Psr7 Laravel Package

Added

• Add Utils::redactUriForMessage() and Utils::redactUriStringForMessage() for URI diagnostics
• Add support for PHP 8.6

Changed

• Omit rejected header values and sensitive URI components from automatic exception messages

Fixed

• Prefix relative paths that begin with a colon segment with ./ instead of throwing
• Apply the /. prefix for authority-less // paths to percent-encoding normalizations as well
• Keep colon-leading first path segments when reading the paths of scheme-less non-native URIs
• Stop throwing when removing the default file host strands a // path, prefixing it with /.

Added

• Add DiagnosticValue::escape() to escape controls and malformed UTF-8 in diagnostics
• Add GuzzleHttp\Psr7\Exception\TimeoutException for timed-out stream operations
• Add GuzzleHttp\Psr7\Utils::redactUserInfoInString() to redact the userinfo of a raw URI string within text
• Promote GuzzleHttp\Psr7\Rfc3986 to public API with isValid*() predicates and canonicalizeIpv6()
• Add GuzzleHttp\Psr7\UriNormalizer::CANONICALIZE_IPV6_HOST to PRESERVING_NORMALIZATIONS

Changed

• Require psr/http-message:^2.0 and add native parameter and return types
• Require psr/http-factory:^1.1
• Reject native PHP serialization of stream implementations
• Preserve request method casing, except ServerRequest::fromGlobals() still uppercases
• Reject empty arrays and non-string values as header values
• Reject invalid uploaded file trees and invalid parsed body values
• Reject uploaded file specs missing tmp_name, size, or error
• Reject non-integer and negative uploaded file error values
• Reject invalid stream/upload sizes, buffer high-water marks, and dropping-stream limits
• Rewind seekable uploaded-file streams before copying in UploadedFile::moveTo()
• Reject negative read() lengths across all stream implementations
• Detect the + flag anywhere in a mode for Stream::isReadable()/isWritable()
• Reject empty strings returned by PumpStream source callables
• Discard buffered bytes on PumpStream close and detach
• Restore the original stream position after Message::bodySummary()
• Allow null for the Message::bodySummary() truncation length to use the default
• Validate LimitStream offset/limit and track non-seekable offset by bytes skipped
• Make FnStream close and detach terminal, calling close callbacks at most once
• Suppress exceptions from FnStream close callbacks during destructor cleanup
• Make CachingStream::close() idempotent, preserving remote cleanup after detach
• Do not move the CachingStream cursor when a SEEK_END target on an unknown-size stream is rejected
• Normalize multiple leading slashes in Uri::getPath() and origin-form request targets
• Serialize authority-less file URIs with rootless paths without the // separator
• Serialize authority-less file URIs with empty paths as file: instead of the unparseable file://
• Remove dot segments above the root per RFC 3986, prefixing authority-less // paths with /.
• Return a network-path reference from UriResolver::relativize() when an empty-path target requires one
• Stop returning an empty reference from UriResolver::relativize() when it would inherit the base fragment
• Stop throwing from UriResolver::relativize() when an equal-path target's last path segment contains a colon
• Harden URI host validation (delimiters, backslashes, IPv6, embedded ports); require schemes to start with a letter
• Validate Uri::fromParts() ports instead of casting them
• Treat ports 80 and 443 as defaults for the ws and wss schemes
• Use the ws and wss default ports in UriComparator::isCrossOrigin() port comparisons
• Redact all non-empty URI userinfo in Utils::redactUserInfo()
• Rebuild server request URIs from $_SERVER by REQUEST_METHOD, using target authority before SERVER_PORT
• Remove userinfo from absolute-form REQUEST_URI targets in ServerRequest::fromGlobals()
• Reject zero-port HTTP_HOST and malformed SERVER_PORT in ServerRequest::getUriFromGlobals()
• Reject malformed REQUEST_METHOD and SERVER_PROTOCOL server values in ServerRequest::fromGlobals()
• Reject zero-port Host and normalize leading-zero ports in Message::parseRequest()
• Reject duplicate Host headers and validate present values for all request-target forms
• Reject zero-port, hostless, and userinfo absolute-form request targets in Message::parseRequest()
• Synchronize the Host header in Request::withUri() when the URI changes or Host is empty
