HttpClient timeout defaults and cancellation gap between CakePHP 4.x and 5.x

Goal

Determine whether one HttpClient timeout configuration can govern outbound requests consistently after upgrading from CakePHP 4.x to 5.x, and whether the framework supports graceful cancellation of long-running calls.

CakePHP HttpClient delegates transport to Guzzle and exposes timeout values through the Client constructor and per-request options. The effective default timeout changed across the 4.x to 5.x boundary, and CakePHP 5 removes HttpSocket while raising the minimum PHP version. CakePHP core does not expose a first-party cancellation token for an in-flight request, so cancellation depends on the underlying Guzzle version or external process control.

Because Guzzle versions and custom transport adapters vary between projects, the exact cancellation boundary is uncertain without inspecting the installed dependency set.

• Which timeout option takes precedence when both Client config and per-request options are defined?
• Does CakePHP 5 HttpClient provide a stable cancellation mechanism, or must cancellation be implemented through Guzzle directly?
• What replacement pattern handles in-flight request cancellation when moving from CakePHP 4 HttpSocket to CakePHP 5 HttpClient?