reject invalid stream/upload sizes, buffer high-water marks, and dropping-stream limits
• Rewind seekable uploaded-file streams before copying in UploadedFile::moveTo()
• Reject negative read() lengths across all stream implementations
• Detect the + flag anywhere in a mode for Stream::isReadable()/isWritable()
• Reject empty strings returned by PumpStream source callables
• Discard buffered bytes on PumpStream close and detach
• Restore the original stream position after Message::bodySummary()
• Allow null for the Message::bodySummary() truncation length to use the default
• Validate LimitStream offset/limit and track non-seekable offset by bytes skipped
• Make FnStream close and detach terminal, calling close callbacks at most once

... (truncated)

Commits

• a3059ba Release 3.1.0
• cf5d5de Merge remote-tracking branch 'origin/3.0' into 3.1
• a7c1d4a Release 3.0.1
• 3698982 Add PHP 8.6 to the CI matrix and version guidance (#882)
• 4229885 Merge branch '3.0' into 3.1
• 086457f Prefix stranded file host paths with /. instead of throwing (#881)
• e7203cc Merge branch '3.0' into 3.1
• 130e5c4 Keep a colon-leading first path segment when reading scheme-less non-native U...
• 75010c3 Prefix relative paths that begin with a colon segment instead of throwing (#879)
• 98db496 Harden automatic exception diagnostics (#875)
• Additional commits viewable in compare view

[github-actions]

🐢 Performance warning.
It looks like the query count of the integration tests increased with this PR.
Database query count is now 9160 was 9041 (+1.31%)
Please check your code again. If you added a new test this can be expected and the base value in tests/Integration/base-query-count.txt can be increased.

[github-actions]

🐢 Performance warning.
It looks like the query count of the integration tests increased with this PR.
Database query count is now 9158 was 9041 (+1.29%)
Please check your code again. If you added a new test this can be expected and the base value in tests/Integration/base-query-count.txt can be increased.

[nickvergessen]

@dependabot rebase

[nickvergessen]

Cause: psr7 2.x depended on ralouphie/getallheaders, and that was the only package whose code Mozart copied into classmap_directory (lib/autoload/). psr7 3.x dropped
that dependency, so a fresh composer install no longer creates lib/autoload/. Your checkout only still had it because an old copy was left over from before the bump.
Two tools then fail on the missing path:

• psalm: Could not resolve config path to …/lib/autoload
• rector: The path "…/lib/autoload" does not exist.