Skip to content

build(deps): bump the composer group across 2 directories with 12 updates#426

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/composer-5a993aa1d1
Open

build(deps): bump the composer group across 2 directories with 12 updates#426
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/composer-5a993aa1d1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 22, 2026

Copy link
Copy Markdown
Contributor

Bumps the composer group with 9 updates in the / directory:

Package From To
guzzlehttp/guzzle 7.10.0 7.12.1
phpoffice/phpspreadsheet 4.5.0 5.7.0
phpseclib/phpseclib 3.0.50 3.0.54
symfony/cache 7.4.8 7.4.13
symfony/dom-crawler 7.4.8 7.4.12
symfony/http-foundation 6.4.35 6.4.41
symfony/mailer 6.4.34 6.4.40
symfony/routing 6.4.34 6.4.41
symfony/yaml 7.4.8 7.4.13

Bumps the composer group with 1 update in the /WordPress Extension/libs directory: guzzlehttp/guzzle.

Updates guzzlehttp/guzzle from 7.10.0 to 7.12.1

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.12.1

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.12.1

Fixed

  • Reject proxy URLs with a malformed scheme in the cURL handlers instead of letting libcurl mishandle them

Security

7.12.0

Added

  • Added RequestOptions constants for curl, retries, and stream_context

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.12
  • Constrain cURL transport sharing to safe libcurl DNS and SSL session support
  • Resolve proxy environment variables in the cURL handlers; libcurl no longer reads the environment itself
  • Ignore proxy environment variables when the proxy request option makes a decision
  • Disable proxy environment variables on Windows SAPIs other than CLI (httpoxy hardening)
  • Redact proxy credentials from cURL handler error messages, following Psr7\Utils::redactUserInfo()
  • Normalize no-proxy domain and IP literal matching across the cURL and stream handlers

Deprecated

  • Deprecated the request-level handler option, which will be ignored in 8.0
  • Deprecated raw cURL request options outside the built-in cURL handlers' allow-list
  • Deprecated the CURLOPT_PROXYTYPE cURL request option; set the proxy type via a scheme-prefixed proxy URL
  • Deprecated PHP stream context options outside the built-in stream handler allow-list
  • Deprecated passing ntlm as a built-in auth type
  • Deprecated Utils::describeType()
  • Deprecated non-finite floats in the query and form_params options; 8.0 rejects them
  • Deprecated non-string scalar values in the body option; 8.0 rejects them

Fixed

  • Fix cURL TLS and HTTP/2 capability detection using libcurl feature checks
  • Fix proxy no list matches being re-proxied through environment-configured proxies by libcurl
  • Fix no list and NO_PROXY matching to support IP CIDR ranges, matching libcurl
  • Fix the stream handler not applying scheme-less proxies and their credentials

7.11.2

Fixed

... (truncated)

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.12.1 - 2026-06-18

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.12.1

Fixed

  • Reject proxy URLs with a malformed scheme in the cURL handlers instead of letting libcurl mishandle them

Security

7.12.0 - 2026-06-16

Added

  • Added RequestOptions constants for curl, retries, and stream_context

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.12
  • Constrain cURL transport sharing to safe libcurl DNS and SSL session support
  • Resolve proxy environment variables in the cURL handlers; libcurl no longer reads the environment itself
  • Ignore proxy environment variables when the proxy request option makes a decision
  • Disable proxy environment variables on Windows SAPIs other than CLI (httpoxy hardening)
  • Redact proxy credentials from cURL handler error messages, following Psr7\Utils::redactUserInfo()
  • Normalize no-proxy domain and IP literal matching across the cURL and stream handlers

Deprecated

  • Deprecated the request-level handler option, which will be ignored in 8.0
  • Deprecated raw cURL request options outside the built-in cURL handlers' allow-list
  • Deprecated the CURLOPT_PROXYTYPE cURL request option; set the proxy type via a scheme-prefixed proxy URL
  • Deprecated PHP stream context options outside the built-in stream handler allow-list
  • Deprecated passing ntlm as a built-in auth type
  • Deprecated Utils::describeType()
  • Deprecated non-finite floats in the query and form_params options; 8.0 rejects them
  • Deprecated non-string scalar values in the body option; 8.0 rejects them

