[dependabot]

Bumps the composer group with 5 updates in the / directory:

Package	From	To
guzzlehttp/guzzle	8.2.0	8.3.1
guzzlehttp/psr7	3.1.0	3.2.0
phpstan/phpstan	2.2.16	2.3.4
phpstan/phpstan-strict-rules	2.0.12	2.1.0
rector/rector	2.6.7	2.8.3

Updates guzzlehttp/guzzle from 8.2.0 to 8.3.1

Release notes

Sourced from guzzlehttp/guzzle's releases.

8.3.1

Fixed

• Fix CookieJar storing already expired cookies instead of removing the stored cookie
• Fix CookieJar ignoring a same-value cookie that changes its expiry or its Discard, Secure, or HttpOnly flag
• Fix SetCookie renewing the lifetime of Max-Age cookies rebuilt from an array, so persisted cookies never expired

8.3.0

Changed

• Adjusted guzzlehttp/promises version constraint to ^3.1
• Adjusted guzzlehttp/psr7 version constraint to ^3.2
• Replace the deprecated Promise\Is with Promise\State for PHP 8.6
• Decode chunked stream handler bodies as they arrive, ending at the last chunk
• Reject truncated and malformed chunked stream handler bodies, like libcurl
• Reject unsupported response transfer codings, like libcurl 8.14+
• End stream handler bodies at their declared Content-Length, including 0
• Throw when a streamed body ends before its declared Content-Length
• Classify cURL errors 8 and 23 with a response as ResponseTransferException
• Reject stream handler gzip and deflate bodies with trailing data, like libcurl
• Accept raw deflate stream handler bodies, like libcurl

Fixed

• Fix streamed stream handler bodies delaying bytes that arrived with the headers

8.2.1

Fixed

• Fix PHP 8.6 notices for oversized numeric hosts
• Fix delay values over 71 minutes
• Fix CurlMultiHandler delays over 71 minutes
• Fix overlapping stream handler requests sharing a deadline
• Fix stream handler responses in Swoole coroutines on PHP 8.4+
• Fix reads of streamed gzip and deflate responses waiting for 8 KiB of decoded data
• Fix stream handler accepting corrupt gzip and deflate response bodies

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^3.1.1

Changelog

Sourced from guzzlehttp/guzzle's changelog.

8.3.1 - 2026-10-25

Fixed

• Fix CookieJar storing already expired cookies instead of removing the stored cookie
• Fix CookieJar ignoring a same-value cookie that changes its expiry or its Discard, Secure, or HttpOnly flag
• Fix SetCookie renewing the lifetime of Max-Age cookies rebuilt from an array, so persisted cookies never expired

8.3.0 - 2026-10-18

Changed

• Adjusted guzzlehttp/promises version constraint to ^3.1
• Adjusted guzzlehttp/psr7 version constraint to ^3.2
• Replace the deprecated Promise\Is with Promise\State for PHP 8.6
• Decode chunked stream handler bodies as they arrive, ending at the last chunk
• Reject truncated and malformed chunked stream handler bodies, like libcurl
• Reject unsupported response transfer codings, like libcurl 8.14+
• End stream handler bodies at their declared Content-Length, including 0
• Throw when a streamed body ends before its declared Content-Length
• Classify cURL errors 8 and 23 with a response as ResponseTransferException
• Reject stream handler gzip and deflate bodies with trailing data, like libcurl
• Accept raw deflate stream handler bodies, like libcurl

Fixed

• Fix streamed stream handler bodies delaying bytes that arrived with the headers

8.2.1 - 2026-10-18

Fixed

• Fix PHP 8.6 notices for oversized numeric hosts
• Fix delay values over 71 minutes
• Fix CurlMultiHandler delays over 71 minutes
• Fix overlapping stream handler requests sharing a deadline
• Fix stream handler responses in Swoole coroutines on PHP 8.4+
• Fix reads of streamed gzip and deflate responses waiting for 8 KiB of decoded data
• Fix stream handler accepting corrupt gzip and deflate response bodies

