chore(deps-dev): bump guzzlehttp/psr7 from 2.12.0 to 2.12.4

[dependabot]

Bumps guzzlehttp/psr7 from 2.12.0 to 2.12.4.

Release notes

Sourced from guzzlehttp/psr7's releases.

2.12.4

Changed

• Pass explicit trim characters ahead of the PHP 8.6 trim default change

2.12.3

Security

• Validate the URI host so getHost() matches the URI authority (GHSA-c2w2-prh8-qm98)

2.12.2

Fixed

• Report URI parsing, filtering, and normalization PCRE failures explicitly
• Report HTTP message parser PCRE failures explicitly
• Fail closed when PCRE validation fails for request targets and hosts

2.12.1

Security

• Reject CR/LF in HTTP method, protocol version, and reason phrase (GHSA-vm85-hxw5-5432)

Changelog

Sourced from guzzlehttp/psr7's changelog.

2.12.4 - 2026-07-08

Changed

• Pass explicit trim characters ahead of the PHP 8.6 trim default change

Fixed

• Anchor server port and response start-line patterns to the true end of input
• Treat host-less origin-form request targets starting with // as paths in Message::parseRequest()
• Reject raw DEL bytes in bracketed IP-literal hosts instead of parsing a mutated host
• Reject invalid bytes after a bracketed IP-literal host instead of reparsing a different host

2.12.3 - 2026-06-23

Security

• Validate the URI host so getHost() matches the URI authority (GHSA-c2w2-prh8-qm98)

2.12.2 - 2026-06-23

Fixed

• Report URI parsing, filtering, and normalization PCRE failures explicitly
• Report HTTP message parser PCRE failures explicitly
• Fail closed when PCRE validation fails for request targets and hosts

2.12.1 - 2026-06-18

Security

• Reject CR/LF in HTTP method, protocol version, and reason phrase (GHSA-vm85-hxw5-5432)

Commits

• 51e27f9 Release 2.12.4
• 25bde3c Reject raw DEL and ambiguous suffixes in bracketed IP-literal parsing (#836)
• 7a20ba3 Cover negative seek targets in CachingStreamTest (#823)
• a8539ed Treat host-less origin-form // targets as paths (#820)
• 7aee8d7 Add regression tests for multi-slash URI paths (#816)
• e0faef6 Anchor validation patterns to the true end of input (#814)
• c8edab2 Freeze trim characters ahead of PHP 8.6 (#812)
• 7ec62dc Release 2.12.3
• ddd64f1 Validate the URI host so getHost() matches the URI authority (#811)
• 5ec8b15 Release 2.12.2
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[private-packagist]

composer.lock

Dev Package changes

Package	Operation	From	To	About
guzzlehttp/psr7	upgrade	2.12.0 ⚠️	2.12.4 ✅	diff
symfony/deprecation-contracts	upgrade	v3.7.0	v3.7.1	diff

---

Settings · Docs · Powered by Private Packagist