Skip to content

Upgrading guzzlehttp/psr7 1 to 2

Breaking1.9.1 → 2.13.2Security8Platform1Deprecated12New11Changed20Fixed52Other1

Full comparisonBack to guzzlehttp/psr7
BreakingUpgrade verdict

A platform requirement change and 8 security fixes.

In plain terms
  • The library now works on PHP 8.6.
  • A security fix makes the host reported for a URI consistent with the URI's authority, closing a parsing inconsistency.
  • If the regular expression check on a request target or host fails, the request is now rejected rather than allowed through.
  • Blocks a way to sneak extra line breaks into parts of an HTTP message, which could be abused to smuggle requests.
Must act Top 5 of 21 that need code or config changes

PHP requirement changed in 2.0.0-beta1: >=5.4.0 → ^7.2.5 || ^8.0.

Adds psr/http-factory ^1.0, symfony/deprecation-contracts ^2.5 || ^3.0, symfony/polyfill-php80 ^1.25.

Moves psr/http-message ~1.0 → ^1.1 || ^2.0, ralouphie/getallheaders ^2.0.5 || ^3.0.0 → ^3.0. Your build may pick other versions.

What you must change

Security8
Validates the URI host so getHost() matches the URI authority.
getHost()Moderate · CVSS 4.2
2.12.3GitHub ReleaseSummarizedView source
Fails closed when PCRE validation fails for request targets and hosts.
2.12.2GitHub ReleaseSummarizedView source
Rejects CR/LF characters in the HTTP method, protocol version, and reason phrase.
Moderate · CVSS 4.8
2.12.1GitHub ReleaseSummarizedView source
Rejects control and whitespace characters in URI host components.
Moderate · CVSS 5.3
2.10.2GitHub ReleaseSummarizedView source
Rejects malformed Host values when constructing request URIs.
Moderate · CVSS 5.3
2.10.2GitHub ReleaseSummarizedView source
Hardens ServerRequest::fromGlobals() against malformed $_SERVER values.
ServerRequest::fromGlobals()$_SERVER
2.10.0GitHub ReleaseSummarizedView source
Improper header name validation in guzzlehttp/psr7
Moderate · CVSS 5.3
2.4.5GitHub AdvisoryOriginalView source
Improper Input Validation in guzzlehttp/psr7
Moderate · CVSS 5.3
2.1.1GitHub AdvisoryOriginalView source
Platform1
Adds support for PHP 8.6.
2.13.1GitHub ReleaseSummarizedView source

Deprecations to plan for

Deprecated12
Triggers a runtime deprecation for functionality previously deprecated in 2.3.0.
2.13.0GitHub ReleaseSummarizedView source
Deprecates non-finite float values in Query::build() that guzzlehttp/psr7 3.0 rejects.
Query::build()
2.12.0GitHub ReleaseSummarizedView source
Deprecates non-finite float multipart contents that guzzlehttp/psr7 3.0 rejects.
2.12.0GitHub ReleaseSummarizedView source
Deprecates non-string scalar bodies in Utils::streamFor(); cast them to a string for 3.0.
Utils::streamFor()
2.12.0GitHub ReleaseSummarizedView source
Deprecates non-string Uri::withQueryValues() values; cast them to a string for 3.0.
Uri::withQueryValues()
2.12.0GitHub ReleaseSummarizedView source
Deprecates invalid PSR-7 arguments that guzzlehttp/psr7 3.0 will require native types for.
2.11.0GitHub ReleaseSummarizedView source
Deprecates non-string header values that guzzlehttp/psr7 3.0 will reject.
2.11.0GitHub ReleaseSummarizedView source
Deprecates empty header value arrays that guzzlehttp/psr7 3.0 will reject.
2.11.0GitHub ReleaseSummarizedView source
Deprecates URI schemes that do not match guzzlehttp/psr7 3.0 syntax requirements.
2.11.0GitHub ReleaseSummarizedView source
Deprecates multipart boundary and custom part header metadata that guzzlehttp/psr7 3.0 will reject.
2.11.0GitHub ReleaseSummarizedView source
Deprecates reliance on automatic uppercasing of request methods; guzzlehttp/psr7 3.0 preserves method casing.
2.11.0GitHub ReleaseSummarizedView source
Deprecates invalid Utils::modifyRequest() change values that guzzlehttp/psr7 3.0 will reject.
Utils::modifyRequest()
2.11.0GitHub ReleaseSummarizedView source