vcswatch reports that
this package seems to have a new changelog entry (version
3.2.0-2, distribution
unstable) and new commits
in its VCS. You should consider whether it's time to make
an upload.
https://salsa.debian.org/api/v4/projects/php-team%2Fpear%2Fphp-guzzlehttp-psr7 API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.
1 issue left for the package maintainer to handle:
CVE-2026-59882:
(needs triaging)
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost() to disagree with the URI authority used for security or routing decisions. This issue is fixed in version 2.12.3.
Among the 2 debian patches
available in version 2.13.1-1 of the package,
we noticed the following issues:
1 patch
where the metadata indicates that the patch has not yet been forwarded
upstream. You should either forward the patch upstream or update the
metadata to document its real status.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/p/php-guzzlehttp-psr7.png){kind=link}