Skip to content

v2.0.1

Latest

Choose a tag to compare

@drdmitry drdmitry released this 18 Apr 16:32

Changes

Raised minimum Guzzle version from ^7.0 to ^7.5.

Why

Guzzle 7.0.0 through 7.4.x had several HIGH-severity advisories (CVE-2022-29248, CVE-2022-31042, CVE-2022-31043, CVE-2022-31090, CVE-2022-31091) that were fixed in 7.4.3 - 7.4.5. With the old ^7.0 constraint, Composer installations on hosts with strict block-insecure audit settings would fail because 7.0.0 appeared in the candidate set.

^7.5 starts at a clean version, so fresh installs now resolve to Guzzle 7.10.0 (or later) without audit warnings.

Upgrade

No SDK API changes. Existing projects get the fix on their next composer update.