Skip to content

chore(deps): Bump the composer group across 2 directories with 5 updates - #1

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/tests/integration/composer-03083a1d5e
Open

chore(deps): Bump the composer group across 2 directories with 5 updates#1
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/tests/integration/composer-03083a1d5e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 7, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the composer group with 1 update in the / directory: phpoffice/phpspreadsheet.
Bumps the composer group with 4 updates in the /tests/integration directory: phpunit/phpunit, guzzlehttp/guzzle, guzzlehttp/psr7 and symfony/yaml.

Updates phpoffice/phpspreadsheet from 5.7.0 to 5.8.1

Release notes

Sourced from phpoffice/phpspreadsheet's releases.

5.8.1

Last version with support for Php 8.1.

Added

Changed

Fixed

5.8.0

This will probably be the last release on the master branch that supports Php8.1.

Security Note

  • File::prohibitWrappers and Drawing::setPath now reject phar paths with extra leading slashes (e.g. phar:///…) that escaped the prior parse_url-based filter. No security exploit was possible even with the extra slashes. [PR #4876](PHPOffice/PhpSpreadsheet#4876)

Added

Changed

Fixed

Changelog

Sourced from phpoffice/phpspreadsheet's changelog.

2026-07-12 - 5.8.1

Last version with support for Php 8.1.

Added

Changed

Fixed

2026-06-06 - 5.8.0

Security Note

  • File::prohibitWrappers and Drawing::setPath now reject phar paths with extra leading slashes (e.g. phar:///…) that escaped the prior parse_url-based filter. No security exploit was possible even with the extra slashes. [PR #4876](PHPOffice/PhpSpreadsheet#4876)

Added

Changed

Fixed

Commits

Updates phpunit/phpunit from 9.6.13 to 9.6.33

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 9.6.33

Changed

  • To prevent Poisoned Pipeline Execution (PPE) attacks using prepared .coverage files in pull requests, a PHPT test will no longer be run if the temporary file for writing code coverage information already exists before the test runs

Learn how to install or update PHPUnit 9.6 in the documentation.

Keep up to date with PHPUnit:

PHPUnit 9.6.32

Changed

  • PHPUnit\Framework\MockObject exceptions are now subtypes of PHPUnit\Exception

Learn how to install or update PHPUnit 9.6 in the documentation.

Keep up to date with PHPUnit:

Changelog

Sourced from phpunit/phpunit's changelog.

[9.6.33] - 2026-01-27

Changed

  • To prevent Poisoned Pipeline Execution (PPE) attacks using prepared .coverage files in pull requests, a PHPT test will no longer be run if the temporary file for writing code coverage information already exists before the test runs

[9.6.32] - 2026-01-24

Changed

  • PHPUnit\Framework\MockObject exceptions are now subtypes of PHPUnit\Exception

[9.6.31] - 2025-12-06

  • No changes; phpunit.phar rebuilt with PHP 8.4 to work around PHP-Scoper issue #1139

[9.6.30] - 2025-12-01

Changed

  • Updated list of deprecated PHP configuration settings for PHP 8.4, PHP 8.5, and PHP 8.6

[9.6.29] - 2025-09-24

  • No changes; phpunit.phar rebuilt with updated dependencies

[9.6.28] - 2025-09-23

  • No changes; phpunit.phar rebuilt with updated dependencies

[9.6.27] - 2025-09-14

Changed

  • #6366: Exclude __sleep() and __wakeup() from test double code generation on PHP >= 8.5

[9.6.26] - 2025-09-11

Changed

  • Implement __serialize() in addition to __sleep() (which will be deprecated in PHP 8.5)

[9.6.25] - 2025-08-20

Changed

  • Do not configure report_memleaks setting (which will be deprecated in PHP 8.5) for PHPT processes

[9.6.24] - 2025-08-10

... (truncated)

Commits
  • fea0625 Prepare release
  • 1a677f6 Merge branch '8.5' into 9.6
  • 1015741 Prepare release
  • 1cce5f3 Merge branch '8.5' into 9.6
  • 3141742 Do not run PHPT test when its temporary file for code coverage information ex...
  • 0b3170a We do not need to unserialize() objects here
  • 261086a Extract method
  • fdd6b86 Fix CS/WS issue
  • 492ee10 Prepare release
  • 81edce2 Merge branch '8.5' into 9.6
  • Additional commits viewable in compare view

