[kvz]

Dependabot’s Guzzle, PSR-7 and PHP_CodeSniffer security updates cannot resolve the old development lock against the SDK’s published PHP 7.4 minimum: php-coveralls locks psr/log 2.0.0, which requires PHP 8.

Resolve development dependencies at PHP 7.4 and refresh the lock to compatible patched releases. Set safe development floors for Guzzle, PSR-7, PHPUnit and PHP_CodeSniffer. Keep the public requirement at php >=7.4.0 and all six existing CI cases; add a PHP 7.4.33 locked case and validate locked installations against the actual runtime.

The PHP 7.4 run also exposed an existing invalid-HMAC warning before the intended exception. Validate the algorithm first so the existing regression test receives InvalidArgumentException consistently on PHP 7 and 8.

Validation:

• Composer manifest validation, clean lock audit, and all three individual security-update resolutions.
• Actual PHP 7.4.33 and PHP 8.3.36 lint/unit tests with Node 26 parity; existing invalid-algorithm test demonstrated the PHP 7.4 failure before the guard.
• Consumer resolution at PHP 7.4, 8.1 and 8.2.35; public runtime dependencies unchanged.
• Two council reviews without posting: both returned “No issues found.”
• PR CI: all seven cases green on f089e950, including the native PHP 7.4 install, API system tests and coverage.

Advisory floors: Guzzle 7.15.2, PSR-7 2.12.3, PHP_CodeSniffer 3.13.6. PHP’s HMAC warning/exception change explains the compatibility guard.

_{🤖 Claimed by kvz on framework1/php-sdk since 2026-10-22 · resume: codex resume 01a16227-a911-7581-be2f-48cb694033e9}

[github-actions]

Coverage report for commit: f089e95
File: ./build/logs/clover.xml

Summary - Lines: 89.84% | Methods: 65.22%

Files	Lines	Methods	Branches
lib/transloadit
CurlRequest.php	91.67%	66.67%	100.00%
CurlResponse.php	100.00%	100.00%	100.00%
Transloadit.php	86.67%	55.56%	100.00%
TransloaditRequest.php	89.83%	57.14%	100.00%
TransloaditResponse.php	100.00%	100.00%	100.00%

_{🤖 comment via lucassabreu/comment-coverage-clover}