guzzle (7.15.2-1) unstable; urgency=medium

  [ Graham Campbell ]
  * Security fixes 7.15 (#3907) (Closes: #1143595)
    + Reject non-printable-ASCII and percent-escaped URI hosts and `Host`
      headers (GHSA-v5mv-p594-2x33) [CVE-2026-69246]
    + Reject request URI hosts that contain a URI authority delimiter
      (GHSA-v5mv-p594-2x33) [CVE-2026-69246]
    + Reject numeric-looking URI hosts with trailing dots, read as IPv4
      addresses (GHSA-v5mv-p594-2x33) [CVE-2026-69246]
    + Treat numeric-in-any-base and percent-escaped cookie domains as
      exact-match-only (GHSA-f7vp-7xgx-4w4r) [CVE-2026-69245]
    + Regenerate a derived `Host` header after client URI rewrites
      (GHSA-v5mv-p594-2x33) [CVE-2026-69246]

  [ David Prévot ]
  * Track version 7 for now

 -- David Prévot <taffit@debian.org>  Wed, 05 Aug 2026 06:56:39 +0200

guzzle (7.15.1-1) unstable; urgency=medium

  [ Graham Campbell ]
  * Security fixes 7.15 (#3901)
    (GHSA-f283-ghqc-fg79 GHSA-h95v-h523-3mw8 GHSA-wm3w-8rrp-j577)
  * Release 7.15.1

 -- David Prévot <taffit@debian.org>  Sat, 18 Jul 2026 18:27:49 -0300

guzzle (7.15.0-1) unstable; urgency=medium

  [ Graham Campbell ]
  * Setup the 7.15 branch (#3834)
  * Sanitize the native cURL error in exception handler context (#3840)
  * Make the cURL multi handler safe to re-enter from callbacks (#3844)
  * Fail closed when named cURL multi connection caps cannot be applied (#3828)
  * Add Multiplexing::NONE handler, client, and request support (#3835)
  * Complete old-libcurl SOCKS connection isolation (#3861)
  * Isolate HTTP proxy tunnels from opaque connection shares (#3864)
  * Fix `delay` affecting unrelated waits and followed redirects (#3874)
  * Bound cURL uploads to declared lengths (#3882)
  * Trigger runtime deprecations for legacy functions and methods (#3896)
  * Require `guzzlehttp/psr7` `^2.13` (#3870)
  * Release 7.15.0

 -- David Prévot <taffit@debian.org>  Fri, 17 Jul 2026 16:59:45 -0300

guzzle (7.14.2-1) unstable; urgency=medium

  [ Graham Campbell ]
  * Never send first-class `Proxy-Authorization` headers to origins (#3876)
  * Release 7.14.2

 -- David Prévot <taffit@debian.org>  Fri, 17 Jul 2026 09:15:09 -0300

guzzle (7.14.1-1) unstable; urgency=medium

  [ Graham Campbell ]
  * Reject streamed requests on connection-capped stream handlers (#3816)
  * Fix flaky cookie expiry test on slow CI runners (#3820)
  * Restore conservative redaction for multi-@ proxy strings (#3821)
  * Enforce required multiplexing against the final configuration (#3825)
  * Correct cURL multi target waiting and delay deadlines (#3823)
  * Release the cURL easy handle when on_stats throws (#3831)
  * Redact request URI credentials in stream connection errors (#3839)
  * Tighten the response trailer API (#3837)
  * Roll back failed cURL multi handle attachment (#3827)
  * Use locale-independent ASCII folding for matching decisions (#3845)
  * Compare cookie and credential header names with ASCII folding (#3848)
  * Correct the stream handler connection-cap contract wording (#3842)
  * Fail closed on tunnel isolation and normalize proxy credentials (#3854)
  * Fix the multiplex conflict check for non-array multi options (#3858)
  * Reject ambiguous raw proxy option types (#3862)
  * Bump `guzzlehttp/psr7` to `^2.12.5` (#3868)
  * Release 7.14.1

