Skip to content

chore(deps): bump the composer group across 1 directory with 3 updates - #43

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/composer-406b138c80
Open

chore(deps): bump the composer group across 1 directory with 3 updates#43
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/composer-406b138c80

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 6, 2026

Copy link
Copy Markdown
Contributor

Bumps the composer group with 2 updates in the / directory: guzzlehttp/guzzle and mtdowling/jmespath.php.

Updates guzzlehttp/guzzle from 7.10.0 to 7.15.5

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.15.5

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.13.1
  • Adjusted guzzlehttp/promises version constraint to ^2.5.3

7.15.4

Added

  • Added support for PHP 8.6

Changed

  • Replace the deprecated spl_object_hash() in handler stack debug output for PHP 8.6

7.15.3

Changed

  • Adjusted guzzlehttp/promises version constraint to ^2.5.2

Fixed

  • Fail a cURL multi handler wait with an attributable error when the transfer is no longer tracked
  • Fix StreamHandler resolving numeric IPv4 hosts differently from cURL handlers on macOS and Windows
  • Fix StreamHandler TLS peer names and proxy authorities for numeric IPv4 hosts on all platforms
  • Settle a cURL multi handler transfer displaced by a request reusing its native handle ID

7.15.2

Security

Fixed

  • Preserve RequestException when the stream handler rejects a request before opening a stream

7.15.1

Security

7.15.0

Added

... (truncated)

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.15.5 - 2026-08-24

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.13.1
  • Adjusted guzzlehttp/promises version constraint to ^2.5.3

7.15.4 - 2026-08-24

Added

  • Added support for PHP 8.6

Changed

  • Replace the deprecated spl_object_hash() in handler stack debug output for PHP 8.6

7.15.3 - 2026-08-05

Changed

  • Adjusted guzzlehttp/promises version constraint to ^2.5.2

Fixed

  • Fail a cURL multi handler wait with an attributable error when the transfer is no longer tracked
  • Fix StreamHandler resolving numeric IPv4 hosts differently from cURL handlers on macOS and Windows
  • Fix StreamHandler TLS peer names and proxy authorities for numeric IPv4 hosts on all platforms
  • Settle a cURL multi handler transfer displaced by a request reusing its native handle ID

7.15.2 - 2026-07-26

Security

Fixed

  • Preserve RequestException when the stream handler rejects a request before opening a stream

7.15.1 - 2026-07-18

Security

... (truncated)

Commits

Updates guzzlehttp/psr7 from 2.11.0 to 2.13.1

Release notes

Sourced from guzzlehttp/psr7's releases.

2.13.1

Added

  • Add support for PHP 8.6

Fixed

  • Prefix relative paths that begin with a colon segment with ./ instead of throwing

2.13.0

Added

  • Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

  • Use locale-independent ASCII case folding everywhere case is normalized
  • Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

2.12.5

Fixed

  • Compare header names and hosts with locale-independent ASCII lowercasing
  • Compare hosts without locale sensitivity when detecting cross-origin redirects

2.12.4

Changed

  • Pass explicit trim characters ahead of the PHP 8.6 trim default change

2.12.3

Security

2.12.2

Fixed

  • Report URI parsing, filtering, and normalization PCRE failures explicitly
  • Report HTTP message parser PCRE failures explicitly
  • Fail closed when PCRE validation fails for request targets and hosts

2.12.1

Security

2.12.0

Deprecated

... (truncated)

Changelog

Sourced from guzzlehttp/psr7's changelog.