Fixed

  • Fix cURL TLS and HTTP/2 capability detection using libcurl feature checks
  • Fix proxy no list matches being re-proxied through environment-configured proxies by libcurl
  • Fix no list and NO_PROXY matching to support IP CIDR ranges, matching libcurl
  • Fix the stream handler not applying scheme-less proxies and their credentials

... (truncated)

Commits
  • d346274 Release 7.12.1
  • 7f537cd Reject dot-only cookie domains (#3653)
  • 29482f2 Adjust version constraints (#3651)
  • fc70174 Reject proxy URLs with a malformed scheme in the cURL handlers (#3637)
  • 0f4da82 Reject HTTPS proxies when libcurl lacks HTTPS-proxy support (#3626)
  • eaa8159 Release 7.12.0
  • e0d3349 Adjusted guzzlehttp/psr7 version constraint and corrected links (#3646)
  • 8ca9415 Normalize scalar body request options (#3644)
  • 1a8d3aa Translate scheme-less proxies and their credentials in the stream handler (#3...
  • 751f7a5 Revert too aggressive authenticated proxy tunnel reuse mitigation (#3641)
  • Additional commits viewable in compare view

Updates phpoffice/phpspreadsheet from 4.5.0 to 5.7.0

Release notes

Sourced from phpoffice/phpspreadsheet's releases.

5.7.0

Fixed

  • Security patches.

5.6.0

Added

Deprecated

  • Collection/Cells::MAX_COLUMN_ID - use Cell/AddressRange::MAX_COLUMN_INT.
  • Writer/Xls/Worksheet constants MAX_XLS_COLUMN, MAX_XLS_COLUMN_STRING, MAX_XLS_ROW - use Cell/AddressRange MAX_COLUMN_INT_XLS, MAX_COLUMN_XLS, MAX_ROW_XLS

Fixed

5.5.0

Added

Deprecated

  • Writer/Html constant BODY_LINE no longer makes sense with a configurable line ending. No replacement.
  • Calculation classes FormulaParser and FormulaToken are unused. No replacement.
  • Writer/Xls/Worksheet methods insertBitMap, positionImage, writeObjPicture, processBitmapGd, and processBitmap are unused. No replacement.

Fixed

... (truncated)

Changelog

Sourced from phpoffice/phpspreadsheet's changelog.

2026-04-19 - 5.7.0

Fixed

  • Security patches.

2026-04-09 - 5.6.0

Added

Removed

  • Nothing yet.

Changed

  • Nothing yet.

Moved

  • Nothing yet.

Deprecated

  • Collection/Cells::MAX_COLUMN_ID - use Cell/AddressRange::MAX_COLUMN_INT.
  • Writer/Xls/Worksheet constants MAX_XLS_COLUMN, MAX_XLS_COLUMN_STRING, MAX_XLS_ROW - use Cell/AddressRange MAX_COLUMN_INT_XLS, MAX_COLUMN_XLS, MAX_ROW_XLS

Fixed

2026-02-28 - 5.5.0

Added

... (truncated)

Commits
  • 9f55d3b Merge pull request #4859 from oleibman/updchangelog20260419
  • 2e35213 Update Changelog for New Release
  • 9019a9c Merge commit from fork
  • f1eb4e6 Merge commit from fork
  • 9b90dee Merge pull request #4857 from oleibman/changelog20260406
  • f302b32 Prepare Changelog For New Release
  • 4a47607 Merge pull request #4850 from oleibman/updatestan
  • 8a9e9b5 Merge pull request #4845 from oleibman/csvnonutf8
  • 5d6d7d5 Merge branch 'master' into csvnonutf8
  • 6f23fe3 Merge pull request #4844 from oleibman/xlookup
  • Additional commits viewable in compare view

Updates phpseclib/phpseclib from 3.0.50 to 3.0.54

Release notes

Sourced from phpseclib/phpseclib's releases.

