chore: bump psr/http-message to ^1.0|^2.0

[msbit]

I have a project using both:

• tuupola/cors-middleware, and
• psr/http-message

and would like to bring psr/http-message up to ^2.0.

However, the transitive dependency of tuupola/cors-middleware -> neomerx/cors-psr7 -> psr/http-message ^1.0 is holding that back.

Uses of psr/http-message in this project seem to be constrained to:

• Psr\Http\Message\RequestInterface

which has only changed between 1.1 and 2.0 by adding return types to the methods.

[filisko]

HI @msbit this change has been added to https://github.com/middlewares/cors-psr7/blob/main/composer.json, a fork that we just did.

[msbit]

@filisko that's great, but I am not depending on neomerx/cors-psr7 directly (as noted above) so perhaps mention this at tuupola/cors-middleware if you haven't already?

EDIT:

tuupola/cors-middleware#88 shows a willingness to accept a fork of neomerx/cors-psr7 as a dependency.

[WardVH]

+1 — running into the exact same need. Verified this 1-line change works: forked from develop, applied the same constraint widen, ran the full upstream test suite on PHP 8.4 with psr/http-message 2.0 installed → all 17 tests / 108 assertions pass. src/Analyzer.php is the only file touching PSR-7 types and it only consumes RequestInterface as a parameter (no interface implementations to update), which matches the analysis in the PR description.

If this isn't moving for some reason, would another reviewer (e.g. @neomerx) be able to take a look? A growing number of projects depend on this transitively via tuupola/cors-middleware and are stuck on psr/http-message ^1.0 because of this.

[tuupola]

I think this library is abandoned and needs to be forked.