[dependabot]

Updates the requirements on guzzlehttp/guzzle to permit the latest version.

Release notes

Sourced from guzzlehttp/guzzle's releases.

8.3.0

Changed

• Adjusted guzzlehttp/promises version constraint to ^3.1
• Adjusted guzzlehttp/psr7 version constraint to ^3.2
• Replace the deprecated Promise\Is with Promise\State for PHP 8.6
• Decode chunked stream handler bodies as they arrive, ending at the last chunk
• Reject truncated and malformed chunked stream handler bodies, like libcurl
• Reject unsupported response transfer codings, like libcurl 8.14+
• End stream handler bodies at their declared Content-Length, including 0
• Throw when a streamed body ends before its declared Content-Length
• Classify cURL errors 8 and 23 with a response as ResponseTransferException
• Reject stream handler gzip and deflate bodies with trailing data, like libcurl
• Accept raw deflate stream handler bodies, like libcurl

Fixed

• Fix streamed stream handler bodies delaying bytes that arrived with the headers

Changelog

Sourced from guzzlehttp/guzzle's changelog.

8.3.0 - 2026-10-18

Changed

• Adjusted guzzlehttp/promises version constraint to ^3.1
• Adjusted guzzlehttp/psr7 version constraint to ^3.2
• Replace the deprecated Promise\Is with Promise\State for PHP 8.6
• Decode chunked stream handler bodies as they arrive, ending at the last chunk
• Reject truncated and malformed chunked stream handler bodies, like libcurl
• Reject unsupported response transfer codings, like libcurl 8.14+
• End stream handler bodies at their declared Content-Length, including 0
• Throw when a streamed body ends before its declared Content-Length
• Classify cURL errors 8 and 23 with a response as ResponseTransferException
• Reject stream handler gzip and deflate bodies with trailing data, like libcurl
• Accept raw deflate stream handler bodies, like libcurl

Fixed

• Fix streamed stream handler bodies delaying bytes that arrived with the headers

8.2.1 - 2026-10-18

Fixed

• Fix PHP 8.6 notices for oversized numeric hosts
• Fix delay values over 71 minutes
• Fix CurlMultiHandler delays over 71 minutes
• Fix overlapping stream handler requests sharing a deadline
• Fix stream handler responses in Swoole coroutines on PHP 8.4+
• Fix reads of streamed gzip and deflate responses waiting for 8 KiB of decoded data
• Fix stream handler accepting corrupt gzip and deflate response bodies

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^3.1.1

8.2.0 - 2026-09-06

Changed

• Allow connection caps to be combined with persistent transport sharing on libcurl 8.22.0+

8.1.0 - 2026-08-24

Added

• Add PHP 8.6+ stream TLS session sharing, while persistent sharing remains cURL-only

... (truncated)

Commits

• b920e5f Release 8.3.0
• 1e0396c Decode stream handler gzip and deflate bodies like libcurl (#3972)
• e3ec346 Replace the deprecated promises Is with State (#3975)
• 1b3c5d3 List 7.16 as the maintained 7.x version (#3979)
• 453adce Raise minimum psr7 version to 3.2 (#3980)
• 546e0b9 Merge branch '8.2' into 8.3
• 1113a54 Release 8.2.1
• f3a730e Raise minimum psr7 version (#3977)
• e7d15e7 Classify cURL errors 8 and 23 with a response as ResponseTransferException (#...
• 3a16833 End stream handler response bodies at their declared Content-Length (#3970)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Overview
Widens dev-time and optional Guzzle support to v8 by changing composer.json require-dev on guzzlehttp/guzzle from ^7 to ^7|^8, and updates the suggest text so optional guzzlehttp/guzzle and kevinrob/guzzle-cache-middleware versions include 8.x.

Tests in FeatureFlagTest now call native json_decode instead of \GuzzleHttp\json_decode, avoiding reliance on Guzzle’s JSON helper so the suite stays valid when Guzzle 8 is installed.

No runtime require changes; this is primarily developer/consumption dependency alignment with Guzzle 8.

^{Reviewed by Cursor Bugbot for commit b059de5. Bugbot is set up for automated code reviews on this repo. Configure here.}