Upgrading guzzlehttp/guzzle 6 to 7
Breaking6.5.8 → 7.16.1Security25Platform8Deprecated36New21Changed71Fixed112Other3
SecurityHigh · CVSS 7.2Rejects non-printable-ASCII and percent-escaped URI hosts and Host headers.GHSA-v5mv-p594-2x33 · CVE-2026-69246 ↗
BreakingUpgrade verdict
8 platform requirement changes and 24 security fixes.
In plain terms
- The library can now be used on PHP 8.6.
- The library now works on PHP 8.5.
- The library now works on PHP 8.4.
- The library can now be used on PHP 8.3.
Must act Top 5 of 68 that need code or config changes
PHP requirement changed in 7.2.0: >=5.5 → ^7.2.5 || ^8.0.
What you must change
Security24
Rejects non-printable-ASCII and percent-escaped URI hosts and Host headers.
HostHigh · CVSS 7.2Rejects request URI hosts that contain a URI authority delimiter.
High · CVSS 7.2Rejects numeric-looking URI hosts with trailing dots that read as IPv4 addresses.
High · CVSS 7.2Treats numeric-in-any-base and percent-escaped cookie domains as exact-match-only.
Moderate · CVSS 6.5Regenerates a derived Host header after client URI rewrites.
HostHigh · CVSS 7.2Preserves host-only cookie scope and requires explicit persistence markers.
Moderate · CVSS 5.9Bounds response cookie admission and generated Cookie headers.
CookieModerate · CVSS 5.3Excludes URI fragments from Referer headers generated for redirects.
RefererModerate · CVSS 5.9Sanitizes the cURL error text exposed through exception handler context.
Strengthens old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles.
CURLOPT_PRE_PROXYIsolates HTTP proxy tunnels from opaque shared connection caches.
Prevents first-class and proxy URL credentials from reaching origins (GHSA-94pj-82f3-465w).
Moderate · CVSS 5.3Treats IP and numeric cookie domains as exact-match-only.
Moderate · CVSS 4.7Rejects HTTPS proxies when the installed libcurl lacks HTTPS-proxy support (GHSA-wpwq-4j6v-78m3).
Moderate · CVSS 5.9Rejects dot-only cookie
Domain attributes as match-all (GHSA-cwxw-98qj-8qjx).DomainModerate · CVSS 5.8Disables proxy environment variables on Windows SAPIs other than CLI as httpoxy hardening.
Redacts proxy credentials from cURL handler error messages, following Psr7\Utils::redactUserInfo().
Psr7\Utils::redactUserInfo()CURLOPT_HTTPAUTH option not cleared on change of origin
High · CVSS 7.7Change in port should be considered a change in origin
High · CVSS 7.7Fix failure to strip Authorization header on HTTP downgrade
High · CVSS 7.5Failure to strip the Cookie header on change in host or HTTP downgrade
High · CVSS 7.5Cross-domain cookie leakage in Guzzle
High · CVSS 8.0Removes curl auth on cross-domain redirects to align with the Authorization HTTP header.
Rejects non-HTTP schemes in StreamHandler.
StreamHandlerPlatform8
Adds support for PHP 8.6.
Adds support for PHP 8.5.
Adds support for PHP 8.4.
Adds support for PHP 8.3.
Adds support for PHP 8.2.
Adds support for PHP 8.1.
Adds support for PHP 8.
Dropped PHP 5.x support.
Deprecations to plan for
Deprecated36
Triggers runtime deprecations for functionality previously deprecated in 7.1.0.
Deprecates Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions.
Utils::jsonDecode()Utils::jsonEncode()Deprecates passing CURLMOPT_PIPELINING in the cURL multi handler options array.
CURLMOPT_PIPELININGDeprecates passing CURLOPT_PROXYHEADER without cURL proxy header separation support.
CURLOPT_PROXYHEADERClarifies that NTLM is deprecated by both Guzzle and curl/libcurl.
Deprecates the raw
CURLOPT_PIPEWAIT cURL option in favour of the multiplex request option.CURLOPT_PIPEWAITmultiplexDeprecates unknown handler constructor options.
Deprecates invalid
select_timeout cURL multi handler option values.select_timeoutDeprecates raw cURL multi connection cap options in favour of the named options.
max_host_connectionsmax_total_connectionsDeprecates invalid protocols, force_ip_resolve, delay, cookies, and allow_redirects values.
force_ip_resolvedelaycookiesallow_redirectsDeprecates the request-level handler option, which will be ignored in 8.0.
handlerDeprecates raw cURL request options outside the built-in cURL handlers' allow-list.
Deprecates the CURLOPT_PROXYTYPE cURL request option; set proxy type via a scheme-prefixed proxy URL.
CURLOPT_PROXYTYPEDeprecates PHP stream context options outside the built-in stream handler allow-list.
Deprecates passing ntlm as a built-in auth type.
ntlmauthDeprecates Utils::describeType().
Utils::describeType()Deprecates non-finite floats in the query and form_params options; 8.0 rejects them.
queryform_paramsDeprecates non-string scalar values in the body option; 8.0 rejects them.
bodyDeprecates non-iterable
Pool request collections, which will be rejected in 8.0.PoolDeprecates non-uppercase easy request methods; 8.0 preserves method casing.
Deprecates non-string
headers request option values, which will be rejected in 8.0.headersDeprecates empty
headers request option value arrays, which will be rejected in 8.0.headersDeprecates empty and malformed request protocol versions, which will be rejected in 8.0.
Deprecates conflicting raw cURL request options, including
CURLOPT_SHARE, which will be rejected in 8.0.CURLOPT_SHAREDeprecates scalar-coerced
idn_conversion request option values, which will be rejected in 8.0.idn_conversionDeprecates invalid documented request option value types, which will be rejected in 8.0.
Deprecates selected request options ignored by incompatible built-in handlers, which will be rejected in 8.0.
Deprecates RequestException::wrapException(), which will be removed in 8.0.
RequestException::wrapException()Deprecates RetryMiddleware::exponentialDelay(), which will be removed in 8.0.
RetryMiddleware::exponentialDelay()Deprecates using environment variable GUZZLE_CURL_SELECT_TIMEOUT.
GUZZLE_CURL_SELECT_TIMEOUTDeprecates all functions in GuzzleHttp; use static methods on Utils instead.
GuzzleHttpUtilsDeprecates ClientInterface::getConfig().
ClientInterface::getConfig()Deprecates Client::getConfig().
Client::getConfig()Deprecates Client::__call().
Client::__call()Deprecates Utils::defaultCaBundle().
Utils::defaultCaBundle()Deprecates CurlFactory::LOW_CURL_VERSION_NUMBER.
CurlFactory::LOW_CURL_VERSION_NUMBER