chore(deps-dev): bump guzzlehttp/guzzle from 7.10.0 to 7.15.5

[dependabot]

Bumps guzzlehttp/guzzle from 7.10.0 to 7.15.5.

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.15.5

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.13.1
• Adjusted guzzlehttp/promises version constraint to ^2.5.3

7.15.4

Added

• Added support for PHP 8.6

Changed

• Replace the deprecated spl_object_hash() in handler stack debug output for PHP 8.6

7.15.3

Changed

• Adjusted guzzlehttp/promises version constraint to ^2.5.2

Fixed

• Fail a cURL multi handler wait with an attributable error when the transfer is no longer tracked
• Fix StreamHandler resolving numeric IPv4 hosts differently from cURL handlers on macOS and Windows
• Fix StreamHandler TLS peer names and proxy authorities for numeric IPv4 hosts on all platforms
• Settle a cURL multi handler transfer displaced by a request reusing its native handle ID

7.15.2

Security

• Reject non-printable-ASCII and percent-escaped URI hosts and Host headers (GHSA-v5mv-p594-2x33)
• Reject request URI hosts that contain a URI authority delimiter (GHSA-v5mv-p594-2x33)
• Reject numeric-looking URI hosts with trailing dots, read as IPv4 addresses (GHSA-v5mv-p594-2x33)
• Treat numeric-in-any-base and percent-escaped cookie domains as exact-match-only (GHSA-f7vp-7xgx-4w4r)
• Regenerate a derived Host header after client URI rewrites (GHSA-v5mv-p594-2x33)

Fixed

• Preserve RequestException when the stream handler rejects a request before opening a stream

7.15.1

Security

• Preserve host-only cookie scope and require explicit persistence markers (GHSA-wm3w-8rrp-j577)
• Bound response cookie admission and generated Cookie headers (GHSA-f283-ghqc-fg79)
• Exclude URI fragments from Referer headers generated for redirects (GHSA-h95v-h523-3mw8)

7.15.0

Added

... (truncated)

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.15.5 - 2026-08-24

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.13.1
• Adjusted guzzlehttp/promises version constraint to ^2.5.3

7.15.4 - 2026-08-24

Added

• Added support for PHP 8.6

Changed

• Replace the deprecated spl_object_hash() in handler stack debug output for PHP 8.6

7.15.3 - 2026-08-05

Changed

• Adjusted guzzlehttp/promises version constraint to ^2.5.2

Fixed

• Fail a cURL multi handler wait with an attributable error when the transfer is no longer tracked
• Fix StreamHandler resolving numeric IPv4 hosts differently from cURL handlers on macOS and Windows
• Fix StreamHandler TLS peer names and proxy authorities for numeric IPv4 hosts on all platforms
• Settle a cURL multi handler transfer displaced by a request reusing its native handle ID

7.15.2 - 2026-07-26

Security

• Reject non-printable-ASCII and percent-escaped URI hosts and Host headers (GHSA-v5mv-p594-2x33)
• Reject request URI hosts that contain a URI authority delimiter (GHSA-v5mv-p594-2x33)
• Reject numeric-looking URI hosts with trailing dots, read as IPv4 addresses (GHSA-v5mv-p594-2x33)
• Treat numeric-in-any-base and percent-escaped cookie domains as exact-match-only (GHSA-f7vp-7xgx-4w4r)
• Regenerate a derived Host header after client URI rewrites (GHSA-v5mv-p594-2x33)

Fixed

• Preserve RequestException when the stream handler rejects a request before opening a stream

7.15.1 - 2026-07-18

Security

... (truncated)

Commits

• ee80339 Release 7.15.5
• fb464ad Bump minimum promises and psr7
• 994a8a0 Release 7.15.4
• 6e73b57 Support PHP 8.6 (#3928)
• ae311b8 Release 7.15.3
• e3d8b4b Adjust the guzzlehttp/promises version constraint to ^2.5.2 (#3920)
• c55971f Settle cURL multi transfers displaced by native handle ID reuse (#3917)
• 04a8319 Fold numeric IPv4 hosts in the stream handler (#3909)
• ae0facb Reject untracked cURL multi handler waits with an attributable error (#3911)
• 7441019 Security fixes 7.15 (#3907)
• Additional commits viewable in compare view

[swissspidy]

@dependabot rebase