chore(deps): bump the composer group across 1 directory with 2 updates

[dependabot]

Bumps the composer group with 1 update in the / directory: guzzlehttp/guzzle.

Updates guzzlehttp/guzzle from 7.10.0 to 7.15.1

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.15.1

Security

• Preserve host-only cookie scope and require explicit persistence markers (GHSA-wm3w-8rrp-j577)
• Bound response cookie admission and generated Cookie headers (GHSA-f283-ghqc-fg79)
• Exclude URI fragments from Referer headers generated for redirects (GHSA-h95v-h523-3mw8)

7.15.0

Added

• Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.13
• Use locale-independent ASCII folding for all case normalization and comparison
• Bound cURL upload reads to the declared Content-Length
• Sanitize the cURL error text exposed through exception handler context
• Fail closed when a named cURL multi connection cap cannot be applied
• Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured
• Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles
• Isolate HTTP proxy tunnels from opaque shared connection caches
• Trigger runtime deprecations for previously deprecated functionality in 7.1.0

Deprecated

• Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
• Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array
• Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support

Fixed

• Defer cURL requests created from multi callbacks until native execution unwinds
• Fail synchronous waits from native cURL callbacks promptly instead of self-deadlocking
• Guard cURL multi handle removal against progress callbacks re-entering the handler
• Scope promise waits on the cURL multi handler to the awaited transfer
• Strip Content-Length and Transfer-Encoding when redirects discard the request body
• Stop re-applying the delay request option to followed redirects

7.14.2

Security

• Prevent first-class and proxy URL credentials from reaching origins (GHSA-94pj-82f3-465w)

7.14.1

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.12.5

Fixed

... (truncated)

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.15.1 - 2026-07-18

Security

• Preserve host-only cookie scope and require explicit persistence markers (GHSA-wm3w-8rrp-j577)
• Bound response cookie admission and generated Cookie headers (GHSA-f283-ghqc-fg79)
• Exclude URI fragments from Referer headers generated for redirects (GHSA-h95v-h523-3mw8)

7.15.0 - 2026-07-17

Added

• Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.13
• Use locale-independent ASCII folding for all case normalization and comparison
• Bound cURL upload reads to the declared Content-Length
• Sanitize the cURL error text exposed through exception handler context
• Fail closed when a named cURL multi connection cap cannot be applied
• Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured
• Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles
• Isolate HTTP proxy tunnels from opaque shared connection caches
• Trigger runtime deprecations for previously deprecated functionality in 7.1.0

Deprecated

• Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
• Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array
• Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support

Fixed

• Defer cURL requests created from multi callbacks until native execution unwinds
• Fail synchronous waits from native cURL callbacks promptly instead of self-deadlocking
• Guard cURL multi handle removal against progress callbacks re-entering the handler
• Scope promise waits on the cURL multi handler to the awaited transfer
• Strip Content-Length and Transfer-Encoding when redirects discard the request body
• Stop re-applying the delay request option to followed redirects

7.14.2 - 2026-07-14

Security

• Prevent first-class and proxy URL credentials from reaching origins (GHSA-94pj-82f3-465w)

... (truncated)

Commits

• 61443df Release 7.15.1
• 7b68220 Security fixes 7.15 (#3901)
• 90bd104 Release 7.15.0
• e8c879e Require guzzlehttp/psr7 ^2.13 (#3870)
• 0d578f5 Trigger runtime deprecations for legacy functions and methods (#3896)
• d5fcd1e Deprecate JSON utility methods (#3889)
• 3281fe2 Go with "guzzlehttp/test-server": "^0.7" (#3890)
• ba662c9 Remove stale framing from redirected requests (#3881)
• dd32f84 Bound cURL uploads to declared lengths (#3882)
• a29e961 Merge branch '7.14' into 7.15
• Additional commits viewable in compare view

Updates guzzlehttp/psr7 from 2.8.0 to 2.13.0

Release notes

Sourced from guzzlehttp/psr7's releases.

2.13.0

Added

• Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

• Use locale-independent ASCII case folding everywhere case is normalized
• Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

2.12.4

Changed

• Pass explicit trim characters ahead of the PHP 8.6 trim default change

2.12.3

Security

• Validate the URI host so getHost() matches the URI authority (GHSA-c2w2-prh8-qm98)

2.12.2

Fixed

• Report URI parsing, filtering, and normalization PCRE failures explicitly
• Report HTTP message parser PCRE failures explicitly
• Fail closed when PCRE validation fails for request targets and hosts

2.12.1

Security

• Reject CR/LF in HTTP method, protocol version, and reason phrase (GHSA-vm85-hxw5-5432)

2.12.0

Deprecated

• Deprecated non-finite float values in Query::build() that guzzlehttp/psr7 3.0 rejects
• Deprecated non-finite float multipart contents that guzzlehttp/psr7 3.0 rejects
• Deprecated non-string scalar bodies in Utils::streamFor(); cast them to a string for 3.0
• Deprecated non-string Uri::withQueryValues() values; cast them to a string for 3.0

2.11.1

Fixed

• Fixed non-finite float values emitting coercion warnings on PHP 8.5

2.11.0

Changed

• Changed Utils::modifyRequest() to reject conflicting URI and Host header changes in the same call
• Changed Header::parse() to split semicolon-separated parameters without repeated regular expression lookaheads

... (truncated)

Changelog

Sourced from guzzlehttp/psr7's changelog.

2.13.0 - 2026-07-16

Added

• Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

• Use locale-independent ASCII case folding everywhere case is normalized
• Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

2.12.5 - 2026-07-13

Fixed

• Compare header names and hosts with locale-independent ASCII lowercasing
• Compare hosts without locale sensitivity when detecting cross-origin redirects

2.12.4 - 2026-07-08

Changed

• Pass explicit trim characters ahead of the PHP 8.6 trim default change

Fixed

• Anchor server port and response start-line patterns to the true end of input
• Treat host-less origin-form request targets starting with // as paths in Message::parseRequest()
• Reject raw DEL bytes in bracketed IP-literal hosts instead of parsing a mutated host
• Reject invalid bytes after a bracketed IP-literal host instead of reparsing a different host

2.12.3 - 2026-06-23

Security

• Validate the URI host so getHost() matches the URI authority (GHSA-c2w2-prh8-qm98)

2.12.2 - 2026-06-23

Fixed

• Report URI parsing, filtering, and normalization PCRE failures explicitly
• Report HTTP message parser PCRE failures explicitly
• Fail closed when PCRE validation fails for request targets and hosts

2.12.1 - 2026-06-18

Security

• Reject CR/LF in HTTP method, protocol version, and reason phrase (GHSA-vm85-hxw5-5432)

... (truncated)

Commits

• dad8962 Release 2.13.0
• 1bc4f53 Trigger a runtime deprecation for Header::normalize() (#866)
• a1372ea Add tests locking in no-file upload handling (#856)
• d9561d1 Merge branch '2.12' into 2.13
• 9365d57 Release 2.12.5
• b82bac4 Add caseless comparison and asciiUcFirst helpers (#854)
• 2cf293e Merge branch '2.12' into 2.13
• c685419 Fold cross-origin host comparison without locale sensitivity (#852)
• 226b5b3 Add locale-independent ASCII case folding helpers (#850)
• 1acfa28 Use locale-independent ASCII folding for header and host names (#849)
• Additional commits viewable in compare view