• Include the URI port in Host headers synthesized by Message::toString()
• Validate the Host header synthesized by Message::toString() from the request URI
• Include non-default URI ports in Host headers set by Utils::modifyRequest() URI changes
• Accept OPTIONS * and CONNECT authority-form request targets in Message::parseRequest()
• Hide credential-bearing URI, server, and cookie arguments in stack traces on PHP 8.2+
• Reject malformed HTTP request/response start-lines
• Unfold obsolete HTTP/1.0 line folding for all valid request method tokens
• Reject empty and control-character request targets in Request::withRequestTarget()
• Validate iterator chunks passed to Utils::streamFor()
• Validate unsupported values passed to Query::build()
• Reject non-finite float values in Query::build() and MultipartStream contents
• Reject non-finite float values in iterator chunks passed to Utils::streamFor()
• Utils::streamFor() now rejects non-string scalar bodies
• Uri::withQueryValues() now rejects non-string values
• Reject invalid Utils::modifyRequest() change values
• Use PHP debug type names in type error messages
• Changed Utils::copyToStream() to throw when destination streams cannot make progress
• Throw TimeoutException from Stream read/write and Utils copy/hash/readLine on stream timeouts
• Throw TimeoutException from AppendStream::read(), CachingStream::read(), and Utils::tryGetContents() on stream timeouts
• Re-throw TimeoutException from InflateStream when the decoded source stream times out
• Close the compressed source stream from InflateStream::close()
• Return the number of bytes copied from Utils::copyToStream()
• Throw OverflowException when stream byte counts or offsets exceed PHP_INT_MAX
• Translate StreamWrapper runtime failures to PHP stream failure values
• Stop adding default Content-Length to multipart/form-data parts (RFC 7578 §4.8)
• Escape multipart Content-Disposition parameters and reject unsafe boundaries and part headers
• Preserve trailing whitespace in custom MultipartStream part header values
• Preserve explicit custom MultipartStream boundary '0' instead of replacing it with a generated boundary
• Made static utility classes non-instantiable
• Validate bracketed IP-literal hosts consistently between parsing and withHost(), including userinfo forms
• Percent-encode raw control bytes in userinfo before bracketed IP-literal hosts instead of parsing mutated values
• Reject invalid UTF-8 and preserve percent-sequences in userinfo before bracketed IP-literal hosts
• Normalize percent-encoded octets in the URI host to uppercase hex
• Canonicalize IPv6 hosts to RFC 5952 form in Uri construction, fromParts(), and withHost()
• Canonicalize bracketed IPv6 hosts in UriComparator::isCrossOrigin()
• Reject malformed percent-sequences and percent-encoded bytes forbidden by the URI host policy
• Extend CAPITALIZE_PERCENT_ENCODING and DECODE_UNRESERVED_CHARACTERS to userinfo and host
• Trim header list elements with only spaces, horizontal tabs, and line terminators in Header::splitList()
• Report header parameter PCRE failures explicitly in Header::parse()
• Escape controls and malformed UTF-8 consistently in generated exception messages

Removed

• Dropped support for PHP 7.2 and 7.3
• Removed the ralouphie/getallheaders dependency
• Removed deprecated Header::normalize() method

Added

• Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

• Use locale-independent ASCII case folding everywhere case is normalized
• Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

Fixed

• Compare header names and hosts with locale-independent ASCII lowercasing
• Compare hosts without locale sensitivity when detecting cross-origin redirects

Changed

• Pass explicit trim characters ahead of the PHP 8.6 trim default change

Fixed

• Anchor server port and response start-line patterns to the true end of input
• Treat host-less origin-form request targets starting with // as paths in Message::parseRequest()
• Reject raw DEL bytes in bracketed IP-literal hosts instead of parsing a mutated host
• Reject invalid bytes after a bracketed IP-literal host instead of reparsing a different host

Security

• Validate the URI host so getHost() matches the URI authority (GHSA-c2w2-prh8-qm98)

Fixed

• Report URI parsing, filtering, and normalization PCRE failures explicitly
• Report HTTP message parser PCRE failures explicitly
• Fail closed when PCRE validation fails for request targets and hosts