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^3.1.1

Commits

• 7d9b1f4 Release 8.3.1
• 2567cb4 Time only the attach in the ticking delayed request test (#3994)
• 89f4293 Keep the stored expiry when rebuilding Max-Age cookies (#3991)
• 3236dc4 Replace same-value cookies whose expiry or flags change (#3990)
• 0b3016c Drop expired cookies instead of storing them (#3987)
• b920e5f Release 8.3.0
• 1e0396c Decode stream handler gzip and deflate bodies like libcurl (#3972)
• e3ec346 Replace the deprecated promises Is with State (#3975)
• 1b3c5d3 List 7.16 as the maintained 7.x version (#3979)
• 453adce Raise minimum psr7 version to 3.2 (#3980)
• Additional commits viewable in compare view

Updates guzzlehttp/psr7 from 3.1.0 to 3.2.0

Release notes

Sourced from guzzlehttp/psr7's releases.

3.2.0

• Fix InflateStream ignoring source read failures that follow decoded bytes
• Fix AppendStream discarding bytes read before a timeout

3.1.1

• Fix StreamWrapper flushes reporting failure
• Fix CachingStream skipping unread bytes after repeated writes

Changelog

Sourced from guzzlehttp/psr7's changelog.

3.2.0 - 2026-10-18

Fixed

• Fix InflateStream ignoring source read failures that follow decoded bytes
• Fix AppendStream discarding bytes read before a timeout

3.1.1 - 2026-10-18

Fixed

• Fix StreamWrapper flushes reporting failure
• Fix CachingStream skipping unread bytes after repeated writes

Commits

• cdc1393 Release 3.2.0
• 268aabf Merge branch '3.1' into 3.2
• e6e2b99 Keep AppendStream bytes read before a timeout (#899)
• b1ab16b Report InflateStream source read failures that follow decoded bytes (#898)
• 6a66fbd Release 3.1.1
• 3c4ac62 Bump version to 3.2 (#900)
• b91cce8 Fix CachingStream skipping unread bytes after repeated writes (#892)
• ad965d4 Report successful flushes from the stream wrapper (#890)
• 52f87ed Use a zero backtrack limit to force the header PCRE failure (#889)
• 5823fee Reference the security maintainers in the readme (#887)
• See full diff in compare view

Updates phpstan/phpstan from 2.2.16 to 2.3.4

Commits

• See full diff in compare view

Updates phpstan/phpstan-strict-rules from 2.0.12 to 2.1.0

Release notes

Sourced from phpstan/phpstan-strict-rules's releases.

2.1.0

• 24ec515 - Update github-actions (#334)
• 19b5b5b - Name the node types the arithmetic operand rules want
• 25c1a99 - Merge remote-tracking branch 'origin/2.0.x' into 2.1.x
• aac2457 - Fix build (#336)
• b39a53a - Fix 2.3.x-dev build errors (#335)
• 4908484 - Report loop variable overwrites only for variables still in use
• 9db0b58 - Require PHPStan 2.3.0
• c58b775 - Open 2.1.x-dev
• 3c614d5 - Update github-actions (#331)
• 361d3d0 - Update github-actions (#330)
• 33d4b9e - Update github-actions (#329)
• f504dd3 - Update github-actions (#328)
• b04c8f7 - Update github-actions (#326)

Commits

• 24ec515 Update github-actions (#334)
• 19b5b5b Name the node types the arithmetic operand rules want
• 25c1a99 Merge remote-tracking branch 'origin/2.0.x' into 2.1.x
• aac2457 Fix build (#336)
• b39a53a Fix 2.3.x-dev build errors (#335)
• 4908484 Report loop variable overwrites only for variables still in use
• 9db0b58 Require PHPStan 2.3.0
• c58b775 Open 2.1.x-dev
• 3c614d5 Update github-actions (#331)
• 361d3d0 Update github-actions (#330)
• Additional commits viewable in compare view

Updates rector/rector from 2.6.7 to 2.8.3

Release notes

Sourced from rector/rector's releases.