3.0.54

  • X509: add setURLFetchCallback() method

3.0.53

  • RSA: decryption with password protected keys didn't work with OpenSSL engine (#2140)
  • ASN1: speed up OID calculations
  • SFTP: add hardlink() method (#2142)
  • DES: fix PHP deprecations (#2145)

3.0.52

  • ASN1: more stringent OID length limits (CVE-2026-44167)
  • RSA: OpenSSL 3.2+ changed how PKCS1 decryption works (#2136)
  • Keys/OpenSSH: support comments with spaces in them (#2137)

3.0.51

  • SSH2: use constant time string comparison in get_binary_packet() (CVE-2026-40194)
  • RSA: add sha3 support (#2132)
  • use new OpenSSL functionality (#2130)
Changelog

Sourced from phpseclib/phpseclib's changelog.

3.0.54 - 2026-06-14

  • X509: add setURLFetchCallback() method

3.0.53 - 2026-06-09

  • RSA: decryption with password protected keys didn't work with OpenSSL engine (#2140)
  • ASN1: speed up OID calculations
  • SFTP: add hardlink() method (#2142)
  • DES: fix PHP deprecations (#2145)

3.0.52 - 2026-04-27

  • ASN1: more stringent OID length limits (CVE-2026-44167)
  • RSA: OpenSSL 3.2+ changed how PKCS1 decryption works (#2136)
  • Keys/OpenSSH: support comments with spaces in them (#2137)

3.0.51 - 2026-04-09

  • SSH2: use constant time string comparison in get_binary_packet() (CVE-2026-40194)
  • RSA: add sha3 support (#2132)
  • use new OpenSSL functionality (#2130)
Commits
  • 5418963 Merge branch '2.0' into 3.0
  • d73c9e0 Merge branch '1.0' into 2.0
  • fa867e5 CHANGELOG: add new release
  • 5bbefa4 X509: add visibility
  • 5eabac9 Merge branch '2.0' into 3.0
  • bab8dc0 X509: make setURLFetchCallback static and use filter_var
  • f5c33c4 Merge branch '1.0' into 2.0
  • 0987dd9 X509: add setURLFetchCallback() method
  • 00c3bd1 DSA/PKCS1: require version be 0
  • 9116b83 BigInteger/GMP: getLengthInBytes() fix for empty strings
  • Additional commits viewable in compare view

Updates guzzlehttp/psr7 from 2.9.0 to 2.12.1

Release notes

Sourced from guzzlehttp/psr7's releases.

2.12.1

Security

2.12.0

Deprecated

  • Deprecated non-finite float values in Query::build() that guzzlehttp/psr7 3.0 rejects
  • Deprecated non-finite float multipart contents that guzzlehttp/psr7 3.0 rejects
  • Deprecated non-string scalar bodies in Utils::streamFor(); cast them to a string for 3.0
  • Deprecated non-string Uri::withQueryValues() values; cast them to a string for 3.0

2.11.1

Fixed

  • Fixed non-finite float values emitting coercion warnings on PHP 8.5

2.11.0

Changed

  • Changed Utils::modifyRequest() to reject conflicting URI and Host header changes in the same call
  • Changed Header::parse() to split semicolon-separated parameters without repeated regular expression lookaheads
  • Changed UriComparator::isCrossOrigin() so only HTTP and HTTPS missing ports receive implicit default ports

Deprecated

  • Deprecated invalid PSR-7 arguments that guzzlehttp/psr7 3.0 will require native types for
  • Deprecated non-string header values that guzzlehttp/psr7 3.0 will reject
  • Deprecated empty header value arrays that guzzlehttp/psr7 3.0 will reject
  • Deprecated URI schemes that do not match guzzlehttp/psr7 3.0 syntax requirements
  • Deprecated multipart boundary and custom part header metadata that guzzlehttp/psr7 3.0 will reject
  • Deprecated reliance on automatic uppercasing of request methods; guzzlehttp/psr7 3.0 preserves method casing
  • Deprecated invalid Utils::modifyRequest() change values that guzzlehttp/psr7 3.0 will reject

