Bump the composer group across 1 directory with 3 updates

[dependabot]

Bumps the composer group with 2 updates in the / directory: guzzlehttp/guzzle and league/commonmark.

Updates guzzlehttp/guzzle from 7.7.0 to 7.15.1

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.15.1

Security

• Preserve host-only cookie scope and require explicit persistence markers (GHSA-wm3w-8rrp-j577)
• Bound response cookie admission and generated Cookie headers (GHSA-f283-ghqc-fg79)
• Exclude URI fragments from Referer headers generated for redirects (GHSA-h95v-h523-3mw8)

7.15.0

Added

• Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.13
• Use locale-independent ASCII folding for all case normalization and comparison
• Bound cURL upload reads to the declared Content-Length
• Sanitize the cURL error text exposed through exception handler context
• Fail closed when a named cURL multi connection cap cannot be applied
• Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured
• Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles
• Isolate HTTP proxy tunnels from opaque shared connection caches
• Trigger runtime deprecations for previously deprecated functionality in 7.1.0

Deprecated

• Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
• Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array
• Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support

Fixed

• Defer cURL requests created from multi callbacks until native execution unwinds
• Fail synchronous waits from native cURL callbacks promptly instead of self-deadlocking
• Guard cURL multi handle removal against progress callbacks re-entering the handler
• Scope promise waits on the cURL multi handler to the awaited transfer
• Strip Content-Length and Transfer-Encoding when redirects discard the request body
• Stop re-applying the delay request option to followed redirects

7.14.2

Security

• Prevent first-class and proxy URL credentials from reaching origins (GHSA-94pj-82f3-465w)

7.14.1

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.12.5

Fixed

... (truncated)

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.15.1 - 2026-07-18

Security

• Preserve host-only cookie scope and require explicit persistence markers (GHSA-wm3w-8rrp-j577)
• Bound response cookie admission and generated Cookie headers (GHSA-f283-ghqc-fg79)
• Exclude URI fragments from Referer headers generated for redirects (GHSA-h95v-h523-3mw8)

7.15.0 - 2026-07-17

Added

• Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.13
• Use locale-independent ASCII folding for all case normalization and comparison
• Bound cURL upload reads to the declared Content-Length
• Sanitize the cURL error text exposed through exception handler context
• Fail closed when a named cURL multi connection cap cannot be applied
• Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured
• Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles
• Isolate HTTP proxy tunnels from opaque shared connection caches
• Trigger runtime deprecations for previously deprecated functionality in 7.1.0

Deprecated

• Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
• Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array
• Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support

Fixed

• Defer cURL requests created from multi callbacks until native execution unwinds
• Fail synchronous waits from native cURL callbacks promptly instead of self-deadlocking
• Guard cURL multi handle removal against progress callbacks re-entering the handler
• Scope promise waits on the cURL multi handler to the awaited transfer
• Strip Content-Length and Transfer-Encoding when redirects discard the request body
• Stop re-applying the delay request option to followed redirects

7.14.2 - 2026-07-14

Security

• Prevent first-class and proxy URL credentials from reaching origins (GHSA-94pj-82f3-465w)

... (truncated)

Commits

• 61443df Release 7.15.1
• 7b68220 Security fixes 7.15 (#3901)
• 90bd104 Release 7.15.0
• e8c879e Require guzzlehttp/psr7 ^2.13 (#3870)
• 0d578f5 Trigger runtime deprecations for legacy functions and methods (#3896)
• d5fcd1e Deprecate JSON utility methods (#3889)
• 3281fe2 Go with "guzzlehttp/test-server": "^0.7" (#3890)
• ba662c9 Remove stale framing from redirected requests (#3881)
• dd32f84 Bound cURL uploads to declared lengths (#3882)
• a29e961 Merge branch '7.14' into 7.15
• Additional commits viewable in compare view

Updates guzzlehttp/psr7 from 2.5.0 to 2.13.0

Release notes

Sourced from guzzlehttp/psr7's releases.

2.13.0

Added

• Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

• Use locale-independent ASCII case folding everywhere case is normalized
• Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

2.12.4

Changed

• Pass explicit trim characters ahead of the PHP 8.6 trim default change

2.12.3

Security

• Validate the URI host so getHost() matches the URI authority (GHSA-c2w2-prh8-qm98)

2.12.2

Fixed

• Report URI parsing, filtering, and normalization PCRE failures explicitly
• Report HTTP message parser PCRE failures explicitly
• Fail closed when PCRE validation fails for request targets and hosts

2.12.1

Security

• Reject CR/LF in HTTP method, protocol version, and reason phrase (GHSA-vm85-hxw5-5432)

2.12.0

Deprecated

• Deprecated non-finite float values in Query::build() that guzzlehttp/psr7 3.0 rejects
• Deprecated non-finite float multipart contents that guzzlehttp/psr7 3.0 rejects
• Deprecated non-string scalar bodies in Utils::streamFor(); cast them to a string for 3.0
• Deprecated non-string Uri::withQueryValues() values; cast them to a string for 3.0

2.11.1

Fixed

• Fixed non-finite float values emitting coercion warnings on PHP 8.5

2.11.0

Changed

• Changed Utils::modifyRequest() to reject conflicting URI and Host header changes in the same call
• Changed Header::parse() to split semicolon-separated parameters without repeated regular expression lookaheads

... (truncated)

Changelog

Sourced from guzzlehttp/psr7's changelog.

