7.14.0

Added

• Added the on_trailers request option to expose parsed HTTP response trailers
• Added the multiplex request option with Multiplexing::* modes to control or require HTTP/2 multiplexing
• Added rejection of explicit multiplex requests when CURLMOPT_PIPELINING disables multiplexing
• Added the max_host_connections and max_total_connections client and cURL multi handler options

Changed

• Redirects that discard the request body no longer require it to be rewindable
• Synchronous cURL multi handler requests no longer wait for other queued transfers
• Section SOCKS proxy connections by credentials on libcurl before 7.69.0
• Reject request-level CURLOPT_SHARE when combined with authenticated SOCKS proxy configuration
• Redact proxy userinfo containing raw control bytes in cURL errors
• Check linked curl/libcurl NTLM support before applying NTLM auth
• Clarify that NTLM is deprecated by both Guzzle and curl/libcurl
• Remove deprecation for the raw cURL CURLOPT_CERTINFO option
• Warn when a cURL multi option cannot be applied

Deprecated

• Deprecate the raw CURLOPT_PIPEWAIT cURL option in favour of the multiplex request option
• Deprecate unknown handler constructor options
• Deprecate invalid select_timeout cURL multi handler option values
• Deprecate raw cURL multi connection cap options in favour of the named options

7.13.3

Changed

• Adjusted guzzlehttp/promises version constraint to ^2.5.1
• Adjusted guzzlehttp/psr7 version constraint to ^2.12.4
• Pass explicit trim characters ahead of the PHP 8.6 trim default change

Fixed

• Stop matching cookie domains against hosts with a trailing newline
• Reject HTTP status codes and certificate type extensions with a trailing newline
• Treat PCRE engine failures as invalid cookie names during cookie validation
• Report PCRE engine failures when formatting log messages
• Report PCRE engine failures when splitting no_proxy values

7.13.2

Fixed

• Stop the cURL multi handler busy-waiting on request delays shorter than one second
• Stop cURL HEAD requests with request bodies hanging on responses that declare a content length
• The cURL handler no longer transmits request bodies on HEAD requests
• Preserve response headers when a response includes HTTP trailers
• Harden cURL response header block detection when HTTP trailers are received
• Corrected the PSR-7 class names in the Pool iterator exception
• Redirect body rewind failures no longer leak a bare RuntimeException

7.13.1

Fixed

• Allow middleware to rewrite partial URIs before transports validate them

7.13.0

Added

• Added the crypto_method_max request option to cap the maximum TLS protocol version
• Added HTTP QUERY redirect support, preserving method and body on 301 and 302

Changed

• Section proxy tunnel connection reuse by credential so distinct credentials never share a tunnel
• Isolate concurrent foreign cURL proxy tunnels added while another owner's tunnel is active
• Route credentialed HTTP(S) proxy Proxy-Authorization headers through cURL proxy header handling
• Reject request-level CURLOPT_SHARE when combined with authenticated HTTP/HTTPS proxy tunnel configuration
• Remove deprecation for raw cURL CURLOPT_PREREQFUNCTION callbacks when defined by PHP cURL
• Route TLS 1.2 crypto_method requests to the stream handler when cURL cannot select TLS 1.2
• Reject final request URIs missing a scheme or host before transfer

Deprecated

• Deprecate invalid protocols, force_ip_resolve, delay, cookies, and allow_redirects values

7.12.3

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.12.3

Security

• Treat IP and numeric cookie domains as exact-match-only (GHSA-g446-98w2-8p5w)

7.12.2

Fixed

• Clamp out-of-range Max-Age so a very large value no longer overflows to an already-expired timestamp
• Use strict comparison in CookieJar conflict resolution so distinct numeric-string names don't overwrite
• Store a cookie whose Domain has a trailing dot on the origin host instead of silently discarding it
• Fix StreamHandler hard-failing on bracketed IPv6 literal hosts when force_ip_resolve is set
• Use strict cookie Path comparison so CookieJar::clear() with a numeric path keeps a distinct-path cookie
• Fixed cookie handling for falsey Domain, Max-Age, path, and name values
• Fixed decode_content handling for falsey string values
• Fixed deprecated request option values reaching built-in handlers before normalization

7.12.1

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.12.1

Fixed

• Reject proxy URLs with a malformed scheme in the cURL handlers instead of letting libcurl mishandle them

Security

• Reject HTTPS proxies when the installed libcurl lacks HTTPS-proxy support (GHSA-wpwq-4j6v-78m3)
• Reject dot-only cookie Domain attributes as match-all (GHSA-cwxw-98qj-8qjx)

7.12.0

Added

• Added RequestOptions constants for curl, retries, and stream_context

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.12
• Constrain cURL transport sharing to safe libcurl DNS and SSL session support
• Resolve proxy environment variables in the cURL handlers; libcurl no longer reads the environment itself
• Ignore proxy environment variables when the proxy request option makes a decision
• Disable proxy environment variables on Windows SAPIs other than CLI (httpoxy hardening)
• Redact proxy credentials from cURL handler error messages, following Psr7\Utils::redactUserInfo()
• Normalize no-proxy domain and IP literal matching across the cURL and stream handlers

Deprecated

• Deprecated the request-level handler option, which will be ignored in 8.0
• Deprecated raw cURL request options outside the built-in cURL handlers' allow-list
• Deprecated the CURLOPT_PROXYTYPE cURL request option; set the proxy type via a scheme-prefixed proxy URL
• Deprecated PHP stream context options outside the built-in stream handler allow-list
• Deprecated passing ntlm as a built-in auth type
• Deprecated Utils::describeType()
• Deprecated non-finite floats in the query and form_params options; 8.0 rejects them
• Deprecated non-string scalar values in the body option; 8.0 rejects them

Fixed

• Fix cURL TLS and HTTP/2 capability detection using libcurl feature checks
• Fix proxy no list matches being re-proxied through environment-configured proxies by libcurl
• Fix no list and NO_PROXY matching to support IP CIDR ranges, matching libcurl
• Fix the stream handler not applying scheme-less proxies and their credentials

7.11.2

Fixed

• Fixed non-finite float values emitting coercion warnings on PHP 8.5