Skip to content

v1.7.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Jul 20:31
· 8 commits to main since this release
v1.7.1
4e0c2f5

Security

  • Bump guzzlehttp/guzzle to ^7.15.1 to clear nine dependency advisories. The previous ^7.11.1 floor still resolved versions affected by seven Guzzle advisories (URI fragments leaking into Referer on redirect, host-only cookie scope not preserved, unbounded response cookies, Proxy-Authorization sent to origin servers, dot-only cookie domains matching all hosts, a silent HTTPS→cleartext proxy downgrade, and CVE-2026-59883 cookie disclosure/injection via IP-address domains) and, transitively, two guzzlehttp/psr7 advisories (host confusion via weak URI host validation, CRLF injection in start-line serialization). ^7.15.1 pulls a fixed Guzzle which in turn requires guzzlehttp/psr7 >= 2.13, so composer audit now reports no advisories. No code changes — the agent's HTTP surface is unchanged.

Full Changelog: v1.7.0...v1.7.1

Assets 2
Loading