Fixed

  • Fixed Utils::copyToStream() to retry short destination writes instead of dropping the unwritten remainder
  • Fixed Header::parse() splitting of semicolon-separated parameters with escaped quotes

2.10.4

Fixed

  • Apply UriNormalizer percent-encoding normalizations to URI fragments
  • Make LimitStream::getSize() return 0 for slices past the underlying stream end
  • Make AppendStream::read() return an empty string when no streams are attached
  • Make CachingStream::read() throw on an incomplete cache-target write instead of silently corrupting replays
  • Prevent CachingStream::seek() from looping indefinitely when the remote stream makes no progress

2.10.3

... (truncated)

Changelog

Sourced from guzzlehttp/psr7's changelog.

2.12.1 - 2026-06-18

Security

2.12.0 - 2026-06-16

Deprecated

  • Deprecated non-finite float values in Query::build() that guzzlehttp/psr7 3.0 rejects
  • Deprecated non-finite float multipart contents that guzzlehttp/psr7 3.0 rejects
  • Deprecated non-string scalar bodies in Utils::streamFor(); cast them to a string for 3.0
  • Deprecated non-string Uri::withQueryValues() values; cast them to a string for 3.0

2.11.1 - 2026-06-12

Fixed

  • Fixed non-finite float values emitting coercion warnings on PHP 8.5

2.11.0 - 2026-06-02

Changed

  • Changed Utils::modifyRequest() to reject conflicting URI and Host header changes in the same call
  • Changed Header::parse() to split semicolon-separated parameters without repeated regular expression lookaheads
  • Changed UriComparator::isCrossOrigin() so only HTTP and HTTPS missing ports receive implicit default ports

Deprecated

  • Deprecated invalid PSR-7 arguments that guzzlehttp/psr7 3.0 will require native types for
  • Deprecated non-string header values that guzzlehttp/psr7 3.0 will reject
  • Deprecated empty header value arrays that guzzlehttp/psr7 3.0 will reject
  • Deprecated URI schemes that do not match guzzlehttp/psr7 3.0 syntax requirements
  • Deprecated multipart boundary and custom part header metadata that guzzlehttp/psr7 3.0 will reject
  • Deprecated reliance on automatic uppercasing of request methods; guzzlehttp/psr7 3.0 preserves method casing
  • Deprecated invalid Utils::modifyRequest() change values that guzzlehttp/psr7 3.0 will reject

Fixed

  • Fixed Utils::copyToStream() to retry short destination writes instead of dropping the unwritten remainder
  • Fixed Header::parse() splitting of semicolon-separated parameters with escaped quotes

2.10.4 - 2026-05-29

Fixed

  • Apply UriNormalizer percent-encoding normalizations to URI fragments
  • Make LimitStream::getSize() return 0 for slices past the underlying stream end

... (truncated)

Commits

Updates symfony/cache from 7.4.8 to 7.4.13

Release notes

Sourced from symfony/cache's releases.

v7.4.13

Changelog (symfony/cache@v7.4.12...v7.4.13)

v7.4.12

Changelog (symfony/cache@v7.4.10...v7.4.12)

v7.4.10

Changelog (symfony/cache@v7.4.9...v7.4.10)

v7.4.9

Changelog (symfony/cache@v7.4.8...v7.4.9)

Commits
  • 4c09e18 Merge branch '6.4' into 7.4
  • 5490a57 Merge branch '5.4' into 6.4
  • bf58147 [Cache] skip tests for adapters that cannot clear by prefix
  • f796e47 Ignore Doctrine DBAL deprecations that can't be worked around
  • bf9d30f Merge branch '6.4' into 7.4
  • 03472b6 [Cache] Fix strlen(null) deprecation on RelayCluster path in RedisTrait::doCl...
  • 8602405 Merge branch '5.4' into 6.4
  • 4acd37c [Cache] Accept '_' and ':' in prefix passed to AbstractAdapter::clear()
  • 902d621 Merge branch '6.4' into 7.4
  • 8f9b022 Merge branch '5.4' into 6.4
  • Additional commits viewable in compare view