Security

• Reject CR/LF in HTTP method, protocol version, and reason phrase (GHSA-vm85-hxw5-5432)

Deprecated

• Deprecated non-finite float values in Query::build() that guzzlehttp/psr7 3.0 rejects
• Deprecated non-finite float multipart contents that guzzlehttp/psr7 3.0 rejects
• Deprecated non-string scalar bodies in Utils::streamFor(); cast them to a string for 3.0
• Deprecated non-string Uri::withQueryValues() values; cast them to a string for 3.0

Fixed

• Fixed non-finite float values emitting coercion warnings on PHP 8.5

Changed

• Changed Utils::modifyRequest() to reject conflicting URI and Host header changes in the same call
• Changed Header::parse() to split semicolon-separated parameters without repeated regular expression lookaheads
• Changed UriComparator::isCrossOrigin() so only HTTP and HTTPS missing ports receive implicit default ports

Deprecated

• Deprecated invalid PSR-7 arguments that guzzlehttp/psr7 3.0 will require native types for
• Deprecated non-string header values that guzzlehttp/psr7 3.0 will reject
• Deprecated empty header value arrays that guzzlehttp/psr7 3.0 will reject
• Deprecated URI schemes that do not match guzzlehttp/psr7 3.0 syntax requirements
• Deprecated multipart boundary and custom part header metadata that guzzlehttp/psr7 3.0 will reject
• Deprecated reliance on automatic uppercasing of request methods; guzzlehttp/psr7 3.0 preserves method casing
• Deprecated invalid Utils::modifyRequest() change values that guzzlehttp/psr7 3.0 will reject

Fixed

• Fixed Utils::copyToStream() to retry short destination writes instead of dropping the unwritten remainder
• Fixed Header::parse() splitting of semicolon-separated parameters with escaped quotes

Fixed

• Apply UriNormalizer percent-encoding normalizations to URI fragments
• Make LimitStream::getSize() return 0 for slices past the underlying stream end
• Make AppendStream::read() return an empty string when no streams are attached
• Make CachingStream::read() throw on an incomplete cache-target write instead of silently corrupting replays
• Prevent CachingStream::seek() from looping indefinitely when the remote stream makes no progress

Fixed

• Fixed URI parsing for IPv6 literals containing embedded IPv4 addresses
• Fixed malformed UTF-8 URI strings being parsed as empty URIs

Security

• Reject control and whitespace characters in URI host components (GHSA-hq7v-mx3g-29hw)
• Reject malformed Host values when constructing request URIs (GHSA-34xg-wgjx-8xph)

Fixed

• Make ServerRequest::fromGlobals() robust against unexpected HTTP header value types in $_SERVER

Fixed

• Fix Utils::modifyRequest() with numeric header names

Fixed

• Fix parsing of relative path references containing a colon in a non-initial path segment
• Fix CachingStream::detach() returning an incomplete resource before the decorated stream has been fully read
• Fix Message::bodySummary() returning null when truncating printable UTF-8 bodies inside a multibyte character

Changed

• Harden ServerRequest::fromGlobals() against malformed $_SERVER values
• Prevent custom stream metadata from affecting internal size handling
• Throw when StreamWrapper::getResource() cannot create a resource
• Preserve custom request implementations in Utils::modifyRequest()
• Preserve custom URI implementations in UriResolver::resolve()
• Make Uri::__toString() side-effect-free

Added

• Added nested array expansion support to MultipartStream
• Added [@return](https://github.com/return) static to MessageTrait methods

Changed

• Updated MIME type mappings

Fixed

• Encode + signs in Uri::withQueryValue() and Uri::withQueryValues() to prevent them being interpreted as spaces

Added

• Allow empty lists as header values

Changed

• PHP 8.5 support

Fixed

• Fixed uppercase IPv6 addresses in URI

Changed

• Improve uploaded file error message

Added

• Add Utils::redactUserInfo() method
• Add ability to encode bools as ints in Query::build

Fixed

• Make StreamWrapper::stream_stat() return false if inner stream's size is null

Changed

• PHP 8.4 support

Fixed

• Fixed another issue with the fact that PHP transforms numeric strings in array keys to ints

