[dependabot]

Updates the requirements on guzzlehttp/guzzle to permit the latest version.

Release notes

Sourced from guzzlehttp/guzzle's releases.

8.3.1

Fixed

• Fix CookieJar storing already expired cookies instead of removing the stored cookie
• Fix CookieJar ignoring a same-value cookie that changes its expiry or its Discard, Secure, or HttpOnly flag
• Fix SetCookie renewing the lifetime of Max-Age cookies rebuilt from an array, so persisted cookies never expired

Changelog

Sourced from guzzlehttp/guzzle's changelog.

8.3.1 - 2026-10-25

Fixed

• Fix CookieJar storing already expired cookies instead of removing the stored cookie
• Fix CookieJar ignoring a same-value cookie that changes its expiry or its Discard, Secure, or HttpOnly flag
• Fix SetCookie renewing the lifetime of Max-Age cookies rebuilt from an array, so persisted cookies never expired

8.3.0 - 2026-10-18

Changed

• Adjusted guzzlehttp/promises version constraint to ^3.1
• Adjusted guzzlehttp/psr7 version constraint to ^3.2
• Replace the deprecated Promise\Is with Promise\State for PHP 8.6
• Decode chunked stream handler bodies as they arrive, ending at the last chunk
• Reject truncated and malformed chunked stream handler bodies, like libcurl
• Reject unsupported response transfer codings, like libcurl 8.14+
• End stream handler bodies at their declared Content-Length, including 0
• Throw when a streamed body ends before its declared Content-Length
• Classify cURL errors 8 and 23 with a response as ResponseTransferException
• Reject stream handler gzip and deflate bodies with trailing data, like libcurl
• Accept raw deflate stream handler bodies, like libcurl

Fixed

• Fix streamed stream handler bodies delaying bytes that arrived with the headers

8.2.1 - 2026-10-18

Fixed

• Fix PHP 8.6 notices for oversized numeric hosts
• Fix delay values over 71 minutes
• Fix CurlMultiHandler delays over 71 minutes
• Fix overlapping stream handler requests sharing a deadline
• Fix stream handler responses in Swoole coroutines on PHP 8.4+
• Fix reads of streamed gzip and deflate responses waiting for 8 KiB of decoded data
• Fix stream handler accepting corrupt gzip and deflate response bodies

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^3.1.1

8.2.0 - 2026-09-06

Changed

... (truncated)

Commits

• 7d9b1f4 Release 8.3.1
• 2567cb4 Time only the attach in the ticking delayed request test (#3994)
• 89f4293 Keep the stored expiry when rebuilding Max-Age cookies (#3991)
• 3236dc4 Replace same-value cookies whose expiry or flags change (#3990)
• 0b3016c Drop expired cookies instead of storing them (#3987)
• b920e5f Release 8.3.0
• 1e0396c Decode stream handler gzip and deflate bodies like libcurl (#3972)
• e3ec346 Replace the deprecated promises Is with State (#3975)
• 1b3c5d3 List 7.16 as the maintained 7.x version (#3979)
• 453adce Raise minimum psr7 version to 3.2 (#3980)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[samaxbytez]

Superseded by the PR that allows ^7.5 || ^8.3. Requiring only Guzzle 8 would break installs still on Guzzle 7, and Guzzle 8's exception changes needed code changes too.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.