fix(php): bump guzzlehttp packages for Dependabot/OSV advisories

[proxymeshai]

Summary

• Reviewed open security findings across proxy-examples ecosystems (npm, RubyGems, Packagist, PyPI via OSV/npm audit/composer audit; GitHub Dependabot alerts API is not accessible to this token).
• Only remaining vulnerabilities were in the PHP lockfile: guzzlehttp/guzzle 7.10.0 and guzzlehttp/psr7 2.9.0.
• Bumped guzzlehttp/guzzle → 7.15.2 and guzzlehttp/psr7 → 2.13.0 (plus related transitive updates: promises, deprecation-contracts, polyfill-php80).

Advisories addressed

• Guzzle: cookie/proxy/redirect issues fixed in 7.12.1–7.15.1 (e.g. GHSA-wpwq-4j6v-78m3, GHSA-f283-ghqc-fg79, GHSA-94pj-82f3-465w)
• psr7: host confusion / CRLF issues fixed in 2.10.2–2.12.3 (e.g. GHSA-c2w2-prh8-qm98, GHSA-vm85-hxw5-5432)

composer audit and OSV Packagist querybatch are clean afterward. PHP integration check passed. npm/ruby had no open vulns; Python requirements had no actionable current advisories.

Slack Thread

  

[cursor]

Approved: lockfile-only security version bump for guzzlehttp packages with all status checks passing. No reviewers assigned. Auto-merge could not be enabled from this run’s available tools.

  

_{Sent by Cursor Approval Agent: oss dependabot approver}