Bump guzzlehttp/psr7 from 1.2.3 to 1.9.1

[dependabot]

Bumps guzzlehttp/psr7 from 1.2.3 to 1.9.1.

Release notes

Sourced from guzzlehttp/psr7's releases.

1.9.1

See change log for changes.

1.9.0

See change log for changes.

1.8.5

See change log for changes.

1.8.4

See change log for changes.

1.8.3

See change log for changes.

1.8.2

See change log for changes.

1.8.1

See change log for changes.

1.8.0

See change log for changes.

1.7.0

See change log for changes.

Revert PSR-7 type assertions

1.6.0 introduced a few type assertions to enforce types defined by PSR-7. Unfortunately that break the library for users not strictly following the PSR-7 standard. Since the users impacted by this change seems to be rather large, this hotfix reverts that change with the note that we will reapply it in 2.0.0, so fixing this is recommended regardless of which version you use.

Details are in #282 and #283

1.6.0

Version 1.6.0 is released which will likely be the last minor release in 1.x. We're focussing 2.0 now with support for psr/http-factory, PHP 7.2 requirement and type declarations.

Added

• Allowed version ^3.0 of ralouphie/getallheaders dependency (#244)
• Added MIME type for WEBP image format (#246)
• Added more validation of values according to PSR-7 and RFC standards, e.g. status code range (#250, #272)

Changed

• Tests don't pass with HHVM 4.0, so HHVM support got dropped. Other libraries like composer have done the same. (#262)
• Accept port number 0 to be valid (#270)

Fixed

• Fixed subsequent reads from php://input in ServerRequest (#247)
• Fixed readable/writable detection for certain stream modes (#248)

... (truncated)

Changelog

Sourced from guzzlehttp/psr7's changelog.

1.9.1 - 2023-04-17

Fixed

• Fixed header validation issue

1.9.0 - 2022-06-20

Added

• Added UriComparator::isCrossOrigin method

1.8.5 - 2022-03-20

Fixed

• Correct header value validation

1.8.4 - 2022-03-20

Fixed

• Validate header values properly

1.8.3 - 2021-10-05

Fixed

• Return null in caching stream size if remote size is null

1.8.2 - 2021-04-26

Fixed

• Handle possibly unset url in stream_get_meta_data

1.8.1 - 2021-03-21

Fixed

• Issue parsing IPv6 URLs
• Issue modifying ServerRequest lost all its attributes

1.8.0 - 2021-03-21

Added

• Locale independent URL parsing
• Most classes got a @final annotation to prepare for 2.0

... (truncated)

Commits

• e4490ca Release 1.9.1
• c8b21de Release 1.9.1
• 18fd891 Patch header validation issue
• 0e75375 Remove branch alias
• 7cd3009 Update CI workflows (#552)
• e98e3e6 Release 1.9.0 (#520)
• 337e3ad Release 1.8.5 (#491)
• 902db15 Release 1.8.4 (#486)
• 1afdd86 Release 1.8.3 (#446)
• a0c4a5f Return null in caching stream size if remote is null (#438)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[private-packagist]

composer.lock

Package changes

Package	Operation	From	To	About
ralouphie/getallheaders	add	-	3.0.3	view code - License: MIT License
guzzlehttp/psr7	upgrade	1.2.3 ⚠️	1.9.1 ✅	diff
psr/http-message	upgrade	1.0	1.0.1	diff

---

Settings · Docs · Powered by Private Packagist

[linkorb-automation]

Security-Reviewed-Head-SHA: 860185c
Reviewed head SHA: 860185c
Security scope only: this is not a full functional approval.

Security review verdict: SECURITY_ISSUES

I reviewed the dependency-only lockfile change for guzzlehttp/psr7 and ran Composer validation/audit checks.

Findings

Medium: guzzlehttp/psr7 1.9.1 is still affected by current advisories

The PR updates guzzlehttp/psr7 from 1.2.3 to 1.9.1:

• composer.lock:124

This does improve the old lockfile by addressing older psr7 advisories affecting <1.9.1, but composer audit --locked still reports guzzlehttp/psr7 1.9.1 as vulnerable to:

• CVE-2026-48998 / GHSA-34xg-wgjx-8xph — Host Confusion via Authority Reinterpretation
• CVE-2026-49214 / GHSA-hq7v-mx3g-29hw — CRLF Injection via URI Host Component

Both advisories affect guzzlehttp/psr7 <2.10.2, so this PR does not fully remediate the current psr7 dependency risk.

High: existing guzzlehttp/guzzle 6.1.1 remains vulnerable and blocks the fixed psr7 line

The lockfile still contains:

• composer.lock:11 — guzzlehttp/guzzle 6.1.1
• composer.lock:25 — guzzlehttp/guzzle requires guzzlehttp/psr7 ~1.1

composer audit --locked reports multiple High-severity advisories against guzzlehttp/guzzle 6.1.1, including credential/cookie leakage and proxy/header handling issues.

composer why-not guzzlehttp/psr7 2.10.2 --locked reports that guzzlehttp/guzzle 6.1.1 requires guzzlehttp/psr7 ~1.1, which prevents upgrading to guzzlehttp/psr7 >=2.10.2 without broader dependency updates.

Other checks:

• No application code changed.
• No secrets, auth/authz logic, SSRF/path traversal/deserialization/upload/download/logging/session logic changed in this PR.
• No GitHub Actions or CI/CD files are present/changed.
• No Composer scripts/plugins/allow-plugins entries were introduced.
• The new transitive package ralouphie/getallheaders 3.0.3 is a library/polyfill dependency required by guzzlehttp/psr7; Composer audit did not report advisories for it.

Recommendation: do not treat this PR as a complete security fix. Consider a broader dependency update that moves the HTTP stack to non-vulnerable versions, e.g. upgrading guzzlehttp/guzzle to a version that can support patched guzzlehttp/psr7 >=2.10.2, subject to the project’s supported PHP version constraints.