Changed

• Updated links in docs to their canonical versions
• Replaced call_user_func* with native calls

Fixed

• Properly handle the fact that PHP transforms numeric strings in array keys to ints

Changed

• Updated the mime type map to add some new entries, fix a couple of invalid entries, and remove an invalid entry
• Fallback to application/octet-stream if we are unable to guess the content type for a multipart file upload

Fixed

• Corrected mime type for .acc files to audio/aac

Changed

• PHP 8.3 support

Changed

• Adjusted psr/http-message version constraint to ^1.1 || ^2.0

Fixed

• Prevent possible warnings on unset variables in ServerRequest::normalizeNestedFileSpec
• Fixed Message::bodySummary when preg_match fails
• Fixed header validation issue

Changed

• Removed the need for AllowDynamicProperties in LazyOpenStream

Changed

• Replaced sha1(uniqid()) by bin2hex(random_bytes(20))

Fixed

• Fixed erroneous behaviour when combining host and relative path

Fixed

• Rewind body before reading in Message::bodySummary

Added

• Added provisional PHP 8.2 support
• Added UriComparator::isCrossOrigin method

Fixed

• Added Header::splitList method
• Added Utils::tryGetContents method
• Improved Stream::getContents method
• Updated mimetype mappings

Fixed

• Fix Message::parseRequestUri for numeric headers
• Re-wrap exceptions thrown in fread into runtime exceptions
• Throw an exception when multipart options is misformatted

Fixed

• Correct header value validation

Added

• A more compressive list of mime types
• Add JsonSerializable to Uri
• Missing return types

Fixed

• Bug MultipartStream no uri metadata
• Bug MultipartStream with filename for data:// streams
• Fixed new line handling in MultipartStream
• Reduced RAM usage when copying streams
• Updated parsing in Header::normalize()

Fixed

• Validate header values properly

Changed

• Attempting to create a Uri object from a malformed URI will no longer throw a generic InvalidArgumentException, but rather a MalformedUriException, which inherits from the former for backwards compatibility. Callers relying on the exception being thrown to detect invalid URIs should catch the new exception.

Fixed

• Return null in caching stream size if remote size is null

Identical to the RC release.

Fixed

• Handle possibly unset url in stream_get_meta_data

Added

• PSR-17 factories
• Made classes final
• PHP7 type hints

Changed

• When building a query string, booleans are represented as 1 and 0.

Removed

• PHP < 7.2 support
• All functions in the GuzzleHttp\Psr7 namespace

Fixed

• Issue parsing IPv6 URLs
• Issue modifying ServerRequest lost all its attributes

Added

• Locale independent URL parsing
• Most classes got a [@final](https://github.com/final) annotation to prepare for 2.0

Fixed

• Issue when creating stream from php://input and curl-ext is not installed
• Broken Utils::tryFopen() on PHP 8

Added

• Replaced functions by static methods

Fixed

• Converting a non-seekable stream to a string
• Handle multiple Set-Cookie correctly
• Ignore array keys in header values when merging
• Allow multibyte characters to be parsed in Message:bodySummary()

Changed

• Restored partial HHVM 3 support

Fixed

• Accept null and bool header values again

Added

• Allowed version ^3.0 of ralouphie/getallheaders dependency (#244)
• Added MIME type for WEBP image format (#246)
• Added more validation of values according to PSR-7 and RFC standards, e.g. status code range (#250, #272)

Changed

• Tests don't pass with HHVM 4.0, so HHVM support got dropped. Other libraries like composer have done the same. (#262)
• Accept port number 0 to be valid (#270)

Fixed

• Fixed subsequent reads from php://input in ServerRequest (#247)
• Fixed readable/writable detection for certain stream modes (#248)
• Fixed encoding of special characters in the userInfo component of an URI (#253)

Fixed

• Check body size when getting the message summary

Fixed

• Get the summary of a body only if it is readable

Added

• Response first-line to response string exception (fixes #145)
• A test for #129 behavior
• get_message_body_summary function in order to get the message summary
• 3gp and mkv mime types

Changed

• Clarify exception message when stream is detached

Deprecated

• Deprecated parsing folded header lines as per RFC 7230

Fixed

• Fix AppendStream::detach to not close streams
• InflateStream preserves isSeekable attribute of the underlying stream
• ServerRequest::getUriFromGlobals to support URLs in query parameters

Several other fixes and improvements.

