Update react/promise dependency to v3.2.0+ for PHP 8.4 compatibility

[xppppy]

When using bunny/bunny in a PHP 8.4 environment, a TypeError is triggered due to an outdated version of react/promise (likely <3.2.0). The error stems from implicitly nullable type declarations in older versions of react/promise, which are no longer allowed in PHP 8.4 .

[WyriHaximus]

What version are you on @xppppy ?

[xppppy]

PHP 8.4.7 , bunny versions : * v0.5.6

[radimvaculik]

Same here ✋

We need to wait for bunny v0.6 (which already have react/promise v3) or backport react/promise v3 to bunny v0.5

[WyriHaximus]

PHP 8.4.7 , bunny versions : * v0.5.6

That would be promise v2 then, IIRC we're not updating it anymore and v3 is the way to go.

Same here ✋

We need to wait for bunny v0.6 (which already have react/promise v3) or backport react/promise v3 to bunny v0.5

v0.6 is very stable at this point, but I would love to get more feedback on from user it before releasing a stable. If you're up for it you can already try it out by targeting ^0.6@dev in composer.json. (Maybe I should release an alpha/beta version tbh.) 0.6 was born out of two things:

• Promise v3
• Fiber based sync looking API

Bringing promise v3 to 0.5 is going to be a challenge continuing supporting both as we made significant breaking changes to it's API and behavior that made it give up on it. I'm open for a PR that gets it to work tho.

[mdissington]

We've been running v0.6 since the end of last year, the only issue we faced was around February when a commit introduced either a bug or an incompatibility with our code. A couple of weeks later we were working back on @dev again - but I'm not sure if it was a later change of yours or ours that fixed it (sorry!).

I'm looking forward to a stable release as soon as is possible! 👍

[tomas-novotny]

v0.6 is very stable at this point, but I would love to get more feedback on from user it before releasing a stable

We use 0.6.x-dev on production for several months, mainly because Promise v3 support and more async stability.

Only issues we encountered was bugs in RabbitMQ server (upgrade helped) or non-ideal use of Event loop and this fixed bug.

I'm also looking forward to a "stable" release as v0.6.0.

[zolthan]

@WyriHaximus how is the current plan with 0.6? We have a security issue with composer/composer which requires us to update to ^3.3 of react/promise

+-------------------+----------------------------------------------------------------------------------+
| Package           | composer/composer                                                                |
| Severity          | low                                                                              |
| CVE               | CVE-2025-67746                                                                   |
| Title             | Composer is vulnerable to ANSI sequence injection                                |
| URL               | https://github.com/advisories/GHSA-59pp-r3rg-353g                                |
| Affected versions | >=2.3.0,<2.9.3|>=2.0.0,<2.2.26                                                   |
| Reported at       | 2025-12-30T17:44:10+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+

GHSA-59pp-r3rg-353g

[WyriHaximus]

@zolthan Finish adding tests the a set of PR's then release the last alpha, finished helpers to release the first beta. Do a series of testing and maybe a second beta before releasing 0.6.0.