Update dependency psr/http-message to v2

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
psr/http-message	require	major	^1.0 -> ^1.0 || ^2.0

---

Release Notes

php-fig/http-message

v2.0

Compare Source

Added return types, see https://www.php-fig.org/psr/psr-7/meta/[#​72](https://togithub.com/php-fig/http-message/issues/72)-type-additions

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

Read more information about the use of Renovate Bot within Laminas.

[boesing]

Please do not just merge this, there is no check which verifies that psr/http-message v2 is installed.
I wonder if we can somehow improve this by slightly modifying the composer.json to get rid of non-platform dependency widening packages.

So in this case, for locked nothing might change, for lowest we remove all upper major versions and for latest we remove all lower major versions.

This will become:

lowest

{
    "require": {
        "psr/http-message": "^1.0"
    }
}

latest

{
    "require": {
        "psr/http-message": "^2.0"
    }
}

---

We had the same issue in laminas/laminas-cache where PSR-6 & PSR-16 updates did not had failed tests after extending the supported dependency range. That was, because there is nothing which verifies if these versions are actually being installed.

So most probably, for every dependency which declares multiple major versions, a matrix job needs to be created which enforces all major versions so that we can actually verify that we do install them.

Any ideas/thoughts on this @mezzio/technical-steering-committee?

I think that Matthew also meant this kind of check here.

[weierophinney]

@boesing Also... I'll have PRs incoming this week for Diactoros around this. I think once those are in place, we can tackle some of these. In most cases for consumers, however, we should be able to allow ^1.0 || ^2.0. As you note, however, we need to be able to test against both in the CI.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠ Warning: custom changes will be lost.

[gsteel]

CI is currently testing on both major versions for lowest/latest.

Given that we don't currently have a workflow for testing strategies per major release of deps, do you have any objection to merging and releasing @boesing

[internalsystemerror]

Yep, can confirm both versions are being tested with this PR:

https://github.com/mezzio/mezzio-problem-details/actions/runs/4904438255/jobs/8757514065?pr=39#step:3:248
https://github.com/mezzio/mezzio-problem-details/actions/runs/4904438552/jobs/8757514572?pr=39#step:3:290

LGTM, I think we can 🚢 now