Updates guzzlehttp/guzzle from 7.8.0 to 7.15.2

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.15.2

Security

Fixed

  • Preserve RequestException when the stream handler rejects a request before opening a stream

7.15.1

Security

7.15.0

Added

  • Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.13
  • Use locale-independent ASCII folding for all case normalization and comparison
  • Bound cURL upload reads to the declared Content-Length
  • Sanitize the cURL error text exposed through exception handler context
  • Fail closed when a named cURL multi connection cap cannot be applied
  • Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured
  • Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles
  • Isolate HTTP proxy tunnels from opaque shared connection caches
  • Trigger runtime deprecations for previously deprecated functionality in 7.1.0

Deprecated

  • Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
  • Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array
  • Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support

Fixed

  • Defer cURL requests created from multi callbacks until native execution unwinds
  • Fail synchronous waits from native cURL callbacks promptly instead of self-deadlocking
  • Guard cURL multi handle removal against progress callbacks re-entering the handler
  • Scope promise waits on the cURL multi handler to the awaited transfer
  • Strip Content-Length and Transfer-Encoding when redirects discard the request body

... (truncated)

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.15.2 - 2026-07-26

Security

Fixed

  • Preserve RequestException when the stream handler rejects a request before opening a stream

7.15.1 - 2026-07-18

Security

7.15.0 - 2026-07-17

Added

  • Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.13
  • Use locale-independent ASCII folding for all case normalization and comparison
  • Bound cURL upload reads to the declared Content-Length
  • Sanitize the cURL error text exposed through exception handler context
  • Fail closed when a named cURL multi connection cap cannot be applied
  • Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured
  • Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles
  • Isolate HTTP proxy tunnels from opaque shared connection caches
  • Trigger runtime deprecations for previously deprecated functionality in 7.1.0

Deprecated

  • Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
  • Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array
  • Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support

Fixed

... (truncated)

Commits

Updates phpunit/phpunit from 9.6.13 to 9.6.33

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 9.6.33

Changed

  • To prevent Poisoned Pipeline Execution (PPE) attacks using prepared .coverage files in pull requests, a PHPT test will no longer be run if the temporary file for writing code coverage information already exists before the test runs

Learn how to install or update PHPUnit 9.6 in the documentation.

Keep up to date with PHPUnit:

PHPUnit 9.6.32

Changed

  • PHPUnit\Framework\MockObject exceptions are now subtypes of PHPUnit\Exception

Learn how to install or update PHPUnit 9.6 in the documentation.

Keep up to date with PHPUnit:

Changelog

Sourced from phpunit/phpunit's changelog.

[9.6.33] - 2026-01-27

Changed

  • To prevent Poisoned Pipeline Execution (PPE) attacks using prepared .coverage files in pull requests, a PHPT test will no longer be run if the temporary file for writing code coverage information already exists before the test runs

[9.6.32] - 2026-01-24

Changed

  • PHPUnit\Framework\MockObject exceptions are now subtypes of PHPUnit\Exception

[9.6.31] - 2025-12-06

  • No changes; phpunit.phar rebuilt with PHP 8.4 to work around PHP-Scoper issue #1139

[9.6.30] - 2025-12-01

Changed

  • Updated list of deprecated PHP configuration settings for PHP 8.4, PHP 8.5, and PHP 8.6

[9.6.29] - 2025-09-24

  • No changes; phpunit.phar rebuilt with updated dependencies

[9.6.28] - 2025-09-23

  • No changes; phpunit.phar rebuilt with updated dependencies

[9.6.27] - 2025-09-14

Changed

  • #6366: Exclude __sleep() and __wakeup() from test double code generation on PHP >= 8.5

[9.6.26] - 2025-09-11

Changed

  • Implement __serialize() in addition to __sleep() (which will be deprecated in PHP 8.5)

[9.6.25] - 2025-08-20

Changed

  • Do not configure report_memleaks setting (which will be deprecated in PHP 8.5) for PHPT processes

[9.6.24] - 2025-08-10

... (truncated)

Commits
  • fea0625 Prepare release
  • 1a677f6 Merge branch '8.5' into 9.6
  • 1015741 Prepare release
  • 1cce5f3 Merge branch '8.5' into 9.6
  • 3141742 Do not run PHPT test when its temporary file for code coverage information ex...
  • 0b3170a We do not need to unserialize() objects here
  • 261086a Extract method
  • fdd6b86 Fix CS/WS issue
  • 492ee10 Prepare release
  • 81edce2 Merge branch '8.5' into 9.6
  • Additional commits viewable in compare view

Updates guzzlehttp/psr7 from 2.6.1 to 2.13.1

Release notes

Sourced from guzzlehttp/psr7's releases.

