Skip to content

Bump the composer-patching group in /_backend with 3 updates - #4124

Merged
lewisgoddard merged 1 commit into
masterfrom
dependabot/composer/_backend/composer-patching-c7aed8f929
Aug 12, 2026
Merged

Bump the composer-patching group in /_backend with 3 updates#4124
lewisgoddard merged 1 commit into
masterfrom
dependabot/composer/_backend/composer-patching-c7aed8f929

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 12, 2026

Copy link
Copy Markdown
Contributor

Bumps the composer-patching group in /_backend with 3 updates: sentry/sentry, squizlabs/php_codesniffer and guzzlehttp/psr7.

Updates sentry/sentry from 4.29.0 to 4.30.0

Release notes

Sourced from sentry/sentry's releases.

4.30.0

The Sentry SDK team is happy to announce the immediate availability of Sentry PHP SDK v4.30.0.

Features

Bug Fixes

  • Strip breadcrumb metadata when capturing out-of-memory errors to prevent events with large breadcrumbs from being silently dropped. [(#2150)](getsentry/sentry-php#2150)

Misc

Changelog

Sourced from sentry/sentry's changelog.

4.30.0

The Sentry SDK team is happy to announce the immediate availability of Sentry PHP SDK v4.30.0.

Features

Bug Fixes

  • Strip breadcrumb metadata when capturing out-of-memory errors to prevent events with large breadcrumbs from being silently dropped. [(#2150)](getsentry/sentry-php#2150)

Misc

Commits

Updates squizlabs/php_codesniffer from 4.0.2 to 4.0.4

Release notes

Sourced from squizlabs/php_codesniffer's releases.

4.0.4 - 2026-08-06

The 4.0.2 release, the 4.0.3 and the 4.0.4 release are 100% the same (aside from the version number), there was just a slight snafu in the release publication on GitHub (missing PHAR assets). Sorry for the confusion.

Changelog

Sourced from squizlabs/php_codesniffer's changelog.

[4.0.4] - 2026-08-06

The 4.0.2 release, the 4.0.3 and the 4.0.4 release are 100% the same, there was just a slight snafu in the release publication on GitHub. Sorry for the confusion.

[4.0.3] - 2026-08-06

WITHDRAWN

Commits
  • bbdc3d0 Merge branch '3.x' into 4.x
  • 3d9e4c6 Merge pull request #1471 from PHPCSStandards/feature/update-gpg-key-info
  • 0c3dc35 Changelog: add release links
  • ddc0bf9 Changelog update for 4.0.3 + 4.0.4
  • 09a2847 Config: update version nr to next
  • aa43975 Merge branch '3.x' into 4.x
  • 29a0859 Config: update version nr to next
  • 305aebb Update for new GPG keys
  • See full diff in compare view

Updates guzzlehttp/psr7 from 2.13.0 to 3.0.0

Release notes

Sourced from guzzlehttp/psr7's releases.

3.0.0

Added

  • Add DiagnosticValue::escape() to escape controls and malformed UTF-8 in diagnostics
  • Add GuzzleHttp\Psr7\Exception\TimeoutException for timed-out stream operations
  • Add GuzzleHttp\Psr7\Utils::redactUserInfoInString() to redact the userinfo of a raw URI string within text
  • Promote GuzzleHttp\Psr7\Rfc3986 to public API with isValid*() predicates and canonicalizeIpv6()
  • Add GuzzleHttp\Psr7\UriNormalizer::CANONICALIZE_IPV6_HOST to PRESERVING_NORMALIZATIONS