2.13.0 - 2026-07-16

Added

• Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

• Use locale-independent ASCII case folding everywhere case is normalized
• Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

2.12.5 - 2026-07-13

Fixed

• Compare header names and hosts with locale-independent ASCII lowercasing
• Compare hosts without locale sensitivity when detecting cross-origin redirects

2.12.4 - 2026-07-08

Changed

• Pass explicit trim characters ahead of the PHP 8.6 trim default change

Fixed

• Anchor server port and response start-line patterns to the true end of input
• Treat host-less origin-form request targets starting with // as paths in Message::parseRequest()
• Reject raw DEL bytes in bracketed IP-literal hosts instead of parsing a mutated host
• Reject invalid bytes after a bracketed IP-literal host instead of reparsing a different host

2.12.3 - 2026-06-23

Security

• Validate the URI host so getHost() matches the URI authority (GHSA-c2w2-prh8-qm98)

2.12.2 - 2026-06-23

Fixed

• Report URI parsing, filtering, and normalization PCRE failures explicitly
• Report HTTP message parser PCRE failures explicitly
• Fail closed when PCRE validation fails for request targets and hosts

2.12.1 - 2026-06-18

Security

• Reject CR/LF in HTTP method, protocol version, and reason phrase (GHSA-vm85-hxw5-5432)

... (truncated)

Commits

• dad8962 Release 2.13.0
• 1bc4f53 Trigger a runtime deprecation for Header::normalize() (#866)
• a1372ea Add tests locking in no-file upload handling (#856)
• d9561d1 Merge branch '2.12' into 2.13
• 9365d57 Release 2.12.5
• b82bac4 Add caseless comparison and asciiUcFirst helpers (#854)
• 2cf293e Merge branch '2.12' into 2.13
• c685419 Fold cross-origin host comparison without locale sensitivity (#852)
• 226b5b3 Add locale-independent ASCII case folding helpers (#850)
• 1acfa28 Use locale-independent ASCII folding for header and host names (#849)
• Additional commits viewable in compare view

Updates league/commonmark from 2.4.0 to 2.8.3

Release notes

Sourced from league/commonmark's releases.

2.8.3

What's Changed

Fixed

• Fixed tab-indented fenced code blocks inside list items losing the first character of each line and having their info string mangled (#981, #1130)
• Fixed the unsafe link filter incorrectly blocking safe URLs containing vbscript:, file:, or data: anywhere after the start (#1131)

Full Changelog: thephpleague/commonmark@2.8.2...2.8.3

2.8.2

This is a security release to address an issue where the allowed_domains setting for the Embed extension can be bypassed, resulting in a possible SSRF and XSS vulnerabilities.

Fixed

• Fixed DomainFilteringAdapter hostname boundary bypass where domains like youtube.com.evil could match an allowlist entry for youtube.com (GHSA-hh8v-hgvp-g3f5)

Full Changelog: thephpleague/commonmark@2.8.1...2.8.2

2.8.1

What's Changed

This is a security release to address an issue where DisallowedRawHtml can be bypassed, resulting in a possible cross-site scripting (XSS) vulnerability.

Fixed

• Fixed DisallowedRawHtmlRenderer not blocking raw HTML tags with trailing ASCII whitespace (GHSA-4v6x-c7xx-hw9f)
• Fixed PHP 8.5 deprecation (#1107)

New Contributors

• @​Kocal made their first contribution in thephpleague/commonmark#1106
• @​freost made their first contribution in thephpleague/commonmark#1107

Full Changelog: thephpleague/commonmark@2.8.0...2.8.1

2.8.0

What's Changed

Added

• Added a new HighlightExtension for marking important text using == syntax (#1100)

Fixed

• Fixed AutolinkExtension incorrectly matching URLs after invalid www. prefix (#1095, #1103)

New Contributors

• @​samwilson made their first contribution in thephpleague/commonmark#1090
• @​ossobuffo made their first contribution in thephpleague/commonmark#1100

Full Changelog: thephpleague/commonmark@2.7.1...2.8.0

2.7.1

Notable Changes

... (truncated)

Changelog

Sourced from league/commonmark's changelog.

