Fixed
The package referenced Guzzle and PSR-7 without requiring them. Three namespaces appeared in real signatures in src/ while composer.json declared neither package: GuzzleHttp\TransferStats (in Guard::pinnedOptions()), GuzzleHttp\Promise\PromiseInterface and Psr\Http\Message\RequestInterface (in GuardRequestMiddleware and GuardedHandler).
They arrived transitively, but not dependably: illuminate/http only began requiring guzzlehttp/guzzle partway through the 12.x line — v12.0.0 requires nothing Guzzle-related, v12.64.0 requires ^7.8.2. An app pinned to early 12.x under this package's illuminate/http: ^12.0 would autoload GuardedHandler against a class that isn't there.
Now declared:
| Package | Constraint | |
|---|---|---|
guzzlehttp/guzzle |
^7.8.2 || ^8.0 |
require |
guzzlehttp/promises |
^2.0 || ^3.0 |
require |
psr/http-message |
^1.1 || ^2.0 |
require |
guzzlehttp/psr7 |
^2.9 || ^3.0 |
require-dev |
Note TransferStats lives in guzzlehttp/guzzle itself rather than guzzlehttp/promises, and sits in pinnedOptions() rather than the middleware — so this is the whole client, not just the promise layer.
branch-alias declared dev-main as 1.3.x-dev after v1.3.0 had shipped, pointing dev consumers at a closed series; it now tracks 1.4.x-dev.
Upgrade notes
No code changes, no behaviour changes, no config changes. sbom.json regenerates byte-identical at 73 production components — the installed graph is unchanged, only the declaration.
Released as a minor rather than a patch because new require constraints can narrow resolution for a consumer that previously resolved.