Changed

  • Require psr/http-message:^2.0 and add native parameter and return types
  • Require psr/http-factory:^1.1
  • Reject native PHP serialization of stream implementations
  • Preserve request method casing, except ServerRequest::fromGlobals() still uppercases
  • Reject empty arrays and non-string values as header values
  • Reject invalid uploaded file trees and invalid parsed body values
  • Reject uploaded file specs missing tmp_name, size, or error
  • Reject non-integer and negative uploaded file error values
  • Reject invalid stream/upload sizes, buffer high-water marks, and dropping-stream limits
  • Rewind seekable uploaded-file streams before copying in UploadedFile::moveTo()
  • Reject negative read() lengths across all stream implementations
  • Detect the + flag anywhere in a mode for Stream::isReadable()/isWritable()
  • Reject empty strings returned by PumpStream source callables
  • Discard buffered bytes on PumpStream close and detach
  • Restore the original stream position after Message::bodySummary()
  • Allow null for the Message::bodySummary() truncation length to use the default
  • Validate LimitStream offset/limit and track non-seekable offset by bytes skipped
  • Make FnStream close and detach terminal, calling close callbacks at most once
  • Suppress exceptions from FnStream close callbacks during destructor cleanup
  • Make CachingStream::close() idempotent, preserving remote cleanup after detach
  • Do not move the CachingStream cursor when a SEEK_END target on an unknown-size stream is rejected
  • Normalize multiple leading slashes in Uri::getPath() and origin-form request targets
  • Serialize authority-less file URIs with rootless paths without the // separator
  • Serialize authority-less file URIs with empty paths as file: instead of the unparseable file://
  • Remove dot segments above the root per RFC 3986, prefixing authority-less // paths with /.
  • Return a network-path reference from UriResolver::relativize() when an empty-path target requires one
  • Stop returning an empty reference from UriResolver::relativize() when it would inherit the base fragment
  • Stop throwing from UriResolver::relativize() when an equal-path target's last path segment contains a colon
  • Harden URI host validation (delimiters, backslashes, IPv6, embedded ports); require schemes to start with a letter
  • Validate Uri::fromParts() ports instead of casting them
  • Treat ports 80 and 443 as defaults for the ws and wss schemes
  • Use the ws and wss default ports in UriComparator::isCrossOrigin() port comparisons
  • Redact all non-empty URI userinfo in Utils::redactUserInfo()
  • Rebuild server request URIs from $_SERVER by REQUEST_METHOD, using target authority before SERVER_PORT
  • Remove userinfo from absolute-form REQUEST_URI targets in ServerRequest::fromGlobals()
  • Reject zero-port HTTP_HOST and malformed SERVER_PORT in ServerRequest::getUriFromGlobals()
  • Reject malformed REQUEST_METHOD and SERVER_PROTOCOL server values in ServerRequest::fromGlobals()
  • Reject zero-port Host and normalize leading-zero ports in Message::parseRequest()
  • Reject duplicate Host headers and validate present values for all request-target forms

... (truncated)

Changelog

Sourced from guzzlehttp/psr7's changelog.

3.0.0 - 2026-07-20

Added

  • Add DiagnosticValue::escape() to escape controls and malformed UTF-8 in diagnostics
  • Add GuzzleHttp\Psr7\Exception\TimeoutException for timed-out stream operations
  • Add GuzzleHttp\Psr7\Utils::redactUserInfoInString() to redact the userinfo of a raw URI string within text
  • Promote GuzzleHttp\Psr7\Rfc3986 to public API with isValid*() predicates and canonicalizeIpv6()
  • Add GuzzleHttp\Psr7\UriNormalizer::CANONICALIZE_IPV6_HOST to PRESERVING_NORMALIZATIONS

