[timkley]

Summary

Dependabot PR #63 only replaces guzzlehttp/guzzle: ^7.0 with ^8.3. That hard major switch is not safe to merge. This SDK also requires illuminate/http: ^11.0|^12.0|^13.2.0, and those Laravel HTTP releases do not all accept Guzzle 8:

• illuminate/http 11 and 12 require guzzlehttp/guzzle: ^7.8.2
• illuminate/http 13.2 through 13.25 also require ^7.8.2
• illuminate/http 13.26 and later allow ^7.8.2 || ^8.0, plus guzzlehttp/promises: ^2.0.3 || ^3.0 and guzzlehttp/psr7: ^2.9 || ^3.0

A constraint of ^8.3 would make this package uninstallable on Laravel 11, Laravel 12, and Laravel 13 below 13.26. The existing CI matrix installs orchestra/testbench: 9.* (Laravel 11), so that hard switch would also fail CI.

This PR keeps both majors:

"guzzlehttp/guzzle": "^7.0 || ^8.3"

^7.0 is unchanged, so current Guzzle 7 applications keep resolving. The 8.x floor is ^8.3 (not ^8.0) because 8.3 is the release Dependabot proposed and the first 8.x line that requires guzzlehttp/promises: ^3.1 and guzzlehttp/psr7: ^3.2, which is the stack reviewed below. Composer still prefers the highest match: an unconstrained composer update installs Guzzle 8.3 with illuminate/http 13.38. Laravel 11/12, and Laravel 13 before 13.26, stay on Guzzle 7.

PR #63 is left open and is not merged.

Breaking changes reviewed

Guides read:

• Guzzle 7 to 8
• guzzlehttp/psr7 2.x to 3.0, plus the 3.0.0–3.2.0 changelog (native PSR-7 types, stricter headers/URIs/queries/streams; 3.1 and 3.2 are stream bugfixes)
• guzzlehttp/promises 2.x to 3.0, plus the 3.0.0–3.1.0 changelog (Is deprecated in favour of State in 3.1; no call sites here)

This package does not construct Guzzle clients, handlers, middleware, cookies, multipart bodies, or pools. HTTP goes through Illuminate\Http\Client. The only direct Guzzle symbol is GuzzleHttp\Promise\PromiseInterface on Api::$latestResponse. That interface still exists in promises 2.x and 3.x; the new generic PHPDoc is analysis-only, and phpstan.neon already ignores missingType.generics.

Checked against this repo, with no source change required:

• Removed client magic (Client::__call), ClientInterface::getConfig, GuzzleHttp functions, Utils::jsonDecode / jsonEncode, and RetryMiddleware::exponentialDelay are not used.
• Verbs go through Laravel's get / post / put / patch / delete / head, which send uppercase methods. Endpoint::request() dispatches to those methods; it does not pass a lowercase method string into Guzzle.
• Weaviate::__construct() already documents additional headers as array<string, string>. Guzzle 8 rejects non-string header values; this library does not set any.
• Query parameters are forwarded as given. The library does not build nested query arrays. psr7 3 rejects those; scalars are still accepted. On Laravel 13.26+, Illuminate normalizes header and query values before they reach Guzzle.
• No auth, cookie, proxy, IDN, sink, or handler options are set. Timeout is a positive integer (30 by default).

illuminate/http 13.38 (the version resolved with Guzzle 8.3.1) already adapts its own Guzzle calls for promises 3 and psr7 3.

Test status

PHP 8.3.6, Composer 2.7.1. No Weaviate instance and no network calls in the suite: tests use Illuminate\Http\Client\Factory::fake(). composer.lock is gitignored and was not committed.

Guzzle 8, unconstrained composer update

Resolved guzzlehttp/guzzle 8.3.1, guzzlehttp/promises 3.1.0, guzzlehttp/psr7 3.2.0, illuminate/http 13.38.0. composer audit reported no advisories.

• composer test — 36 passed (48 assertions)
• composer phpstan — no errors

A local PHP server also received a real request from the SDK (meta() and post('graphql', ...)): User-Agent: GuzzleHttp/8, Authorization: Bearer …, the extra header as a string, JSON body, and ?limit=10.

Guzzle 7, same install path as CI

composer require orchestra/testbench:9.* --dev --no-update, then composer update --prefer-dist. Resolved guzzlehttp/guzzle 7.16.1, guzzlehttp/promises 2.6.0, guzzlehttp/psr7 2.13.2, laravel/framework 11.57.0. Testbench was not left in composer.json.

• composer test — 36 passed (48 assertions)
• composer phpstan — no errors

composer audit on that tree reported five advisories, all in laravel/framework 11.57.0 pulled by Testbench 9, not in Guzzle.

PHP CS Fixer was not run. No PHP sources changed; the fixer config only scans src/ and tests/.

The existing matrix still installs Testbench 9 and therefore Guzzle 7 (prefer-lowest and prefer-stable). A new guzzle-8 job runs composer update --prefer-stable without Testbench, asserts that Guzzle 8 is installed, then runs composer test and composer phpstan. PHP 8.4 and 8.5 were not executed locally; the existing matrix still covers them on the Guzzle 7 / Testbench 9 path.