build(deps): bump guzzlehttp/guzzle from 7.13.1 to 7.15.1

[dependabot]

Bumps guzzlehttp/guzzle from 7.13.1 to 7.15.1.

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.15.1

Security

• Preserve host-only cookie scope and require explicit persistence markers (GHSA-wm3w-8rrp-j577)
• Bound response cookie admission and generated Cookie headers (GHSA-f283-ghqc-fg79)
• Exclude URI fragments from Referer headers generated for redirects (GHSA-h95v-h523-3mw8)

7.15.0

Added

• Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.13
• Use locale-independent ASCII folding for all case normalization and comparison
• Bound cURL upload reads to the declared Content-Length
• Sanitize the cURL error text exposed through exception handler context
• Fail closed when a named cURL multi connection cap cannot be applied
• Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured
• Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles
• Isolate HTTP proxy tunnels from opaque shared connection caches
• Trigger runtime deprecations for previously deprecated functionality in 7.1.0

Deprecated

• Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
• Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array
• Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support

Fixed

• Defer cURL requests created from multi callbacks until native execution unwinds
• Fail synchronous waits from native cURL callbacks promptly instead of self-deadlocking
• Guard cURL multi handle removal against progress callbacks re-entering the handler
• Scope promise waits on the cURL multi handler to the awaited transfer
• Strip Content-Length and Transfer-Encoding when redirects discard the request body
• Stop re-applying the delay request option to followed redirects

7.14.2

Security

• Prevent first-class and proxy URL credentials from reaching origins (GHSA-94pj-82f3-465w)

7.14.1

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.12.5

Fixed

... (truncated)

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.15.1 - 2026-07-18

Security

• Preserve host-only cookie scope and require explicit persistence markers (GHSA-wm3w-8rrp-j577)
• Bound response cookie admission and generated Cookie headers (GHSA-f283-ghqc-fg79)
• Exclude URI fragments from Referer headers generated for redirects (GHSA-h95v-h523-3mw8)

7.15.0 - 2026-07-17

Added

• Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.13
• Use locale-independent ASCII folding for all case normalization and comparison
• Bound cURL upload reads to the declared Content-Length
• Sanitize the cURL error text exposed through exception handler context
• Fail closed when a named cURL multi connection cap cannot be applied
• Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured
• Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles
• Isolate HTTP proxy tunnels from opaque shared connection caches
• Trigger runtime deprecations for previously deprecated functionality in 7.1.0

Deprecated

• Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
• Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array
• Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support

Fixed

• Defer cURL requests created from multi callbacks until native execution unwinds
• Fail synchronous waits from native cURL callbacks promptly instead of self-deadlocking
• Guard cURL multi handle removal against progress callbacks re-entering the handler
• Scope promise waits on the cURL multi handler to the awaited transfer
• Strip Content-Length and Transfer-Encoding when redirects discard the request body
• Stop re-applying the delay request option to followed redirects

7.14.2 - 2026-07-14

Security

• Prevent first-class and proxy URL credentials from reaching origins (GHSA-94pj-82f3-465w)

... (truncated)

Commits

• 61443df Release 7.15.1
• 7b68220 Security fixes 7.15 (#3901)
• 90bd104 Release 7.15.0
• e8c879e Require guzzlehttp/psr7 ^2.13 (#3870)
• 0d578f5 Trigger runtime deprecations for legacy functions and methods (#3896)
• d5fcd1e Deprecate JSON utility methods (#3889)
• 3281fe2 Go with "guzzlehttp/test-server": "^0.7" (#3890)
• ba662c9 Remove stale framing from redirected requests (#3881)
• dd32f84 Bound cURL uploads to declared lengths (#3882)
• a29e961 Merge branch '7.14' into 7.15
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.45%. Comparing base (af025f9) to head (5d8b513).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@                                  Coverage Diff                                  @@
##             dependabot/github_actions/actions/setup-node-7.0.0    #2541   +/-   ##
=====================================================================================
  Coverage                                                 86.45%   86.45%           
  Complexity                                                23329    23329           
=====================================================================================
  Files                                                      1772     1772           
  Lines                                                     71001    71001           
=====================================================================================
+ Hits                                                      61383    61384    +1     
+ Misses                                                     9618     9617    -1     

Components	Coverage Δ
etl	90.37% <ø> (ø)
cli	89.40% <ø> (ø)
lib-array-dot	81.44% <ø> (ø)
lib-azure-sdk	64.44% <ø> (ø)
lib-doctrine-dbal-bulk	93.61% <ø> (ø)
lib-filesystem	86.64% <ø> (ø)
lib-types	91.15% <ø> (ø)
lib-parquet	70.23% <ø> (ø)
lib-parquet-viewer	82.26% <ø> (ø)
lib-snappy	89.82% <ø> (+0.44%)	⬆️
lib-dremel	0.00% <ø> (ø)
lib-postgresql	88.62% <ø> (ø)
lib-telemetry	86.58% <ø> (ø)
bridge-filesystem-async-aws	92.74% <ø> (ø)
bridge-filesystem-azure	90.45% <ø> (ø)
bridge-monolog-http	96.82% <ø> (ø)
bridge-monolog-telemetry	94.79% <ø> (ø)
bridge-openapi-specification	92.07% <ø> (ø)
symfony-http-foundation	78.57% <ø> (ø)
bridge-psr18-telemetry	100.00% <ø> (ø)
bridge-psr3-telemetry	98.95% <ø> (ø)
bridge-psr7-telemetry	100.00% <ø> (ø)
bridge-telemetry-otlp	90.41% <ø> (ø)
bridge-symfony-http-foundation-telemetry	92.85% <ø> (ø)
bridge-symfony-filesystem-bundle	91.85% <ø> (ø)
bridge-symfony-filesystem-cache	98.18% <ø> (ø)
bridge-symfony-postgresql-bundle	93.70% <ø> (ø)
bridge-symfony-postgresql-cache	94.41% <ø> (ø)
bridge-symfony-postgresql-messenger	98.80% <ø> (ø)
bridge-symfony-postgresql-session	93.65% <ø> (ø)
bridge-symfony-telemetry-bundle	90.10% <ø> (ø)
adapter-chartjs	84.05% <ø> (ø)
adapter-csv	89.46% <ø> (ø)
adapter-doctrine	90.75% <ø> (ø)
adapter-google-sheet	91.56% <ø> (ø)
adapter-http	73.23% <ø> (ø)
adapter-json	87.30% <ø> (ø)
adapter-logger	50.00% <ø> (ø)
adapter-parquet	88.69% <ø> (ø)
adapter-text	92.59% <ø> (ø)
adapter-xml	83.56% <ø> (ø)
adapter-avro	0.00% <ø> (ø)
adapter-excel	86.72% <ø> (ø)
adapter-postgresql	90.84% <ø> (ø)
adapter-seal	83.26% <ø> (ø)
bridge-phpunit-postgresql	75.30% <ø> (ø)
bridge-phpunit-telemetry	87.32% <ø> (ø)
bridge-phpstan-types	0.00% <ø> (ø)
bridge-postgresql-valinor	100.00% <ø> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.