Http Laravel Package

What's Changed

• Added support for PHP 8.4 by @Bilge in https://github.com/amphp/http/pull/29

Full Changelog: https://github.com/amphp/http/compare/v2.1.1...v2.1.2

What's Changed

• Security: Fix Denial of Service via HTTP/2 CONTINUATION Frames by @kelunik

References

• https://github.com/amphp/http/security/advisories/GHSA-qjfw-cvjf-f4fm
• https://kb.cert.org/vuls/id/421644

Full Changelog: https://github.com/amphp/http/compare/v2.1.0...2.1.1

What's Changed

• Security: Fix Denial of Service via HTTP/2 CONTINUATION Frames by @kelunik

References

• https://github.com/amphp/http/security/advisories/GHSA-qjfw-cvjf-f4fm
• https://kb.cert.org/vuls/id/421644

Full Changelog: https://github.com/amphp/http/compare/v1.7.2...v1.7.3

What's Changed

• Make implicit nullable types explicit by @nicolas-grekas in https://github.com/amphp/http/pull/28

Full Changelog: https://github.com/amphp/http/compare/v1.7.1...v1.7.2

• Updated league/uri-components requirements to ^2.4.2 | ^7.1 as part of fixing #24 and allow psr/message@v2
• Changed request query string encoding to use RFC3986 rules to as part of fixing #24

Full Changelog: https://github.com/amphp/http/compare/v2.0.0...v2.1.0

• PHP 8.1 is now required
• Renamed Status and Message to HttpStatus and HttpMessage respectively
• Added a message parameter to Http2Processor::handleShutdown()
• Http2Parser constructor now requires an HPack instance to be injected, as well as providing parameters for upgrade settings, header size limit, and frame size limits
• Http2Parser::parse() was removed; Http2Parser now has a push() and cancel() methods to push received data and end parsing
• Added HttpRequest and HttpResponse as abstract base classes for requests and responses
• HttpRequest now includes methods for getting and setting query parameters
• Moved Rfc7230 to Http1 sub-namespace.
• Renamed header methods using the term "raw" to use "pairs" instead, e.g., getRawHeaders() → getHeaderPairs(), parseRawHeaders() → parseHeaderPairs()
• Added mapHeaderPairs() function to convert header pairs returned from functions such as Rfc7230::parseHeaderPairs() into a map similar to that returned by Rfc7230::parseHeaders()
• Passing an int, float, or Stringable as an array value to HttpMessage::setHeaders() will cast the value to a string instead of throwing a TypeError
• Removed parseFieldValueComponents() and createFieldValueComponentMap(), replacing them with four new functions:
  • splitHeaders() — Splits comma-separated fields into individual components. Returns null if a syntax error is encountered.
  • parseMultipleHeaderFields() — Parses a list of key-value pairs from each comma-separated and semi-colon delineated header value. Returns null if a syntax error is encountered.
  • parseSingleHeaderFields() — Parses a single semi-colon delineated header into key-value pairs.
  • parseHeaderTokens() — Parses a list of tokens from comma-separated header values.

Removed parseFieldValueComponents() and createFieldValueComponentMap(), replacing them with three new functions:

• splitHeaders() — Splits comma-separated fields into individual components. Returns null if a syntax error is encountered.
• parseMultipleHeaderFields() — Parses a list of key-value pairs from each comma-separated and semi-colon delineated header value. Returns null if a syntax error is encountered.
• parseSingleHeaderFields() — Parses a single semi-colon delineated header into key-value pairs.

• Added HttpRequest and HttpResponse as abstract base classes for requests and responses. HttpRequest includes methods for getting and setting query parameters
• Moved Rfc7230 to Http1 sub-namespace.
• Renamed header methods using the term "raw" to use "pairs" instead, e.g., getRawHeaders() → getHeaderPairs(), parseRawHeaders() → parseHeaderPairs()
• Added convertHeaderPairsToMap() function to convert header pairs returned from functions such as Rfc7230::parseHeaderPairs() into a map similar to that returned by Rfc7230::parseHeaders().
• Passing an int, float, or Stringable as an array value to HttpMessage::setHeaders() will cast the value to a string instead of throwing a TypeError.

• PHP 8.1 is now required
• Renamed Status and Message to HttpStatus and HttpMessage respectively. Aliases of the old names to the new names exist in this beta version, but may be removed before the stable release
• Added a message parameter to Http2Processor::handleShutdown()
• Http2Parser constructor now requires an HPack instance to be injected, as well as providing parameters for upgrade settings, header size limit, and frame size limits
• Http2Parser::parse() was removed; Http2Parser now has a push() and cancel() methods to push received data and end parsing

• Fixed header validation regex to allow names containing *, +, and . (#19)

• Expose frame and byte count metrics in Http2Parser
• Reduce strtolower calls, improving performance
• Relax parsing strictness for request cookies to ignore empty trailing semicolons (https://github.com/amphp/http/pull/18)

• Removed flood protection from Http2Parser It's not the task of a parser to apply policy decisions. Additionally, the current policy doesn't work correctly in all normal situations, e.g. larger uploads will trigger this in the client, because the server will send many window increments before sending any payload bytes.

• Fixed GOAWAY frames breaking the parser loop, no longer processing other frames.

• Fixed broken symlink (#16)

• Added Http2Parser that parses HTTP/2 frames, calling methods on a class implementing Http2Processor.
• Added Message::getRawHeaders() to expose the original casing of headers. The API is limited to a single method returning all headers, as applications should never depend on the header casing as defined by the HTTP RFCs.
• Added Rfc7230::parseRawHeaders()
• Added Rfc7230::formatRawHeaders()

• Added Http2Parser that parses HTTP/2 frames, calling methods on a class implementing Http2Processor.

• Added formatDateHeader()

• Added support for the SameSite attribute (#10)

• Increased minimum PHP version to 7.1
• Added parseFieldValueComponents
• Added createFieldValueComponentMap

• Added support for legacy date formats in ResponseCookie parsing (#6)
• Added mutation methods to RequestCookie and ResponseCookie
• Unknown cookie attributes are now preserved in ResponseCookie (#2, #3)

• Added Message class to be used as a base-class for HTTP messages.

• Security: Reject header injections correctly, see #4.

Initial release.