sabre/http

7.1.0 (2026-05-31)

• #280 chore: support PHP 8.2 and up ( @phil-davis )
• #282 test: migrate to phpunit 11 ( @phil-davis )

This release drops support for PHP 7.4 8.0 and 8.1

• #280 chore: support PHP 8.2 and up ( @phil-davis )
• #282 test: migrate to phpunit 11 ( @phil-davis )

7.0.6 (2026-04-27)

• #259 chore (ci): add CI for PHP 8.5 on 6.0 branch ( @phil-davis )
• #273 test: adjust code style ( @phil-davis )
• #272 fix(http/client): prefer CURLOPT_PROTOCOLS_STR over deprecated bitmask constants ( @ralflang )
• #255 chore: update to phpstan major version 2
• #278 chore: add rector ( @phil-davis )

This release continues to support PHP 7.4 and 8.0 through 8.5

• #259 chore (ci): add CI for PHP 8.5 on 6.0 branch ( @phil-davis )
• #273 test: adjust code style ( @phil-davis )
• #272 fix(http/client): prefer CURLOPT_PROTOCOLS_STR over deprecated bitmask constants ( @ralflang )
• #255 chore: update to phpstan major version 2
• #278 chore: add rector ( @phil-davis )

7.0.5 (2025-09-09)

• #257 properly compute absolute URL (@skjnldsv)

• #257 properly compute absolute URL (@skjnldsv)

7.0.4 (2024-09-06)

• #227 Remove redundant PHP doc to make cs-fixer pass ( @phil-davis )
• #229 ci: Create dependabot.yml ( @DeepDiver1975 )
• #231 Add PHP 8.3 to CI ( @phil-davis )
• #234 use php-cs-fixer 3.51 ( @phil-davis )
• #235 adjust for php-cs-fixer 3.54.0 ( @phil-davis )
• #237 stop exporting php-cs-fixer config ( @phil-davis )
• #247 tool changes - add PHP 8.4 to CI ( @phil-davis )

• #227 Remove redundant PHP doc to make cs-fixer pass ( @phil-davis )
• #229 ci: Create dependabot.yml ( @DeepDiver1975 )
• #231 Add PHP 8.3 to CI ( @phil-davis )
• #234 use php-cs-fixer 3.51 ( @phil-davis )
• #235 adjust for php-cs-fixer 3.54.0 ( @phil-davis )
• #237 stop exporting php-cs-fixer config ( @phil-davis )
• #247 tool changes - add PHP 8.4 to CI ( @phil-davis )

• #215 Improve CURLOPT_HTTPHEADER Setting Assignment (@amrita-shrestha)

• #203 Add phpstan phpunit strict-rules (@phil-davis)

• #207 fix: handle client disconnect properly with ignore_user_abort true (@kesselb)

• #198 Allow sabre/uri major version 3 ( @phil-davis )

6.0.5 (2026-04-27)

• #267 chore (ci): add CI for PHP 8.5 on 6.0 branch (@phil-davis)
• #274 test: adjust code style (@phil-davis)
• #275 fix(http/client): prefer CURLOPT_PROTOCOLS_STR over deprecated bitmask constants (@ralflang)

• #267 chore (ci): add CI for PHP 8.5 on 6.0 branch (@phil-davis)
• #274 test: adjust code style (@phil-davis)
• #275 fix(http/client): prefer CURLOPT_PROTOCOLS_STR over deprecated bitmask constants (@ralflang)

6.0.4 (2025-09-09)

• #260 properly compute absolute URL (@skjnldsv)

• #260 properly compute absolute URL (@skjnldsv)

6.0.3 (2024-09-06)

• #228 Remove redundant PHP doc to make cs-fixer pass ( @phil-davis )
• #236 adjust for php-cs-fixer 3.54.0 ( @phil-davis )
• #249 add PHP 8.3 and 8.4 to CI of 6.0 branch ( @phil-davis )

• #228 Remove redundant PHP doc to make cs-fixer pass ( @phil-davis )
• #236 adjust for php-cs-fixer 3.54.0 ( @phil-davis )
• #249 add PHP 8.3 and 8.4 to CI of 6.0 branch ( @phil-davis )

• #215 Improve CURLOPT_HTTPHEADER Setting Assignment (@amrita-shrestha)

• #207 fix: handle client disconnect properly with ignore_user_abort true (@kesselb)

• #191 Create .gitattributes (@cedric-anne)
• #176 Test enhancement (from original PR #98) (@peter279k)
• #192 Set min PHP to 7.4 and add type declarations (@phil-davis)
• #194 Adjust type declarations a little bit (@phil-davis)

5.1.13 (2025-09-09)

• #262 properly compute absolute URL (@skjnldsv)

• #262 properly compute absolute URL (@skjnldsv)

5.1.12 (2024-08-27)

• #243 add cs-fixer v3 (@phil-davis)

This release just has code-style changes applied by php-cs-fixer major version 3.
No change to behavior.