Changed

  • Require psr/http-message:^2.0 and add native parameter and return types
  • Require psr/http-factory:^1.1
  • Reject native PHP serialization of stream implementations
  • Preserve request method casing, except ServerRequest::fromGlobals() still uppercases
  • Reject empty arrays and non-string values as header values
  • Reject invalid uploaded file trees and invalid parsed body values
  • Reject uploaded file specs missing tmp_name, size, or error
  • Reject non-integer and negative uploaded file error values
  • Reject invalid stream/upload sizes, buffer high-water marks, and dropping-stream limits
  • Rewind seekable uploaded-file streams before copying in UploadedFile::moveTo()
  • Reject negative read() lengths across all stream implementations
  • Detect the + flag anywhere in a mode for Stream::isReadable()/isWritable()
  • Reject empty strings returned by PumpStream source callables
  • Discard buffered bytes on PumpStream close and detach
  • Restore the original stream position after Message::bodySummary()
  • Allow null for the Message::bodySummary() truncation length to use the default
  • Validate LimitStream offset/limit and track non-seekable offset by bytes skipped
  • Make FnStream close and detach terminal, calling close callbacks at most once
  • Suppress exceptions from FnStream close callbacks during destructor cleanup
  • Make CachingStream::close() idempotent, preserving remote cleanup after detach
  • Do not move the CachingStream cursor when a SEEK_END target on an unknown-size stream is rejected
  • Normalize multiple leading slashes in Uri::getPath() and origin-form request targets
  • Serialize authority-less file URIs with rootless paths without the // separator
  • Serialize authority-less file URIs with empty paths as file: instead of the unparseable file://
  • Remove dot segments above the root per RFC 3986, prefixing authority-less // paths with /.
  • Return a network-path reference from UriResolver::relativize() when an empty-path target requires one
  • Stop returning an empty reference from UriResolver::relativize() when it would inherit the base fragment
  • Stop throwing from UriResolver::relativize() when an equal-path target's last path segment contains a colon
  • Harden URI host validation (delimiters, backslashes, IPv6, embedded ports); require schemes to start with a letter
  • Validate Uri::fromParts() ports instead of casting them
  • Treat ports 80 and 443 as defaults for the ws and wss schemes
  • Use the ws and wss default ports in UriComparator::isCrossOrigin() port comparisons
  • Redact all non-empty URI userinfo in Utils::redactUserInfo()
  • Rebuild server request URIs from $_SERVER by REQUEST_METHOD, using target authority before SERVER_PORT
  • Remove userinfo from absolute-form REQUEST_URI targets in ServerRequest::fromGlobals()
  • Reject zero-port HTTP_HOST and malformed SERVER_PORT in ServerRequest::getUriFromGlobals()
  • Reject malformed REQUEST_METHOD and SERVER_PROTOCOL server values in ServerRequest::fromGlobals()
  • Reject zero-port Host and normalize leading-zero ports in Message::parseRequest()

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the composer-patching group in /_backend with 3 updates
928dc45 
Bumps the composer-patching group in /_backend with 3 updates: [sentry/sentry](https://github.com/getsentry/sentry-php), [squizlabs/php_codesniffer](https://github.com/PHPCSStandards/PHP_CodeSniffer) and [guzzlehttp/psr7](https://github.com/guzzle/psr7).


Updates `sentry/sentry` from 4.29.0 to 4.30.0
- [Release notes](https://github.com/getsentry/sentry-php/releases)
- [Changelog](https://github.com/getsentry/sentry-php/blob/master/CHANGELOG.md)
- [Commits](getsentry/sentry-php@4.29.0...4.30.0)

Updates `squizlabs/php_codesniffer` from 4.0.2 to 4.0.4
- [Release notes](https://github.com/PHPCSStandards/PHP_CodeSniffer/releases)
- [Changelog](https://github.com/PHPCSStandards/PHP_CodeSniffer/blob/4.x/CHANGELOG-4.x.md)
- [Commits](PHPCSStandards/PHP_CodeSniffer@4.0.2...4.0.4)

Updates `guzzlehttp/psr7` from 2.13.0 to 3.0.0
- [Release notes](https://github.com/guzzle/psr7/releases)
- [Changelog](https://github.com/guzzle/psr7/blob/3.0/CHANGELOG.md)
- [Commits](guzzle/psr7@2.13.0...3.0.0)

---
updated-dependencies:
- dependency-name: sentry/sentry
  dependency-version: 4.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: composer-patching
- dependency-name: squizlabs/php_codesniffer
  dependency-version: 4.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: composer-patching
- dependency-name: guzzlehttp/psr7
  dependency-version: 3.0.0
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: composer-patching
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update Php code labels Aug 12, 2026
@lewisgoddard
lewisgoddard merged commit 2c178a1 into master Aug 12, 2026
5 checks passed
@lewisgoddard
lewisgoddard deleted the dependabot/composer/_backend/composer-patching-c7aed8f929 branch August 12, 2026 18:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lewisgoddard lewisgoddard lewisgoddard approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file php Pull requests that update Php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lewisgoddard