Bump guzzlehttp/guzzle from 7.15.1 to 7.15.3

[dependabot]

Bumps guzzlehttp/guzzle from 7.15.1 to 7.15.3.

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.15.3

Changed

• Adjusted guzzlehttp/promises version constraint to ^2.5.2

Fixed

• Fail a cURL multi handler wait with an attributable error when the transfer is no longer tracked
• Fix StreamHandler resolving numeric IPv4 hosts differently from cURL handlers on macOS and Windows
• Fix StreamHandler TLS peer names and proxy authorities for numeric IPv4 hosts on all platforms
• Settle a cURL multi handler transfer displaced by a request reusing its native handle ID

7.15.2

Security

• Reject non-printable-ASCII and percent-escaped URI hosts and Host headers (GHSA-v5mv-p594-2x33)
• Reject request URI hosts that contain a URI authority delimiter (GHSA-v5mv-p594-2x33)
• Reject numeric-looking URI hosts with trailing dots, read as IPv4 addresses (GHSA-v5mv-p594-2x33)
• Treat numeric-in-any-base and percent-escaped cookie domains as exact-match-only (GHSA-f7vp-7xgx-4w4r)
• Regenerate a derived Host header after client URI rewrites (GHSA-v5mv-p594-2x33)

Fixed

• Preserve RequestException when the stream handler rejects a request before opening a stream

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.15.3 - 2026-08-05

Changed

• Adjusted guzzlehttp/promises version constraint to ^2.5.2

Fixed

• Fail a cURL multi handler wait with an attributable error when the transfer is no longer tracked
• Fix StreamHandler resolving numeric IPv4 hosts differently from cURL handlers on macOS and Windows
• Fix StreamHandler TLS peer names and proxy authorities for numeric IPv4 hosts on all platforms
• Settle a cURL multi handler transfer displaced by a request reusing its native handle ID

7.15.2 - 2026-07-26

Security

• Reject non-printable-ASCII and percent-escaped URI hosts and Host headers (GHSA-v5mv-p594-2x33)
• Reject request URI hosts that contain a URI authority delimiter (GHSA-v5mv-p594-2x33)
• Reject numeric-looking URI hosts with trailing dots, read as IPv4 addresses (GHSA-v5mv-p594-2x33)
• Treat numeric-in-any-base and percent-escaped cookie domains as exact-match-only (GHSA-f7vp-7xgx-4w4r)
• Regenerate a derived Host header after client URI rewrites (GHSA-v5mv-p594-2x33)

Fixed

• Preserve RequestException when the stream handler rejects a request before opening a stream

Commits

• ae311b8 Release 7.15.3
• e3d8b4b Adjust the guzzlehttp/promises version constraint to ^2.5.2 (#3920)
• c55971f Settle cURL multi transfers displaced by native handle ID reuse (#3917)
• 04a8319 Fold numeric IPv4 hosts in the stream handler (#3909)
• ae0facb Reject untracked cURL multi handler waits with an attributable error (#3911)
• 7441019 Security fixes 7.15 (#3907)
• See full diff in compare view