2.13.1 - 2026-08-24

Added

  • Add support for PHP 8.6

Fixed

  • Prefix relative paths that begin with a colon segment with ./ instead of throwing

2.13.0 - 2026-07-16

Added

  • Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

  • Use locale-independent ASCII case folding everywhere case is normalized
  • Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

2.12.5 - 2026-07-13

Fixed

  • Compare header names and hosts with locale-independent ASCII lowercasing
  • Compare hosts without locale sensitivity when detecting cross-origin redirects

2.12.4 - 2026-07-08

Changed

  • Pass explicit trim characters ahead of the PHP 8.6 trim default change

Fixed

  • Anchor server port and response start-line patterns to the true end of input
  • Treat host-less origin-form request targets starting with // as paths in Message::parseRequest()
  • Reject raw DEL bytes in bracketed IP-literal hosts instead of parsing a mutated host
  • Reject invalid bytes after a bracketed IP-literal host instead of reparsing a different host

2.12.3 - 2026-06-23

Security

2.12.2 - 2026-06-23

Fixed

... (truncated)

Commits
  • 95e7828 Release 2.13.1
  • a583cbe Add PHP 8.6 to the CI matrix and version guidance (#883)
  • 93b91b0 Prefix relative paths that begin with a colon segment instead of throwing (#878)
  • 5b1264e Test that noncanonical IPv4 host spellings pass through unchanged (#874)
  • dad8962 Release 2.13.0
  • 1bc4f53 Trigger a runtime deprecation for Header::normalize() (#866)
  • a1372ea Add tests locking in no-file upload handling (#856)
  • d9561d1 Merge branch '2.12' into 2.13
  • 9365d57 Release 2.12.5
  • b82bac4 Add caseless comparison and asciiUcFirst helpers (#854)
  • Additional commits viewable in compare view

Updates mtdowling/jmespath.php from 2.8.0 to 2.9.2

Release notes

Sourced from mtdowling/jmespath.php's releases.

2.9.2

  • Pass explicit trim characters ahead of the PHP 8.6 trim default change.

2.9.1

  • Fixed the compiled runtime to emit function names as string literals, preventing arbitrary code execution.
  • Fixed the parser to reject non-identifier function callees, such as literal and raw string callees.

2.9.0

  • Added PHP 8.5 support.
  • Fixed to_number() to parse number strings using the JSON number grammar.
  • Fixed reverse() and string slicing to operate on UTF-8 characters rather than bytes.
  • Fixed slicing of array-like (ArrayAccess + Countable) values.
  • Fixed equality and contains() to use JSON semantics, e.g. 1 == 1.0 is now true.
  • Fixed multi-select hashes to end projections, so following tokens apply to the projected list.
  • Fixed sort() and sort_by() to compare numbers numerically.
  • Changed sort(), sort_by(), max(), min(), max_by() and min_by() to order strings by code point.
  • Fixed max_by() and min_by() to error on mixed-type keys instead of returning arbitrary elements.
  • Fixed max() returning null or erroring when the first array element is falsy, e.g. max([0, 1]).
  • Fixed sum() and join() to return 0 and an empty string respectively for empty arrays.
  • Fixed 0.0 to be truthy in filters and logical operators, like every other number.
  • Fixed the compiled runtime to apply JMESPath truthiness to || and &&.
  • Fixed @(foo), foo[-] and oversized index literals to throw syntax errors.
  • Fixed PHP warnings emitted while parsing certain invalid expressions.
  • Fixed the caret position in syntax error messages for errors at the end of an expression.
  • Fixed map() to error on non-array second arguments instead of returning [].
  • Fixed Env::cleanCompileDir() when JP_PHP_COMPILE=on.
Changelog

Sourced from mtdowling/jmespath.php's changelog.

2.9.2 - 2026-07-06

  • Pass explicit trim characters ahead of the PHP 8.6 trim default change.

2.9.1 - 2026-06-11

  • Fixed the compiled runtime to emit function names as string literals, preventing arbitrary code execution.
  • Fixed the parser to reject non-identifier function callees, such as literal and raw string callees.

