chore(deps-dev): bump guzzlehttp/psr7 from 2.12.x-dev to 3.0.0 in /vendor-bin/phpunit

[dependabot]

Bumps guzzlehttp/psr7 from 2.12.x-dev to 3.0.0.

Release notes

Sourced from guzzlehttp/psr7's releases.

3.0.0

Added

• Add DiagnosticValue::escape() to escape controls and malformed UTF-8 in diagnostics
• Add GuzzleHttp\Psr7\Exception\TimeoutException for timed-out stream operations
• Add GuzzleHttp\Psr7\Utils::redactUserInfoInString() to redact the userinfo of a raw URI string within text
• Promote GuzzleHttp\Psr7\Rfc3986 to public API with isValid*() predicates and canonicalizeIpv6()
• Add GuzzleHttp\Psr7\UriNormalizer::CANONICALIZE_IPV6_HOST to PRESERVING_NORMALIZATIONS

Changed

• Require psr/http-message:^2.0 and add native parameter and return types
• Require psr/http-factory:^1.1
• Reject native PHP serialization of stream implementations
• Preserve request method casing, except ServerRequest::fromGlobals() still uppercases
• Reject empty arrays and non-string values as header values
• Reject invalid uploaded file trees and invalid parsed body values
• Reject uploaded file specs missing tmp_name, size, or error
• Reject non-integer and negative uploaded file error values
• Reject invalid stream/upload sizes, buffer high-water marks, and dropping-stream limits
• Rewind seekable uploaded-file streams before copying in UploadedFile::moveTo()
• Reject negative read() lengths across all stream implementations
• Detect the + flag anywhere in a mode for Stream::isReadable()/isWritable()
• Reject empty strings returned by PumpStream source callables
• Discard buffered bytes on PumpStream close and detach
• Restore the original stream position after Message::bodySummary()
• Allow null for the Message::bodySummary() truncation length to use the default
• Validate LimitStream offset/limit and track non-seekable offset by bytes skipped
• Make FnStream close and detach terminal, calling close callbacks at most once
• Suppress exceptions from FnStream close callbacks during destructor cleanup
• Make CachingStream::close() idempotent, preserving remote cleanup after detach
• Do not move the CachingStream cursor when a SEEK_END target on an unknown-size stream is rejected
• Normalize multiple leading slashes in Uri::getPath() and origin-form request targets
• Serialize authority-less file URIs with rootless paths without the // separator
• Serialize authority-less file URIs with empty paths as file: instead of the unparseable file://
• Remove dot segments above the root per RFC 3986, prefixing authority-less // paths with /.
• Return a network-path reference from UriResolver::relativize() when an empty-path target requires one
• Stop returning an empty reference from UriResolver::relativize() when it would inherit the base fragment
• Stop throwing from UriResolver::relativize() when an equal-path target's last path segment contains a colon
• Harden URI host validation (delimiters, backslashes, IPv6, embedded ports); require schemes to start with a letter
• Validate Uri::fromParts() ports instead of casting them
• Treat ports 80 and 443 as defaults for the ws and wss schemes
• Use the ws and wss default ports in UriComparator::isCrossOrigin() port comparisons
• Redact all non-empty URI userinfo in Utils::redactUserInfo()
• Rebuild server request URIs from $_SERVER by REQUEST_METHOD, using target authority before SERVER_PORT
• Remove userinfo from absolute-form REQUEST_URI targets in ServerRequest::fromGlobals()
• Reject zero-port HTTP_HOST and malformed SERVER_PORT in ServerRequest::getUriFromGlobals()
• Reject malformed REQUEST_METHOD and SERVER_PROTOCOL server values in ServerRequest::fromGlobals()
• Reject zero-port Host and normalize leading-zero ports in Message::parseRequest()
• Reject duplicate Host headers and validate present values for all request-target forms

... (truncated)

Changelog

Sourced from guzzlehttp/psr7's changelog.

3.0.0 - 2026-07-20

Added

• Add DiagnosticValue::escape() to escape controls and malformed UTF-8 in diagnostics
• Add GuzzleHttp\Psr7\Exception\TimeoutException for timed-out stream operations
• Add GuzzleHttp\Psr7\Utils::redactUserInfoInString() to redact the userinfo of a raw URI string within text
• Promote GuzzleHttp\Psr7\Rfc3986 to public API with isValid*() predicates and canonicalizeIpv6()
• Add GuzzleHttp\Psr7\UriNormalizer::CANONICALIZE_IPV6_HOST to PRESERVING_NORMALIZATIONS

Changed

• Require psr/http-message:^2.0 and add native parameter and return types
• Require psr/http-factory:^1.1
• Reject native PHP serialization of stream implementations
• Preserve request method casing, except ServerRequest::fromGlobals() still uppercases
• Reject empty arrays and non-string values as header values
• Reject invalid uploaded file trees and invalid parsed body values
• Reject uploaded file specs missing tmp_name, size, or error
• Reject non-integer and negative uploaded file error values
• Reject invalid stream/upload sizes, buffer high-water marks, and dropping-stream limits
• Rewind seekable uploaded-file streams before copying in UploadedFile::moveTo()
• Reject negative read() lengths across all stream implementations
• Detect the + flag anywhere in a mode for Stream::isReadable()/isWritable()
• Reject empty strings returned by PumpStream source callables
• Discard buffered bytes on PumpStream close and detach
• Restore the original stream position after Message::bodySummary()
• Allow null for the Message::bodySummary() truncation length to use the default
• Validate LimitStream offset/limit and track non-seekable offset by bytes skipped
• Make FnStream close and detach terminal, calling close callbacks at most once
• Suppress exceptions from FnStream close callbacks during destructor cleanup
• Make CachingStream::close() idempotent, preserving remote cleanup after detach
• Do not move the CachingStream cursor when a SEEK_END target on an unknown-size stream is rejected
• Normalize multiple leading slashes in Uri::getPath() and origin-form request targets
• Serialize authority-less file URIs with rootless paths without the // separator
• Serialize authority-less file URIs with empty paths as file: instead of the unparseable file://
• Remove dot segments above the root per RFC 3986, prefixing authority-less // paths with /.
• Return a network-path reference from UriResolver::relativize() when an empty-path target requires one
• Stop returning an empty reference from UriResolver::relativize() when it would inherit the base fragment
• Stop throwing from UriResolver::relativize() when an equal-path target's last path segment contains a colon
• Harden URI host validation (delimiters, backslashes, IPv6, embedded ports); require schemes to start with a letter
• Validate Uri::fromParts() ports instead of casting them
• Treat ports 80 and 443 as defaults for the ws and wss schemes
• Use the ws and wss default ports in UriComparator::isCrossOrigin() port comparisons
• Redact all non-empty URI userinfo in Utils::redactUserInfo()
• Rebuild server request URIs from $_SERVER by REQUEST_METHOD, using target authority before SERVER_PORT
• Remove userinfo from absolute-form REQUEST_URI targets in ServerRequest::fromGlobals()
• Reject zero-port HTTP_HOST and malformed SERVER_PORT in ServerRequest::getUriFromGlobals()
• Reject malformed REQUEST_METHOD and SERVER_PROTOCOL server values in ServerRequest::fromGlobals()
• Reject zero-port Host and normalize leading-zero ports in Message::parseRequest()

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)