chore(deps-dev): bump guzzlehttp/psr7 from 2.8.0 to 2.13.1

[dependabot]

Bumps guzzlehttp/psr7 from 2.8.0 to 2.13.1.

Release notes

Sourced from guzzlehttp/psr7's releases.

2.13.1

Added

• Add support for PHP 8.6

Fixed

• Prefix relative paths that begin with a colon segment with ./ instead of throwing

2.13.0

Added

• Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

• Use locale-independent ASCII case folding everywhere case is normalized
• Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

2.12.5

Fixed

• Compare header names and hosts with locale-independent ASCII lowercasing
• Compare hosts without locale sensitivity when detecting cross-origin redirects

2.12.4

Changed

• Pass explicit trim characters ahead of the PHP 8.6 trim default change

2.12.3

Security

• Validate the URI host so getHost() matches the URI authority (GHSA-c2w2-prh8-qm98)

2.12.2

Fixed

• Report URI parsing, filtering, and normalization PCRE failures explicitly
• Report HTTP message parser PCRE failures explicitly
• Fail closed when PCRE validation fails for request targets and hosts

2.12.1

Security

• Reject CR/LF in HTTP method, protocol version, and reason phrase (GHSA-vm85-hxw5-5432)

2.12.0

Deprecated

... (truncated)

Changelog

Sourced from guzzlehttp/psr7's changelog.

2.13.1 - 2026-08-24

Added

• Add support for PHP 8.6

Fixed

• Prefix relative paths that begin with a colon segment with ./ instead of throwing

2.13.0 - 2026-07-16

Added

• Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

• Use locale-independent ASCII case folding everywhere case is normalized
• Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

2.12.5 - 2026-07-13

Fixed

• Compare header names and hosts with locale-independent ASCII lowercasing
• Compare hosts without locale sensitivity when detecting cross-origin redirects

2.12.4 - 2026-07-08

Changed

• Pass explicit trim characters ahead of the PHP 8.6 trim default change

Fixed

• Anchor server port and response start-line patterns to the true end of input
• Treat host-less origin-form request targets starting with // as paths in Message::parseRequest()
• Reject raw DEL bytes in bracketed IP-literal hosts instead of parsing a mutated host
• Reject invalid bytes after a bracketed IP-literal host instead of reparsing a different host

2.12.3 - 2026-06-23

Security

• Validate the URI host so getHost() matches the URI authority (GHSA-c2w2-prh8-qm98)

2.12.2 - 2026-06-23

Fixed

... (truncated)

Commits

• 95e7828 Release 2.13.1
• a583cbe Add PHP 8.6 to the CI matrix and version guidance (#883)
• 93b91b0 Prefix relative paths that begin with a colon segment instead of throwing (#878)
• 5b1264e Test that noncanonical IPv4 host spellings pass through unchanged (#874)
• dad8962 Release 2.13.0
• 1bc4f53 Trigger a runtime deprecation for Header::normalize() (#866)
• a1372ea Add tests locking in no-file upload handling (#856)
• d9561d1 Merge branch '2.12' into 2.13
• 9365d57 Release 2.12.5
• b82bac4 Add caseless comparison and asciiUcFirst helpers (#854)
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[swissspidy]

@dependabot rebase