[gustavofreze]

Please follow the contributing guidelines.

Summary

• composer.json requires tiny-blocks/http ^8.0 (was ^7.2). 8.0 validates every header that reaches a response, rejects the connection-specific ones and restricts the protocol version to 1.0, 1.1, 2 and 3 (tiny-blocks/http#74).
• No code change. The only header the library sets is Link, built from the base URI and from query values that Uri percent-encodes, and it sets no protocol version. One behavior change reaches consumers through 8.0: a base URI carrying a control character other than CR or LF (which Link already refuses with LinkUriIsInvalid), such as NUL, now makes toResponse() on Offset\Page, Offset\Slice and Cursor\Page throw HeaderValueIsInvalid instead of writing it into the Link header. A base URI taken from the request path cannot carry one.

CI

CI resolves tiny-blocks/http ^8.0 from Packagist, so it stays red until tiny-blocks/http 8.0.0 is published. Merge after that release and a green re-run.

Locally, against the 8.0 branch of tiny-blocks/http installed through a temporary, uncommitted path repository, make tests passes (440 tests, 803 mutants, MSI 100%). make review fails on one finding unrelated to this change: slevomat/coding-standard 8.31.3 (released 2026-10-28, resolved by any fresh install) reports a cognitive complexity of 7 for Sort::fromExpression(), above the limit of 5. Sort.php is untouched since 1.0.0 and passed under 8.31.1, so the auto-review job will fail on it too until it is addressed in its own change.

Release

Recommended release: 3.0.0 (major). The public API exposes tiny-blocks/http types: Links::toHeader() returns TinyBlocks\Http\Link, and Navigation::with() and NavigationTarget::to() take TinyBlocks\Http\LinkRelation. Raising the required major of that dependency is a breaking change for consumers.

Related issue

None.

Checklist

• Tests added or updated.
• Documentation updated when applicable.
• make review passes.
• make tests passes.