Upgrading guzzlehttp/guzzle 7 to 8
Breaking7.16.1 → 8.3.1Breaking25Security16Platform2Deprecated1New16Changed125Fixed22Other2
BreakingUpgrade verdict
25 breaking changes and 2 platform requirement changes and 16 security fixes.
In plain terms
- NTLM can no longer be selected through the auth request option.
- Removes Client::__call(); use the typed HTTP verb methods or request()/requestAsync().
- Removes ClientInterface::getConfig(); the concrete Client::getConfig() remains available.
- Removes support for the GUZZLE_CURL_SELECT_TIMEOUT environment variable; use CurlMultiHandler's select_timeout option.
Must act Top 5 of 44 that need code or config changes
PHP requirement changed in 8.0.0: ^7.2.5 || ^8.0 → ^7.4 || ^8.0.
Adds psr/http-factory ^1.0, symfony/polyfill-php82 ^1.27.
Drops symfony/deprecation-contracts.
Moves guzzlehttp/promises ^2.6 → ^3.1, guzzlehttp/psr7 ^2.13.2 → ^3.2. Your build may pick other versions.
What you must change
Breaking25
Removes first-class NTLM authentication from the auth request option.
authRemoves Client::__call(); use the typed HTTP verb methods or request()/requestAsync().
Client::__call()request()requestAsync()Removes ClientInterface::getConfig(); the concrete Client::getConfig() remains available.
ClientInterface::getConfig()Client::getConfig()Removes support for the GUZZLE_CURL_SELECT_TIMEOUT environment variable; use CurlMultiHandler's select_timeout option.
GUZZLE_CURL_SELECT_TIMEOUTCurlMultiHandlerselect_timeoutRemoves support for the handler request option; configure the handler on the client.
handlerRemoves direct access to CurlMultiHandler::$_mh; pass CURLMOPT_* values through constructor options instead.
CurlMultiHandler::$_mhCURLMOPT_*optionsRemoves RedirectMiddleware::$defaultSettings; use RedirectMiddleware::DEFAULT_SETTINGS.
RedirectMiddleware::$defaultSettingsRedirectMiddleware::DEFAULT_SETTINGSRemoves the deprecated RetryMiddleware::exponentialDelay() method.
RetryMiddleware::exponentialDelay()Removes the deprecated RequestException::wrapException() method.
RequestException::wrapException()Removes the deprecated Utils::describeType() method.
Utils::describeType()Removes Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions.
Utils::jsonDecode()Utils::jsonEncode()Removes deprecated GuzzleHttp namespace functions in favor of native or class equivalents.
GuzzleHttpRemoves Utils::defaultCaBundle(); rely on the system trust store or pass a bundle path via the verify option.
Utils::defaultCaBundle()verifyRemoves HandlerStack::__toString().
HandlerStack::__toString()Removes RequestException::getHandlerContext() and ConnectException::getHandlerContext().
RequestException::getHandlerContext()ConnectException::getHandlerContext()Removes response access from RequestException; use ResponseException instead.
RequestExceptionResponseExceptionRemoves Utils::isHostInNoProxy(); use ProxyOptions helpers for Guzzle 8 no-proxy matching.
Utils::isHostInNoProxy()ProxyOptionsRemoves Utils::isUriInNoProxy(); use ProxyOptions::isUriInNoProxy().
Utils::isUriInNoProxy()ProxyOptions::isUriInNoProxy()Removes Handler\Proxy::wrapTlsFallback(); the default handler stack now picks the cURL or stream handler by TLS support.
Handler\Proxy::wrapTlsFallback()Throws RequestException, not InvalidArgumentException, for an unavailable proxy or TLS feature.
RequestExceptionInvalidArgumentExceptionRequires a request when constructing TransferException and its subclasses.
TransferExceptionMakes MessageFormatter final and requires Middleware::log() formatters to implement MessageFormatterInterface.
MessageFormatterMiddleware::log()MessageFormatterInterfaceMakes CurlFactory, CurlHandler, CurlMultiHandler, MockHandler, and StreamHandler final.
CurlFactoryCurlHandlerCurlMultiHandlerMockHandlerStreamHandlerMakes static utility classes non-instantiable and declares GuzzleHttp\Handler\Proxy final.
GuzzleHttp\Handler\ProxyPasses the request to on_trailers callbacks, rejects non-callable values, and wraps callback exceptions in ResponseException.
on_trailersResponseExceptionSecurity16
Hides URI credentials, queries, and fragments in automatic exception messages.
Rejects request URI hosts and Host header values that are not printable ASCII.
HostHigh · CVSS 7.2Rejects URI hosts containing a percent escape or that are not valid RFC 3986 hosts.
High · CVSS 7.2Rejects numeric-looking URI hosts with trailing dots that would be read as IPv4 addresses.
High · CVSS 7.2Treats percent-escaped cookie domains as exact-match-only.
Moderate · CVSS 6.5Regenerates a derived Host header after client URI rewrites.
HostHigh · CVSS 7.2Adds SensitiveParameter metadata to credential-bearing parameters so PHP 8.2+ redacts their values in exception traces.
SensitiveParameterRejects Secure cookies and insecure overlays received over insecure connections.
Enforces the __Secure- and __Host- prefix requirements on response cookies.
__Secure-__Host-Hardens FileCookieJar and SessionCookieJar persistence against unsafe unserialization.
FileCookieJarSessionCookieJarRejects native PHP serialization of runtime objects.
Restricts persisted FileCookieJar cookie files to owner-only permissions.
FileCookieJarRequires persisted cookie data to use JSON lists and constructs all records before changing the jar.
Stops forwarding the generic auth request option when following cross-origin redirects.
authLimits the Referer header to the origin on cross-origin redirects.
RefererEscapes controls and malformed UTF-8 when copying raw values into exception messages.
Platform2
Adds support for PHP 8.6.
Drops support for PHP 7.2 and 7.3.
Deprecations to plan for
Deprecated1
Replaces the deprecated Promise\Is with Promise\State for PHP 8.6.
Promise\IsPromise\State