2.13.1

Added

  • Add support for PHP 8.6

Fixed

  • Prefix relative paths that begin with a colon segment with ./ instead of throwing

2.13.0

Added

  • Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

  • Use locale-independent ASCII case folding everywhere case is normalized
  • Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

2.12.5

Fixed

  • Compare header names and hosts with locale-independent ASCII lowercasing
  • Compare hosts without locale sensitivity when detecting cross-origin redirects

2.12.4

Changed

  • Pass explicit trim characters ahead of the PHP 8.6 trim default change

2.12.3

Security

2.12.2

Fixed

  • Report URI parsing, filtering, and normalization PCRE failures explicitly
  • Report HTTP message parser PCRE failures explicitly
  • Fail closed when PCRE validation fails for request targets and hosts

2.12.1

Security

2.12.0

Deprecated

... (truncated)

Changelog

Sourced from guzzlehttp/psr7's changelog.

2.13.1 - 2026-08-24

Added

  • Add support for PHP 8.6

Fixed

  • Prefix relative paths that begin with a colon segment with ./ instead of throwing

2.13.0 - 2026-07-16

Added

  • Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

  • Use locale-independent ASCII case folding everywhere case is normalized
  • Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

2.12.5 - 2026-07-13

Fixed

  • Compare header names and hosts with locale-independent ASCII lowercasing
  • Compare hosts without locale sensitivity when detecting cross-origin redirects

2.12.4 - 2026-07-08

Changed

  • Pass explicit trim characters ahead of the PHP 8.6 trim default change

Fixed

  • Anchor server port and response start-line patterns to the true end of input
  • Treat host-less origin-form request targets starting with // as paths in Message::parseRequest()
  • Reject raw DEL bytes in bracketed IP-literal hosts instead of parsing a mutated host
  • Reject invalid bytes after a bracketed IP-literal host instead of reparsing a different host

2.12.3 - 2026-06-23

Security

2.12.2 - 2026-06-23

Fixed

... (truncated)

Commits
  • 95e7828 Release 2.13.1
  • a583cbe Add PHP 8.6 to the CI matrix and version guidance (#883)
  • 93b91b0 Prefix relative paths that begin with a colon segment instead of throwing (#878)
  • 5b1264e Test that noncanonical IPv4 host spellings pass through unchanged (#874)
  • dad8962 Release 2.13.0
  • 1bc4f53 Trigger a runtime deprecation for Header::normalize() (#866)
  • a1372ea Add tests locking in no-file upload handling (#856)
  • d9561d1 Merge branch '2.12' into 2.13
  • 9365d57 Release 2.12.5
  • b82bac4 Add caseless comparison and asciiUcFirst helpers (#854)
  • Additional commits viewable in compare view

Updates symfony/yaml from 6.3.3 to 6.4.47

Release notes

Sourced from symfony/yaml's releases.

v6.4.47

Changelog (symfony/yaml@v6.4.45...v6.4.47)

v6.4.45

Changelog (symfony/yaml@v6.4.44...v6.4.45)

v6.4.44

Changelog (symfony/yaml@v6.4.43...v6.4.44)

v6.4.43

Changelog (symfony/yaml@v6.4.42...v6.4.43)

v6.4.42

Changelog (symfony/yaml@v6.4.41...v6.4.42)

v6.4.41

Changelog (symfony/yaml@v6.4.40...v6.4.41)

v6.4.40

Changelog (symfony/yaml@v6.4.39...v6.4.40)

v6.4.39

Changelog (symfony/yaml@v6.4.38...v6.4.39)

... (truncated)