• #243 add cs-fixer v3 (@phil-davis)

5.1.11 (2024-07-26)

• #241 PHP 8.4 compliance (@phil-davis)

• #241 PHP 8.4 compliance (@phil-davis)

• #225 Enhance tests/bootstrap.php to find autoloader in more environments (@phil-davis)

• #223 skip testParseMimeTypeOnInvalidMimeType (@phil-davis)

• #215 Improve CURLOPT_HTTPHEADER Setting Assignment (@amrita-shrestha)

• #98 and #176 Add more tests (@peter279k)
• #207 fix: handle client disconnect properly with ignore_user_abort true (@kesselb)

• #187 Allow testSendToGetLargeContent peak memory usage to be specified externally (@phil-davis)
• #188 Fix various small typos and grammar (@phil-davis)
• #189 Fix typo in text of status code 203 'Non-Authoritative Information' (@phil-davis)

• #184 Remove 4GB file size workaround for 32bit OS / Stream Videos on IOS (@schoetju)

• #182 Fix encoding detection on PHP 8.1 (@come-nc)

• #179 version bump that was missed in 5.1.2 (@phil-davis)

• #169 Ensure $_SERVER keys are read as strings (@fredrik-eriksson)
• #170 Fix deprecated usages on PHP 8.1 (@cedric-anne)
• #175 Add resource size to CURL options in client (from #172 ) (@Dartui)

• #160: Added support for PHP 8.0 (@phil-davis)

• Added support for PHP 7.4, dropped support for PHP 7.0 (@phil-davis)
• Updated testsuite for phpunit8, added phpstan coverage (@phil-davis)
• Added autoload-dev for test classes (@C0pyR1ght)

• #138: Fixed possible infinite loop (@dpakach, @vfreex, @phil-davis)
• #136: Improvement regex content-range (@ho4ho)

• #133: Fix short Content-Range download - Regression from 5.0.3 (@phil-davis)

• #119: Significantly improve file download speed by enabling mmap based stream_copy_to_stream (@vfreex)

• #125: Fix Strict Error if Response Body Empty (@WorksDev, @phil-davis)

• #121: fix "Trying to access array offset on value of type bool" in 7.4 (@remicollet)
• #115: Reduce memory footprint when parsing HTTP result (@Gasol)
• #114: Misc code improvements (@mrcnpdlk)
• #111, #118: Added phpstan analysis (@DeepDiver1975, @staabm)
• #107: Tested with php 7.3 (@DeepDiver1975)

• #99: Previous CURL opts are not persisted anymore (@christiaan)
• Final release

• Now requires PHP 7.0+.
• Supports sabre/event 4.x and 5.x
• Depends on sabre/uri 2.
• hhvm is no longer supported starting this release.
• #65: It's now possible to supply request/response bodies using a callback functions. This allows very high-speed/low-memory responses to be created. (@petrkotek).
• Strict typing is used everywhere this is applicable.
• Removed URLUtil class. It was deprecated a long time ago, and most of its functions moved to the sabre/uri package.
• Removed Util class. Most of its functions moved to the functions.php file.
• #68: The $method and $uri arguments when constructing a Request object are now required.
• When Sapi::getRequest() is called, we default to setting the HTTP Method to CLI.
• The HTTP response is now initialized with HTTP code 500 instead of null, so if it's not changed, it will be emitted as 500.
• #69: Sending charset="UTF-8" on Basic authentication challenges per [rfc7617][rfc7617].
• #84: Added support for SERVER_PROTOCOL HTTP/2.0 (@jens1o)

• #74, #77: Work around 4GB file size limit at 32-Bit systems

• #72: Handling clients that send invalid Content-Length headers.

• #56: getBodyAsString now returns at most as many bytes as the contents of the Content-Length header. This allows users to pass much larger strings without having to copy and truncate them.
• The client now sets a default User-Agent header identifying this library.

• This package now supports sabre/event 3.0.

• The async client wouldn't wait() for new http requests being started after the (previous) last request in the queue was resolved.
• Added Sabre\HTTP\Auth\Bearer, to easily extract a OAuth2 bearer token.