Released Rector 2.8.3

Faster node traversal and updated PHPStan stack 🚀

This release brings performance improvements to node visitors, reducing unnecessary traversals and reflection resolution during analysis.

It also updates PHPStan to 2.3.4 and phpstan/phpdoc-parser to 2.4, with compatibility fixes for the updated PHPDoc type nodes.

Performance Improvements 🚀

• Avoid nested traversals in ByRefNodeVisitor by tracking by-reference variable names per FunctionLike (#8879) Thanks @​samsonasik
• Only resolve call reflection for 2-item array arguments in CallLikeReflectionNodeVisitor (#8880) Thanks @​samsonasik

Bugfixes 🐛

• [TypeDeclaration] AddArrayFunctionClosureParamTypeRector: resolve array item types from unions of arrays (#8877) Thanks @​SanderMuller
• Lock the fixture directory itself to prevent conflicts between parallel test workers using different TMPDIR values (#8878) Thanks @​SanderMuller

Internals ⚙️

• Bump PHPStan to 2.3.4 and phpstan/phpdoc-parser to 2.4, adapting PHPDoc node handling for the new NameNode, FullyQualifiedNameNode, and RelativeNameNode types (#8883) Thanks @​ondrejmirtes

Released Rector 2.8.2

Leaner PHPDoc stack and a fluent composer-based config 🚀

This release leans on phpstan/phpdoc-parser directly: Rector drops its own forked parser, printer, token iterator and type-node subclasses, and reuses the upstream parser, format-preserving printer, node traverser and type nodes. Fewer moving parts, one source of truth for PHPDoc handling, and it rides the PHPStan 2.3.3 bump. Thanks @​ondrejmirtes.

On the config side, withComposerBased() now auto-detects installed packages when called with no argument, and a fluent withComposerBasedRule() builder lands across core and the rector-* sets.

New features 🥳

• Add withComposerBasedRule() to the fluent RectorConfig::configure() builder (#8875)
• [Configuration] Auto-detect installed packages in withComposerBased() called with no argument (#8748) Thanks @​MadBox-99
• [TypeDeclaration] Prefer same-namespace classes over global PHPDoc types (#8869) Thanks @​MohannadElemary
• [dx] Report rule-scoped skips that matched a file but never changed it (#8853)

Performance Improvements 🚀

• Reduce memory usage on the LPT bucket by recycling workers and keeping files in discovery order (#8867) Thanks @​samsonasik
• Cache skip-filtered rules per node class for the current file in RectorRegistry::forNodeAndFile() (#8860) Thanks @​samsonasik
• Remove unneeded array_values() when arrays are already lists or called too early (#8857) Thanks @​samsonasik

... (truncated)

Commits

• 12ddb68 Rector 2.8.3
• 768a3dc Updated Rector to commit 8323e93e55a40fb408fae7af4e5ba8b770fa8441
• 7c07b79 Updated Rector to commit 62e0fccbe42cebe7d5b3281b687aa404e6120ede
• b8a1dca Updated Rector to commit 62e0fccbe42cebe7d5b3281b687aa404e6120ede
• 0207c40 Updated Rector to commit 62e0fccbe42cebe7d5b3281b687aa404e6120ede
• 85ff869 Updated Rector to commit 6f8df55c5210ab07b644da15a57111bd65d3690e
• 066425d Updated Rector to commit e291f0d9bc43002279494134a993abc59a27d465
• 69d19ec Updated Rector to commit 8271f5dd75261f4532e3ba6d9ae34649d3d9cffb
• ebc7e41 Updated Rector to commit 7aef6aac3302fe53bf0a3cd8369d496f3a0c84c1
• 03a365d Rector 2.8.2
• Additional commits viewable in compare view

[yasukei]

@dependabot rebase