[wleeaf]

Description
When the header holds a wildcard, Negotiate returns the first supported value, even if the same header excludes that value with q=0. In RFC 9110, a weight of 0 means "not acceptable" (section 12.4.2), and a more specific entry overrides a wildcard (sections 12.5.1 and 12.5.3). Examples:

• Accept-Encoding: gzip;q=0, * with encoding(['gzip', 'br']) returns gzip.
• Accept: application/json;q=0, */* with media(['application/json', 'text/html'], true) returns application/json.
• Accept: text/*, text/html;q=0 with media(['text/html', 'text/plain'], true) returns text/html.
• charset() behaves the same way, and so does language(), with and without $strictLocaleNegotiation. For example, Accept-Language: en;q=0, * gives en.

getBestMatch() and getBestLocaleMatch() now skip values that the header excludes. A private isExcluded() applies the most specific value in the header that matches a supported value (RFC 9110, section 12.5.1): media ranges match by type, subtype and their own parameters, so text/*;q=0 excludes text/html and text/html;q=0 excludes text/html;charset=utf-8, and language ranges use RFC 4647 basic filtering, so en;q=0 excludes en-US. A more specific range with a positive weight still wins: text/html, text/*;q=0 selects text/html, and en;q=0, en-GB;q=0.5, * selects en-GB. Wildcards, broader matches and the strict locale fallbacks all skip excluded values. When nothing matches, $strictMatch = false still falls back to the first supported value, as documented and as testBestMatchOnlyLowQuality expects.

testWildcardsSkipExcludedValues, testMediaRangesExcludeMatchingValues, testMoreSpecificRangesTakePrecedence and testLanguageRangesExcludeRegionalLocales in tests/system/HTTP/NegotiateTest.php cover media(), charset(), encoding() and language() in both locale modes, with positive controls. They fail without the change.

tests/system/HTTP/ passes. php-cs-fixer, PHPStan and Rector (dry run) report nothing for the changed files.

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide

[michalsn]

Also, please rebase: https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/workflow.md#configuring-upstream-and-rebasing

[wleeaf]

Rebased onto develop. The description is updated for the wider scope.

[wleeaf]

Rebased onto develop again.

[wleeaf]

Rebased onto develop after #10660. Only the changelog conflicted; both entries are kept. NegotiateTest (24 tests) and tests/system/HTTP pass, and PHPStan, Rector and php-cs-fixer are clean on the changed files.

[michalsn]

Thank you!