Updates symfony/dom-crawler from 7.4.8 to 7.4.12

Release notes

Sourced from symfony/dom-crawler's releases.

v7.4.12

Changelog (symfony/dom-crawler@v7.4.1...v7.4.12)

Commits
  • b59b591 Merge branch '6.4' into 7.4
  • 7e65f76 Merge branch '5.4' into 6.4
  • b18373e Merge branch '6.4' into 7.4
  • 505deba [DomCrawler] Fix ChoiceFormField::addChoice() clobbering values on multi-se...
  • f474100 Update XSD references in phpunit.xml.dist files
  • b4cf17f [DomCrawler] Fix XXE in addXmlContent() by not enabling validateOnParse
  • 6d86f97 [Tests] Fix "Incomplete version" PHPUnit warnings
  • 04ca269 Merge branch '6.4' into 7.4
  • eac26cf More CS fixes
  • ca5ad73 Merge branch '6.4' into 7.4
  • Additional commits viewable in compare view

Updates symfony/http-foundation from 6.4.35 to 6.4.41

Release notes

Sourced from symfony/http-foundation's releases.

v6.4.41

Changelog (symfony/http-foundation@v6.4.35...v6.4.41)

Commits
  • 48d76c2 security #cve-2026-48736 [HttpFoundation] Block IPv6 transition forms in IpUt...
  • 10d5daa [HttpFoundation] Fix tests for PHP 8.6: session.cookie_samesite=Lax
  • 3ebc78a [HttpFoundation] Block IPv6 transition forms in IpUtils::PRIVATE_SUBNETS
  • 5402ad1 Remove wrong documentation
  • 92eeee6 CS fixes - native_function_invocation & static_lambda
  • See full diff in compare view

Updates symfony/mailer from 6.4.34 to 6.4.40

Release notes

Sourced from symfony/mailer's releases.

v6.4.40

Changelog (symfony/mailer@v6.4.31...v6.4.40)

Commits
  • 94fd44f Merge branch '5.4' into 6.4
  • 5b5385b [Mailer] Add end-of-options separator before recipients in SendmailTransport;...
  • 602519c PHP CS Fixer: backports changes toward 6.4 branch
  • a2918c6 CS fixes - native_function_invocation & static_lambda
  • d56a83b [CS] Back config from 8.1 and apply heredoc_indentation rule
  • See full diff in compare view

Updates symfony/mime from 6.4.36 to 6.4.41

Release notes

Sourced from symfony/mime's releases.

v6.4.41

Changelog (symfony/mime@v6.4.40...v6.4.41)

v6.4.40

Changelog (symfony/mime@v6.4.37...v6.4.40)

v6.4.37

Changelog (symfony/mime@v6.4.36...v6.4.37)

Commits
  • 5575d37 [Routing][RateLimiter][Mime][Security] Harden __unserialize against __toStrin...
  • 7ccfb0c Merge branch '5.4' into 6.4
  • 8f89d3a [Mime] Reject email addresses containing line breaks in Address
  • f2f05cb [Mime] Fix transient test
  • 330077b bug #64047 [Mime] Preserve inline part filename instead of overwriting it wit...
  • 4c7099f [Mime] Preserve inline part filename instead of overwriting it with the Conte...
  • e2ae51d [FrameworkBundle] Apply tagged MIME type guessers in File::getMimeType()
  • 3d48678 More CS fixes
  • 05099f5 CS fixes - native_function_invocation & static_lambda
  • f56fd2b [CS] Back config from 8.1 and apply heredoc_indentation rule
  • See full diff in compare view

Updates symfony/polyfill-intl-idn from 1.33.0 to 1.38.1

Release notes

Sourced from symfony/polyfill-intl-idn's releases.

v1.38.1

Changelog (symfony/polyfill-intl-idn@v1.31.0...v1.38.1)

v1.37.0

Changelog (symfony/polyfill-intl-idn@v1.36.0...v1.37.0)

  • no significant changes

v1.36.0

Changelog (symfony/polyfill-intl-idn@v1.35.0...v1.36.0)

