build(deps): bump guzzlehttp/guzzle from 7.14.1 to 7.15.1

[dependabot]

Bumps guzzlehttp/guzzle from 7.14.1 to 7.15.1.

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.15.1

Security

• Preserve host-only cookie scope and require explicit persistence markers (GHSA-wm3w-8rrp-j577)
• Bound response cookie admission and generated Cookie headers (GHSA-f283-ghqc-fg79)
• Exclude URI fragments from Referer headers generated for redirects (GHSA-h95v-h523-3mw8)

7.15.0

Added

• Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.13
• Use locale-independent ASCII folding for all case normalization and comparison
• Bound cURL upload reads to the declared Content-Length
• Sanitize the cURL error text exposed through exception handler context
• Fail closed when a named cURL multi connection cap cannot be applied
• Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured
• Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles
• Isolate HTTP proxy tunnels from opaque shared connection caches
• Trigger runtime deprecations for previously deprecated functionality in 7.1.0

Deprecated

• Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
• Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array
• Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support

Fixed

• Defer cURL requests created from multi callbacks until native execution unwinds
• Fail synchronous waits from native cURL callbacks promptly instead of self-deadlocking
• Guard cURL multi handle removal against progress callbacks re-entering the handler
• Scope promise waits on the cURL multi handler to the awaited transfer
• Strip Content-Length and Transfer-Encoding when redirects discard the request body
• Stop re-applying the delay request option to followed redirects

7.14.2

Security

• Prevent first-class and proxy URL credentials from reaching origins (GHSA-94pj-82f3-465w)

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.15.1 - 2026-07-18

Security

• Preserve host-only cookie scope and require explicit persistence markers (GHSA-wm3w-8rrp-j577)
• Bound response cookie admission and generated Cookie headers (GHSA-f283-ghqc-fg79)
• Exclude URI fragments from Referer headers generated for redirects (GHSA-h95v-h523-3mw8)

7.15.0 - 2026-07-17

Added

• Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.13
• Use locale-independent ASCII folding for all case normalization and comparison
• Bound cURL upload reads to the declared Content-Length
• Sanitize the cURL error text exposed through exception handler context
• Fail closed when a named cURL multi connection cap cannot be applied
• Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured
• Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles
• Isolate HTTP proxy tunnels from opaque shared connection caches
• Trigger runtime deprecations for previously deprecated functionality in 7.1.0

Deprecated

• Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
• Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array
• Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support

Fixed

• Defer cURL requests created from multi callbacks until native execution unwinds
• Fail synchronous waits from native cURL callbacks promptly instead of self-deadlocking
• Guard cURL multi handle removal against progress callbacks re-entering the handler
• Scope promise waits on the cURL multi handler to the awaited transfer
• Strip Content-Length and Transfer-Encoding when redirects discard the request body
• Stop re-applying the delay request option to followed redirects

7.14.2 - 2026-07-14

Security

• Prevent first-class and proxy URL credentials from reaching origins (GHSA-94pj-82f3-465w)

Commits

• 61443df Release 7.15.1
• 7b68220 Security fixes 7.15 (#3901)
• 90bd104 Release 7.15.0
• e8c879e Require guzzlehttp/psr7 ^2.13 (#3870)
• 0d578f5 Trigger runtime deprecations for legacy functions and methods (#3896)
• d5fcd1e Deprecate JSON utility methods (#3889)
• 3281fe2 Go with "guzzlehttp/test-server": "^0.7" (#3890)
• ba662c9 Remove stale framing from redirected requests (#3881)
• dd32f84 Bound cURL uploads to declared lengths (#3882)
• a29e961 Merge branch '7.14' into 7.15
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)