2.9.0 - 2026-06-10

  • Added PHP 8.5 support.
  • Fixed to_number() to parse number strings using the JSON number grammar.
  • Fixed reverse() and string slicing to operate on UTF-8 characters rather than bytes.
  • Fixed slicing of array-like (ArrayAccess + Countable) values.
  • Fixed equality and contains() to use JSON semantics, e.g. 1 == 1.0 is now true.
  • Fixed multi-select hashes to end projections, so following tokens apply to the projected list.
  • Fixed sort() and sort_by() to compare numbers numerically.
  • Changed sort(), sort_by(), max(), min(), max_by() and min_by() to order strings by code point.
  • Fixed max_by() and min_by() to error on mixed-type keys instead of returning arbitrary elements.
  • Fixed max() returning null or erroring when the first array element is falsy, e.g. max([0, 1]).
  • Fixed sum() and join() to return 0 and an empty string respectively for empty arrays.
  • Fixed 0.0 to be truthy in filters and logical operators, like every other number.
  • Fixed the compiled runtime to apply JMESPath truthiness to || and &&.
  • Fixed @(foo), foo[-] and oversized index literals to throw syntax errors.
  • Fixed PHP warnings emitted while parsing certain invalid expressions.
  • Fixed the caret position in syntax error messages for errors at the end of an expression.
  • Fixed map() to error on non-array second arguments instead of returning [].
  • Fixed Env::cleanCompileDir() when JP_PHP_COMPILE=on.
Commits
  • 2157c5e Release 2.9.2
  • aa13a7b Freeze trim characters ahead of PHP 8.6 (#121)
  • 9c208ba Release 2.9.1
  • 83a51c1 Add security policy and convert readme to markdown (#117)
  • 69aea5a Fix arbitrary code execution in the compiled runtime (#119)
  • 77105da Replace old links in the code (#118)
  • 9501100 Release 2.9.0
  • ca10035 Fixed sum() and join() to return 0 and an empty string respectively for empty...
  • eb36591 Fixed 0.0 to be truthy in filters and logical operators, like every other num...
  • eed8676 Fixed multi-select hashes to end projections, so following tokens apply to th...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the composer group across 1 directory with 3 updates
859c2da 
Bumps the composer group with 2 updates in the / directory: [guzzlehttp/guzzle](https://github.com/guzzle/guzzle) and [mtdowling/jmespath.php](https://github.com/jmespath/jmespath.php).


Updates `guzzlehttp/guzzle` from 7.10.0 to 7.15.5
- [Release notes](https://github.com/guzzle/guzzle/releases)
- [Changelog](https://github.com/guzzle/guzzle/blob/7.15.5/CHANGELOG.md)
- [Commits](guzzle/guzzle@7.10.0...7.15.5)

Updates `guzzlehttp/psr7` from 2.11.0 to 2.13.1
- [Release notes](https://github.com/guzzle/psr7/releases)
- [Changelog](https://github.com/guzzle/psr7/blob/2.13.1/CHANGELOG.md)
- [Commits](guzzle/psr7@2.11.0...2.13.1)

Updates `mtdowling/jmespath.php` from 2.8.0 to 2.9.2
- [Release notes](https://github.com/jmespath/jmespath.php/releases)
- [Changelog](https://github.com/jmespath/jmespath.php/blob/master/CHANGELOG.md)
- [Commits](jmespath/jmespath.php@2.8.0...2.9.2)

---
updated-dependencies:
- dependency-name: guzzlehttp/guzzle
  dependency-version: 7.15.5
  dependency-type: indirect
  dependency-group: composer
- dependency-name: guzzlehttp/psr7
  dependency-version: 2.13.1
  dependency-type: indirect
  dependency-group: composer
- dependency-name: mtdowling/jmespath.php
  dependency-version: 2.9.2
  dependency-type: indirect
  dependency-group: composer
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update php code labels Sep 6, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update php code labels Sep 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@MaximillianGroup MaximillianGroup Awaiting requested review from MaximillianGroup MaximillianGroup is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file php Pull requests that update php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants