v3.1.0

Security

• Parser: byte-accurate strlen payload limit (was mb_strlen); per-
  transaction body cap (default 256 KiB); strict whitelist of forwarded
  parent headers (default: accept, accept-language, content-type,
  user-agent); blacklist now drops cookie, set-cookie, authorization,
  x-csrf-token; $_SERVER filtered through whitelist; parse_str
  guarded against array-bomb (max 1000 fields).
• Validator: combined path-traversal regex; URI re-checked after
  iterative rawurldecode (defeats double-encoded %2e%2e%2f,
  protocol-relative variants); per-transaction content-length guard;
  recursive sub-batch SSRF guard via metadata flag.
• ResponseFormatter: strips set-cookie, authorization, proxy-auth*,
  server, x-powered-by from sub-responses to prevent session/header
  leakage through the batch envelope.
• Facades: parent Authorization header never propagated; new top-level
  "authorization" field in each sub-request injects a per-transaction
  bearer token; trace logs redact authorization|password|token|secret| api_key and truncate to 4 KiB; rate-limit decoding done once.

Performance

• Handler: optional ExecutionStrategyInterface (default sequential,
  BC-safe). New FiberExecutionStrategy parallelises contiguous read-
  only blocks (GET/HEAD only, write ops always serialised) via PHP
  Fibers with bounded maxConcurrency (default 8).
• Parser: generator-driven transaction yielding; pre-flipped O(1) header
  maps; single-pass header/cookie/server filtering.
• ResponseFormatter: BinaryFileResponse streamed in 8190-byte chunks
  (peak RAM ≈ chunk size instead of full file); pre-compiled regex/map
  constants.
• BatchResponse: manual loop in getFailureCount (no array_filter
  closure allocation).

Testing

• Add FiberVsSequentialBenchmarkTest covering pure-CPU, blocking I/O
  and cooperative I/O scenarios with deterministic assertions.
• Update LaravelTransactionExecutorTest to assert Set-Cookie is
  stripped from sub-responses (new secure default).

BREAKING CHANGE: Set-Cookie headers are no longer forwarded from sub-
responses into the batch envelope; parent-request Authorization /
Cookie headers are no longer forwarded into sub-requests. Use the new
top-level "authorization" payload field per sub-request, or override
forwardedHeadersWhitelist in the facade constructor.