Commits
  • 928e3ef [Yaml] Fix tabs in block scalars and comments after empty ones
  • 262f736 bug #66340 [Yaml] Fix !!str and !!float tags on block scalars (nicolas-gr...
  • d191b39 [Yaml] Fix several parsing edge cases
  • 919797d [Yaml] Fix !!str and !!float tags on block scalars
  • 4d2db33 Stop referencing issues and pull requests in tests
  • 5639865 [Yaml] Fix the line offset handed to nested block parsers
  • a778aba Merge branch '5.4' into 6.4
  • 12c6b4f [Yaml] Bound recursion depth in the inline lexer
  • 7b18a2a [Yaml] Quote strings that look like octal numbers when dumping
  • 44b712e [Yaml] Fix parsing tagged block scalars inside sequences
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update php code labels Oct 7, 2026
@dependabot
chore(deps): Bump the composer group across 2 directories with 5 updates
30c0a5f 
Bumps the composer group with 1 update in the / directory: [phpoffice/phpspreadsheet](https://github.com/PHPOffice/PhpSpreadsheet).
Bumps the composer group with 4 updates in the /tests/integration directory: [phpunit/phpunit](https://github.com/sebastianbergmann/phpunit), [guzzlehttp/guzzle](https://github.com/guzzle/guzzle), [guzzlehttp/psr7](https://github.com/guzzle/psr7) and [symfony/yaml](https://github.com/symfony/yaml).


Updates `phpoffice/phpspreadsheet` from 5.7.0 to 5.8.1
- [Release notes](https://github.com/PHPOffice/PhpSpreadsheet/releases)
- [Changelog](https://github.com/PHPOffice/PhpSpreadsheet/blob/5.8.1/CHANGELOG.md)
- [Commits](PHPOffice/PhpSpreadsheet@5.7.0...5.8.1)

Updates `phpunit/phpunit` from 9.6.13 to 9.6.33
- [Release notes](https://github.com/sebastianbergmann/phpunit/releases)
- [Changelog](https://github.com/sebastianbergmann/phpunit/blob/9.6.33/ChangeLog-9.6.md)
- [Commits](sebastianbergmann/phpunit@9.6.13...9.6.33)

Updates `guzzlehttp/guzzle` from 7.8.0 to 7.15.2
- [Release notes](https://github.com/guzzle/guzzle/releases)
- [Changelog](https://github.com/guzzle/guzzle/blob/7.15.2/CHANGELOG.md)
- [Commits](guzzle/guzzle@7.8.0...7.15.2)

Updates `phpunit/phpunit` from 9.6.13 to 9.6.33
- [Release notes](https://github.com/sebastianbergmann/phpunit/releases)
- [Changelog](https://github.com/sebastianbergmann/phpunit/blob/9.6.33/ChangeLog-9.6.md)
- [Commits](sebastianbergmann/phpunit@9.6.13...9.6.33)

Updates `guzzlehttp/psr7` from 2.6.1 to 2.13.1
- [Release notes](https://github.com/guzzle/psr7/releases)
- [Changelog](https://github.com/guzzle/psr7/blob/2.13.1/CHANGELOG.md)
- [Commits](guzzle/psr7@2.6.1...2.13.1)

Updates `symfony/yaml` from 6.3.3 to 6.4.47
- [Release notes](https://github.com/symfony/yaml/releases)
- [Changelog](https://github.com/symfony/yaml/blob/8.2/CHANGELOG.md)
- [Commits](symfony/yaml@v6.3.3...v6.4.47)

---
updated-dependencies:
- dependency-name: guzzlehttp/guzzle
  dependency-version: 7.15.2
  dependency-type: direct:development
- dependency-name: guzzlehttp/psr7
  dependency-version: 2.13.1
  dependency-type: indirect
- dependency-name: phpoffice/phpspreadsheet
  dependency-version: 5.8.1
  dependency-type: direct:production
- dependency-name: phpunit/phpunit
  dependency-version: 9.6.33
  dependency-type: direct:development
- dependency-name: symfony/yaml
  dependency-version: 6.4.47
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump the composer group across 2 directories with 5 updates chore(deps): Bump the composer group across 2 directories with 5 updates Oct 12, 2026
@dependabot
dependabot Bot force-pushed the dependabot/composer/tests/integration/composer-03083a1d5e branch from 285c2a7 to 30c0a5f Compare October 12, 2026 07:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file php Pull requests that update php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants