v1.5.1 - Security: Guzzle update (4 advisories)

Security maintenance release. No functional changes — this updates the bundled HTTP libraries to clear four moderate-severity advisories.

Security

Updated the Guzzle HTTP stack, resolving 4 Dependabot advisories:

Advisory	Severity
URI fragments disclosed in redirect Referer headers	Moderate
Unbounded response cookies (denial of service)	Moderate
Host-only cookie scope is not preserved	Moderate
Proxy-Authorization headers can be sent to origin servers	Moderate

• guzzlehttp/guzzle 7.14.1 → 7.15.2
• guzzlehttp/psr7 2.12.5 → 2.13.0

The release ZIP installs dependencies from composer.lock at build time, so this ZIP contains the patched versions. composer audit reports no remaining advisories.

Notes

Remaining major upgrades — guzzlehttp/guzzle 8.x, guzzlehttp/psr7 3.x, guzzlehttp/promises 3.x and doctrine/cache 2.x (1.x is abandoned upstream) — are pinned by the bundled 5pm-hdh/churchtools-api fork (guzzlehttp/guzzle: ^7, doctrine/cache: ^1.11) and cannot be taken without updating that library first. None of them carries a known advisory.

Upgrading

Drop-in replacement for 1.5.0 — no settings changes, no database migration.