Prepare release 2.7.0

Author: sad-spirit

Changelog.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## [2.7.0] - 2025-04-06
+
+### Added
+* Tested on PHP 8.4;
+* Psalm 6 used for static analysis;
+* Updated Public Suffix List.
+
+### Fixed
+* Prevent XSS when PHP files backing server-side tests are served from a publicly available website,
+  thanks to Peter Potrowl (peter017 at gmail dot com) for the report.
+* `data/generate-list.php` will only run with a command-line SAPI.
+* Better random value used for `cnonce` parameter in Digest authentication, see [issue #30].
+  Digest authentication should be considered deprecated, however.
+* `psalm.xml` configuration file is no longer installed by composer.
+
 ## 2.6.0 - 2023-11-01
 * Tested on PHP 8.2 and 8.3
 * Use [psalm] for static analysis, several minor issues fixed
@@ -57,5 +72,8 @@ no longer uses include-path and does not contain require_once statements
 [issue #20]: https://github.com/pear/HTTP_Request2/issues/20
 [issue #23]: https://github.com/pear/HTTP_Request2/issues/23
 [issue #25]: https://github.com/pear/HTTP_Request2/issues/25
+[issue #30]: https://github.com/pear/HTTP_Request2/issues/30
 [psalm]: https://psalm.dev/
 [pull request #26]: https://github.com/pear/HTTP_Request2/pull/26
+
+[2.7.0]: https://github.com/pear/HTTP_Request2/compare/v2.6.0...v2.7.0

package.xml

@@ -25,22 +25,30 @@ deflate encodings, redirects, monitoring the request progress with Observers...
     <email>[email protected]</email>
     <active>yes</active>
   </lead>
-  <date>2023-11-01</date>
+  <date>2025-04-06</date>
   <version>
-    <release>2.6.0</release>
+    <release>2.7.0</release>
     <api>2.4.0</api>
   </version>
   <stability>
     <release>stable</release>
     <api>stable</api>
   </stability>
-  <license uri="http://opensource.org/licenses/BSD-3-Clause">BSD 3-Clause License</license>
+  <license uri="https://opensource.org/licenses/BSD-3-Clause">BSD 3-Clause License</license>
   <notes>
- * Tested on PHP 8.2 and 8.3
- * Use psalm for static analysis, several minor issues fixed
- * Correctly parse HTTP status line with an empty reason-phrase
-   (see https://github.com/pear/HTTP_Request2/pull/26)
- * Updated Public Suffix List
+Added:
+ * Tested on PHP 8.4;
+ * Psalm 6 used for static analysis;
+ * Updated Public Suffix List.
+
+Fixed:
+ * Prevent XSS when PHP files backing server-side tests are served from
+   a publicly available website, thanks to Peter Potrowl
+   (peter017 at gmail dot com) for the report.
+ * data/generate-list.php will only run with a command-line SAPI.
+ * Better random value used for `cnonce` parameter in Digest authentication,
+   see https://github.com/pear/HTTP_Request2/issues/30.
+   Digest authentication should be considered deprecated, however.
   </notes>
   <contents>
     <dir name="/">
@@ -255,6 +263,25 @@ deflate encodings, redirects, monitoring the request progress with Observers...
    </filelist>
   </phprelease>
   <changelog>
+    <release>
+      <date>2023-11-01</date>
+      <version>
+        <release>2.6.0</release>
+        <api>2.4.0</api>
+      </version>
+      <stability>
+        <release>stable</release>
+        <api>stable</api>
+      </stability>
+      <license uri="http://opensource.org/licenses/BSD-3-Clause">BSD 3-Clause License</license>
+      <notes>
+        * Tested on PHP 8.2 and 8.3
+        * Use psalm for static analysis, several minor issues fixed
+        * Correctly parse HTTP status line with an empty reason-phrase
+          (see https://github.com/pear/HTTP_Request2/pull/26)
+        * Updated Public Suffix List
+      </notes>
+    </release>
     <release>
       <date>2022-01-06</date>
       <version>
@@ -288,7 +315,7 @@ deflate encodings, redirects, monitoring the request progress with Observers...
         * Socket adapter will now retry writing to socket rather than throw an exception if `fwrite()` call
           returns zero written bytes
              https://github.com/pear/HTTP_Request2/issues/23
-       
+
        Changed
         * Socket adapter will use only TLS 1.2 and TLS 1.3
           (the latter is available on PHP 7.4+)
@@ -346,7 +373,7 @@ https://github.com/pear/HTTP_Request2/issues/20
 * Minimum required version is now PHP 5.6, as using older versions for HTTPS
   requests may be insecure
 * Removed support for magic_quotes_runtime, as get_magic_quotes_runtime()
-  was deprecated in PHP 7.4 and the functionality itself was disabled 
+  was deprecated in PHP 7.4 and the functionality itself was disabled
   since PHP 5.4 (bug #23839)
 * Socket adapter now uses socket in non-blocking mode, as some configurations
   could have problems with timeouts in HTTPS requests (bug #21229)