What's Changed

• Foundational improvements to v4 by @JonPurvis in #539
• Feature | v4 - Add opt in to base url overrides by @JonPurvis in #542
• Fixed CVE-2026-33942 - Insecure deserialisation in AccessTokenAuthenticator (object injection / RCE)
• Fixed CVE-2026-33182 - Absolute URL in endpoint overrides base URL (SSRF / credential leakage)
• Fixed CVE-2026-33183 - Fixture name path traversal (out-of-bounds file read/write)

Full Changelog: v3.15.0...v4.0.0

Contributors

• @JonPurvis

What's Changed

• Swap header to use psrResponse by @JonPurvis in #535
• Feature | Add Macroable Trait To Request & Connector Classes by @Sammyjo20 in #526
• Allow defining a default handler stack by @epixian in #475
• Add conditional return type to ClientCredentialsGrant getAccessToken by @kevinmade in #516

New Contributors

• @epixian made their first contribution in #475
• @kevinmade made their first contribution in #516

Full Changelog: v3.14.3...v3.15.0

Contributors

• @JonPurvis
• @Sammyjo20
• @epixian
• @kevinmade

What's Changed

• Handle lowercase Content-Type header for JSON and XML by @JonPurvis in #534

Full Changelog: v3.14.2...v3.14.3

Contributors

• @JonPurvis

What's Changed

• Feature | PHP 8.5 Support by @Sammyjo20 in #525

Full Changelog: v3.14.1...v3.14.2

Contributors

• @Sammyjo20

What's Changed

• Add allow stray requests method to config by @ziadoz in #522

New Contributors

• @ziadoz made their first contribution in #522

Full Changelog: v3.14.0...v3.14.1

Contributors

• @ziadoz

What's Changed

• Feature | Increase Exception Body Message Limit by @Sammyjo20 in #503

Full Changelog: v3.13.1...v3.14.0

Contributors

• @Sammyjo20

What's Changed

• Fix | URLHelper incorrectly URLs with underscores by @Sammyjo20 in #502

Full Changelog: v3.13.0...v3.13.1

Contributors

• @Sammyjo20

What's Changed

• Feature | Add Context To Fixtures by @Gummibeer in #444

Full Changelog: v3.12.0...v3.13.0

Contributors

• @Gummibeer

What's Changed

• Feature | Added isJson and isXML functions to Response class by @mstfblci in #455
• Chore | Dev Dependencies Update by @Sammyjo20 in #494
• Leverage PHPStan conditional return types for more precise return-type declarations by @yankewei in #492

New Contributors

• @mstfblci made their first contribution in #455
• @yankewei made their first contribution in #492

Full Changelog: v3.11.2...v3.11.3

Contributors

• @mstfblci
• @yankewei
• @Sammyjo20

What's Changed

• Revert "Make sure multiple assertions can be made on the same request class" by @Sammyjo20 in #486
• Revert "Feature | Accept type-hinted requests as assertSent parameters" by @Sammyjo20 in #487

Full Changelog: v3.11.1...v3.11.2

Contributors

• @Sammyjo20