Fixed

• Reverted BC break to Uri::resolve and Uri::removeDotSegments by removing calls to trigger_error when deprecated methods are invoked.

Added

• Rriggering of silenced deprecation warnings.

Fixed

• Reverted BC break by reintroducing behavior to automagically fix a URI with a relative path and an authority by adding a leading slash to the path. It's only deprecated now.

Added

• Added common URI utility methods based on RFC 3986 (see documentation in the readme):
  • Uri::isDefaultPort
  • Uri::isAbsolute
  • Uri::isNetworkPathReference
  • Uri::isAbsolutePathReference
  • Uri::isRelativePathReference
  • Uri::isSameDocumentReference
  • Uri::composeComponents
  • UriNormalizer::normalize
  • UriNormalizer::isEquivalent
  • UriResolver::relativize

Changed

• Ensure ServerRequest::getUriFromGlobals returns a URI in absolute form.
• Allow parse_response to parse a response without delimiting space and reason.
• Ensure each URI modification results in a valid URI according to PSR-7 discussions. Invalid modifications will throw an exception instead of returning a wrong URI or doing some magic.
  • (new Uri)->withPath('foo')->withHost('example.com') will throw an exception because the path of a URI with an authority must start with a slash "/" or be empty
  • (new Uri())->withScheme('http') will return 'http://localhost'

Deprecated

• Uri::resolve in favor of UriResolver::resolve
• Uri::removeDotSegments in favor of UriResolver::removeDotSegments

Fixed

• Stream::read when length parameter <= 0.
• copy_to_stream reads bytes in chunks instead of maxLen into memory.
• ServerRequest::getUriFromGlobals when Host header contains port.
• Compatibility of URIs with file scheme and empty host.

Fixed

• Uri::__toString for network path references, e.g. //example.org.
• Missing lowercase normalization for host.
• Handling of URI components in case they are '0' in a lot of places, e.g. as a user info password.
• Uri::withAddedHeader to correctly merge headers with different case.
• Trimming of header values in Uri::withAddedHeader. Header values may be surrounded by whitespace which should be ignored according to RFC 7230 Section 3.2.4. This does not apply to header names.
• Uri::withAddedHeader with an array of header values.
• Uri::resolve when base path has no slash and handling of fragment.
• Handling of encoding in Uri::with(out)QueryValue so one can pass the key/value both in encoded as well as decoded form to those methods. This is consistent with withPath, withQuery etc.
• ServerRequest::withoutAttribute when attribute value is null.

Added

• Remaining interfaces needed for full PSR7 compatibility (ServerRequestInterface, UploadedFileInterface, etc.).
• Support for stream_for from scalars.

Changed

• Can now extend Uri.

Fixed

• A bug in validating request methods by making it more permissive.

Fixed

• Support in GuzzleHttp\Psr7\CachingStream for seeking forward on remote streams, which can sometimes return fewer bytes than requested with fread.
• Handling of gzipped responses with FNAME headers.

Added

• Support for URIs without any authority.
• Support for HTTP 451 'Unavailable For Legal Reasons.'
• Support for using '0' as a filename.
• Support for including non-standard ports in Host headers.

Changes

• Now supporting negative offsets when seeking to SEEK_END.

Changed

• Body as "0" is now properly added to a response.
• Now allowing forward seeking in CachingStream.
• Now properly parsing HTTP requests that contain proxy targets in parse_request.
• functions.php is now conditionally required.
• user-info is no longer dropped when resolving URIs.

Changed

• URIs can now be relative.
• multipart/form-data headers are now overridden case-insensitively.
• URI paths no longer encode the following characters because they are allowed in URIs: "(", ")", "*", "!", "'"
• A port is no longer added to a URI when the scheme is missing and no port is present.

Initial release.

Currently unsupported:

• Psr\Http\Message\ServerRequestInterface
• Psr\Http\Message\UploadedFileInterface