[2.8.3] - 2026-07-12

Fixed

• Fixed tab-indented fenced code blocks inside list items losing the first character of each line and having their info string mangled (#981, #1130)
• Fixed the unsafe link filter incorrectly blocking safe URLs containing vbscript:, file:, or data: anywhere after the start (#1131)

[2.8.2] - 2026-03-19

This is a security release to address an issue where the allowed_domains setting for the Embed extension can be bypassed, resulting in a possible SSRF and XSS vulnerabilities.

Fixed

• Fixed DomainFilteringAdapter hostname boundary bypass where domains like youtube.com.evil could match an allowlist entry for youtube.com (GHSA-hh8v-hgvp-g3f5)

[2.8.1] - 2026-03-05

This is a security release to address an issue where DisallowedRawHtml can be bypassed, resulting in a possible cross-site scripting (XSS) vulnerability.

Fixed

• Fixed DisallowedRawHtmlRenderer not blocking raw HTML tags with trailing ASCII whitespace (GHSA-4v6x-c7xx-hw9f)
• Fixed PHP 8.5 deprecation (#1107)

[2.8.0] - 2025-11-26

Added

• Added a new HighlightExtension for marking important text using == syntax (#1100)

Fixed

• Fixed AutolinkExtension incorrectly matching URLs after invalid www. prefix (#1095, #1103)

[2.7.1] - 2025-07-20

Changed

• Optimized several regular expressions in RegexHelper to improve performance (#674, #1086)

Fixed

• EmbedProcessor no longer calls updateEmbeds() when there are no embeds to update (#1081)
• Fixed missing benchmark.php CSV path validation for non-existent files (#1068, #1085)

[2.7.0] - 2025-05-05

This is a security release to address a potential cross-site scripting (XSS) vulnerability when using the AttributesExtension with untrusted user input.

Added

• Added attributes/allow config option to specify which attributes users are allowed to set on elements (default allows virtually all attributes)

Changed

• The AttributesExtension blocks all attributes starting with on unless explicitly allowed via the attributes/allow config option
• The allow_unsafe_links option is now respected by the AttributesExtension when users specify href and src attributes

[2.6.2] - 2025-04-18

... (truncated)

Commits

• 1902f60 Prepare for 2.8.3 release
• 171f927 Update changelog
• 51b529f Fix tab handling in fenced code blocks (#1130)
• cfb11ec Fix over-blocking of safe URLs by the unsafe link filter (#1131)
• fb59dbc Strengthen unsafe link and image renderer test assertions (#1129)
• 4d0b5b1 Fix typos and broken formatting in the 2.x docs (#1128)
• 73d4f1f Add Anthropic to the list of sponsors
• 0faf9ee Merge pull request #1125 from thephpleague/fix/markdownlint-md060
• a85b4ad Fetch full git history for the Markdownlint job
• e6dc715 Fix Markdownlint CI job by not overriding DEFAULT_BRANCH
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

While this PR successfully targets updates for Guzzle and Commonmark, it leaves the application exposed to two high-severity security vulnerabilities in symfony/process and laravel/framework. Additionally, the PR lacks automated tests to verify that the upgraded libraries do not break existing HTTP, Markdown rendering, or header normalization logic. Although Codacy rates the PR as up to standards, these unaddressed security flaws and the lack of verification scenarios should be resolved before merging.

About this PR

• There are no new or existing tests included in the PR to validate the impact of these library updates on the application's functionality.
• The PR description summary incorrectly states '2 updates' while the PR actually includes three dependency upgrades (Guzzle, PSR-7, and Commonmark).

2 comments outside of the diff

composer.lock

_{line 4968 🔴 HIGH RISK}
The symfony/process component is affected by CVE-2024-51736, which allows command execution hijacking on Windows systems if an executable with the same name as the command is present in the current working directory.

_{line 1030 🔴 HIGH RISK}
The laravel/framework package is affected by CVE-2024-52301. In specific PHP-CGI configurations where the register_argc_argv php.ini setting is enabled, the application is vulnerable to command-line argument injection.

Test suggestions

• Missing recommended test scenario: Verify that HTTP client functionality remains correct under Guzzle 7.15.1, particularly regarding the new security-hardened cookie handling and redirect logic.
• Missing recommended test scenario: Verify that Markdown rendering with league/commonmark 2.8.3 correctly handles fenced code blocks and adheres to safe URL filtering rules.
• Missing recommended test scenario: Ensure that the locale-independent ASCII folding introduced in psr7 2.13.0 does not break existing header or host normalization logic.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Missing recommended test scenario: Verify that HTTP client functionality remains correct under Guzzle 7.15.1, particularly regarding the new security-hardened cookie handling and redirect logic.
2. Missing recommended test scenario: Verify that Markdown rendering with league/commonmark 2.8.3 correctly handles fenced code blocks and adheres to safe URL filtering rules.
3. Missing recommended test scenario: Ensure that the locale-independent ASCII folding introduced in psr7 2.13.0 does not break existing header or host normalization logic.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}