 -- David Prévot <taffit@debian.org>  Mon, 13 Jul 2026 09:29:12 -0300

guzzle (7.14.0-1) unstable; urgency=medium

  [ Graham Campbell ]
  * Fix cURL HEAD request handling (#3729)
  * Preserve response headers when HTTP trailers arrive (#3735)
  * Collect HTTP trailer fields on the easy handle (#3737)
  * Add tiered multiplex request option (#3741)
  * Improve cURL handler option hygiene (#3746)
  * Add `max_host_connections` and `max_total_connections` options (#3749)
  * Harden trailer status-line handling (#3754)
  * Validate collected HTTP trailer fields (#3756)
  * Fix the PSR-7 class names in the Pool iterator exception (#3757)
  * Adjust the minimum promises and psr7 versions (#3801) (#3802)
  * Redact proxy credentials containing raw separators (#3806)
  * Document the synchronous cURL multi handler change (#3808)
  * Release 7.14.0

 -- David Prévot <taffit@debian.org>  Thu, 09 Jul 2026 07:59:59 +0200

guzzle (7.13.1-1) unstable; urgency=medium

  [ Graham Campbell ]
  * Reapply authenticated proxy tunnel reuse mitigation (#3642)
  * Section proxy tunnel connection reuse by credential (#3628)
  * Isolate delegated proxy tunnels (#3668)
  * Add crypto_method_max request option (#3687)
  * Route TLS 1.2 requests to stream fallback (#3691)
  * Support QUERY redirects (#3702)
  * Deprecate invalid numeric-string delay values (#3707)
  * Harden CurlMultiHandler proxy tunnel isolation (#3708)
  * Reject final URIs missing scheme or host (#3715)
  * Harden cURL header list options (#3716)
  * Route Proxy-Authorization through cURL proxy headers (#3710)
  * Reject CURLOPT_SHARE with authenticated proxy tunnel (#3711)
  * Stop deprecating CURLOPT_PREREQFUNCTION (#3718)
  * Allow middleware to rewrite partial URIs (#3721)
  * Release 7.13.1 (#3726)

 -- David Prévot <taffit@debian.org>  Sat, 04 Jul 2026 07:05:20 +0200

guzzle (7.12.3-1) unstable; urgency=medium

  [ Graham Campbell ]
  * Fix cookie falsey edge cases (#3659)
  * Preserve falsey decode_content strings (#3660)
  * Clamp overflowing cookie Max-Age values (#3669)
  * Store trailing-dot cookie domains on origin (#3671)
  * Use strict cookie path matching (#3673)
  * Document cookie name lookup case sensitivity (#3674)
  * Treat IP cookie domains as exact-only (#3694) (GHSA-g446-98w2-8p5w)
  * Adjusted `guzzlehttp/psr7` version constraint to `^2.12.3` (#3696)
  * Release 7.12.3

 -- David Prévot <taffit@debian.org>  Wed, 24 Jun 2026 19:53:10 +0200

guzzle (7.12.1-1) unstable; urgency=medium

  [ Graham Campbell ]
  * Reject HTTPS proxies when libcurl lacks HTTPS-proxy support (#3626)
    (GHSA-wpwq-4j6v-78m3) [CVE-2026-55568]
  * Reject proxy URLs with a malformed scheme in the cURL handlers (#3637)
  * Adjust version constraints (#3651)
  * Reject dot-only cookie domains (#3653)
    (GHSA-cwxw-98qj-8qjx) [CVE-2026-55767]
  * Release 7.12.1

 -- David Prévot <taffit@debian.org>  Fri, 19 Jun 2026 18:12:53 +0200

guzzle (7.12.0-1) unstable; urgency=medium

  [ Graham Campbell ]
  * Ignore request-level transport sharing (#3586)
  * Deprecate request-level handler option (#3588)
  * Deprecate unsupported raw handler options (#3591)
  * Centralize cURL feature detection (#3602)
  * Take over proxy environment variable handling (#3619)
  * Fix non-finite float coercion warnings on PHP 8.5 (#3622)
  * Deprecate non-finite floats in the query and form_params options (#3623)
  * Deprecate non-string scalar values in the body request option (#3631)
  * Deprecate the CURLOPT_PROXYTYPE cURL request option (#3632)
  * Adjusted `guzzlehttp/psr7` version constraint and corrected links (#3646)
  * Release 7.12.0

 -- David Prévot <taffit@debian.org>  Wed, 17 Jun 2026 08:06:37 +0200

guzzle (7.11.0-1) unstable; urgency=medium

  [ Graham Campbell ]
  * Add PHP 8.5 support (#3300)
  * Release 7.11.0

  [ Markus Podar ]
  * Remove explicit content-length header for GET requests (#3278)

  [ Tim Düsterhus ]
  * Remove obsolete reference capturing of `$http_response_header` (#3294)

  [ David Prévot ]
  * Fix debian/gbp.conf
  * Upgrade upstream signing key to new packet format
  * Update standards version to 4.7.4
  * Update watch file format version to 5
  * Removed Rules-Requires-Root
  * Remove redundant Priority: optional from source stanza
  * Wrap and sort
  * Set myself as uploader
  * Build-depend on dh-sequence-phpcomposer instead of pkg-php-tools
  * Drop patch

 -- David Prévot <taffit@debian.org>  Wed, 03 Jun 2026 23:26:16 +0200

guzzle (7.9.2-0.1) unstable; urgency=medium

  [ Katharina Drexel ]
  * Adding patch for removing Makefile (disturbing build process).
  * d/gbp.conf: Correcting upstream-vcs-tag.
  * d/control: Setting php-pear mailing list as maintainer.
  * d/control: Sorting.
  * Updating changelog.
  * d/rules: removing trailing whitespace.

  [ Ondřej Surý ]
  * New upstream version with PHP 8.4 support
  * Non-maintainer upload

 -- Ondřej Surý <ondrej@debian.org>  Fri, 06 Dec 2024 20:07:30 +0100

guzzle (7.4.5-1) unstable; urgency=medium

  * Upgrading to 7.4.5 because of patch concerning removing authorization and
    cookie headers
    (Closes: #1014492)
    [CVE-2022-31091, CVE-2022-31090]
  * d/watch: removing typo.
  * d/gbp.conf: Correcting upstream-vcs-tag.
  * d/control: Setting php-pear mailing list as maintainer.
  * d/control: Sorting.

 -- Katharina Drexel <katharina.drexel@bfh.ch>  Mon, 18 Jul 2022 09:06:20 +0200

guzzle (7.4.4-2) unstable; urgency=medium

  * Team upload
  * Install phpabtpl(1) autoloaders
  * Fix autoload.php
  * Drop broken autopkgtests

 -- David Prévot <taffit@debian.org>  Sun, 19 Jun 2022 19:51:44 +0200

guzzle (7.4.4-1) sid; urgency=medium

  * Upgrading to 7.4.4 because of cookie injection leak (Closes: #1011636)
    [CVE-2022-31042, CVE-2022-31043]
  * Adding test folder to debian.
  * Adopting debian/rules to the salsa standard.
  * Optimizing watchfile.
  * Adding some more files which have to be cleaned.
  * Adding gbp config file.
  * Adding upstream/metadata and signing key.
  * Adding newer standards version.
  * debian/control: Correcting Vcs* paths.
  * debian/control: Break should also be valid for Debian-replace.

 -- Katharina Drexel <katharina.drexel@bfh.ch>  Thu, 16 Jun 2022 18:22:39 +0200

guzzle (7.4.1-1) unstable; urgency=medium

  * Initial release (Closes: #1004898).

 -- Katharina Drexel <katharina.drexel@bfh.ch>  Mon, 31 Jan 2022 17:14:16 +0100