• Deprecated: All static functions from Sabre\HTTP\URLUtil and Sabre\HTTP\Util moved to a separate functions.php, which is also autoloaded. The old functions are still there, but will be removed in a future version. (#49)

• Added a parser for the HTTP Prefer header, as defined in [RFC7240][rfc7240].
• Deprecated Sabre\HTTP\Util::parseHTTPDate, use Sabre\HTTP\parseDate().
• Deprecated Sabre\HTTP\Util::toHTTPDate use Sabre\HTTP\toDate().

• #45: Don't send more data than what is promised in the HTTP content-length. (@dratini0).
• #43: getCredentials returns null if incomplete. (@Hywan)
• #48: Now using php-cs-fixer to make our CS consistent (yay!)
• This includes fixes released in version 3.0.5.

• #41: Fixing bugs related to comparing URLs in Request::getPath().
• #41: This library now uses the sabre/uri package for uri handling.
• Added 421 Misdirected Request from the HTTP/2.0 spec.

• #47 #35: When re-using the client and doing any request after a HEAD request, the client discards the body.

• #38: The Authentication helpers no longer overwrite any existing WWW-Authenticate headers, but instead append new headers. This ensures that multiple authentication systems can exist in the same environment.

• Hiding Authorization header value from Request::__toString.

• When parsing Accept: headers, we're ignoring invalid parts. Before we would throw a PHP E_NOTICE.

• Minor change in unittests.

• getHeaders() now returns header values as an array, just like psr/http.
• Added hasHeader().

• Changed: Copied most of the header-semantics for the PSR draft for representing HTTP messages. [Reference here][psr-http].
• This means that setHeaders() does not wipe out every existing header anymore.
• We also support multiple headers with the same name.
• Use Request::getHeaderAsArray() and Response::getHeaderAsArray() to get a hold off multiple headers with the same name.
• If you use getHeader(), and there's more than 1 header with that name, we concatenate all these with a comma.
• addHeader() will now preserve an existing header with that name, and add a second header with the same name.
• The message class should be a lot faster now for looking up headers. No more array traversal, because we maintain a tiny index.
• Added: URLUtil::resolve() to make resolving relative urls super easy.
• Switched to PSR-4.
• #12: Circumventing CURL's FOLLOW_LOCATION and doing it in PHP instead. This fixes compatibility issues with people that have open_basedir turned on.
• Added: Content negotiation now correctly support mime-type parameters such as charset.
• Changed: Util::negotiate() is now deprecated. Use Util::negotiateContentType() instead.
• #14: The client now only follows http and https urls.

• Changed: No longer escaping @ in urls when it's not needed.
• Fixed: #7: Client now correctly deals with responses without a body.

• Now works on hhvm!
• Fixed: Now throwing an error when a Request object is being created with arguments that were valid for sabre/http 1.0. Hopefully this will aid with debugging for upgraders.

• Fixed: Potential security problem in the client.

• Fixed: getBodyAsString on an empty body now works.
• Fixed: Version string

• Removed: Request::createFromPHPRequest. This is now handled by Sapi::getRequest.

• Added: Asynchronous HTTP client. See examples/asyncclient.php.
• Fixed: Issue #4: Don't escape colon (:) when it's not needed.
• Fixed: Fixed a bug in the content negotiation script.
• Fixed: Fallback for when CURLOPT_POSTREDIR is not defined (mainly for hhvm).
• Added: The Request and Response object now have a __toString() method that serializes the objects into a standard HTTP message. This is mainly for debugging purposes.
• Changed: Added Response::getStatusText(). This method returns the human-readable HTTP status message. This part has been removed from Response::getStatus(), which now always returns just the status code as an int.
• Changed: Response::send() is now Sapi::sendResponse($response).
• Changed: Request::createFromPHPRequest is now Sapi::getRequest().
• Changed: Message::getBodyAsStream and Message::getBodyAsString were added. The existing Message::getBody changed its behavior, so be careful.

• Added: HTTP Status 451 Unavailable For Legal Reasons. Fight government censorship!
• Added: Ability to catch and retry http requests in the client when a curl error occurs.
• Changed: Request::getPath does not return the query part of the url, so everything after the ? is stripped.
• Added: a reverse proxy example.

• Fixed: Doing a GET request with the client uses the last used HTTP method instead.
• Added: HttpException
• Added: The Client class can now automatically emit exceptions when HTTP errors occurred.