  • no significant changes

v1.35.0

Changelog (symfony/polyfill-intl-idn@v1.34.0...v1.35.0)

  • no significant changes

v1.34.0

Changelog (symfony/polyfill-intl-idn@v1.33.0...v1.34.0)

  • no significant changes
Commits
  • dc21118 [Intl][Idn] Reject xn-- labels whose Punycode payload decodes to ASCII-only
  • See full diff in compare view

Updates symfony/routing from 6.4.34 to 6.4.41

Release notes

Sourced from symfony/routing's releases.

v6.4.41

Changelog (symfony/routing@v6.4.40...v6.4.41)

v6.4.40

Changelog (symfony/routing@v6.4.37...v6.4.40)

v6.4.37

Changelog (symfony/routing@v6.4.34...v6.4.37)

Commits
  • af04c79 Merge branch '5.4' into 6.4
  • be4ce34 [Routing][RateLimiter][Mime][Security] Harden __unserialize against __toStrin...
  • f4ca0c5 [Routing] Fix dot-segment encoding for chained "../" and "./" in generated URLs
  • 0cd0d2f Merge branch '5.4' into 6.4
  • 48035d1 [Routing] Honor the Request's method in UrlMatcher::matchRequest()
  • 275b313 [Routing] Fix regex alternation anchoring in UrlGenerator requirement validation
  • 1425c2c More CS fixes
  • 883d140 CS fixes - native_function_invocation & static_lambda
  • 4bcf92a [CS] Back config from 8.1 and apply heredoc_indentation rule
  • See full diff in compare view

Updates symfony/yaml from 7.4.8 to 7.4.13

Release notes

Sourced from symfony/yaml's releases.

v7.4.13

Changelog (symfony/yaml@v7.4.12...v7.4.13)

v7.4.12

Changelog (symfony/yaml@v7.4.11...v7.4.12)

v7.4.11

Changelog (symfony/yaml@v7.4.10...v7.4.11)

v7.4.10

Changelog (symfony/yaml@v7.4.6...v7.4.10)

Commits
  • a7ec3b1 Merge branch '6.4' into 7.4
  • e8fdf34 CS fix
  • 4b5658c Merge branch '6.4' into 7.4
  • 69b7344 Merge branch '5.4' into 6.4
  • ae0bbb4 [Yaml] Allow trailing newlines after the end-of-document marker
  • 8b6952b Merge branch '6.4' into 7.4
  • 68dcd1f Merge branch '5.4' into 6.4
  • b0b2705 [Yaml] Harden the Parser::cleanup() regexes against catastrophic backtracking
  • 5a351ff [Yaml] Bound collection-alias resolution in the parser
  • e2eb64a Merge branch '6.4' into 7.4
  • Additional commits viewable in compare view

Updates guzzlehttp/guzzle from 7.10.0 to 7.12.1

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.12.1

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.12.1

Fixed

  • Reject proxy URLs with a malformed scheme in the cURL handlers instead of letting libcurl mishandle them

Securi...

Description has been truncated

@dependabot
build(deps): bump the composer group across 2 directories with 12 upd…
60c8362 
…ates

Bumps the composer group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [guzzlehttp/guzzle](https://github.com/guzzle/guzzle) | `7.10.0` | `7.12.1` |
| [phpoffice/phpspreadsheet](https://github.com/PHPOffice/PhpSpreadsheet) | `4.5.0` | `5.7.0` |
| [phpseclib/phpseclib](https://github.com/phpseclib/phpseclib) | `3.0.50` | `3.0.54` |
| [symfony/cache](https://github.com/symfony/cache) | `7.4.8` | `7.4.13` |
| [symfony/dom-crawler](https://github.com/symfony/dom-crawler) | `7.4.8` | `7.4.12` |
| [symfony/http-foundation](https://github.com/symfony/http-foundation) | `6.4.35` | `6.4.41` |
| [symfony/mailer](https://github.com/symfony/mailer) | `6.4.34` | `6.4.40` |
| [symfony/routing](https://github.com/symfony/routing) | `6.4.34` | `6.4.41` |
| [symfony/yaml](https://github.com/symfony/yaml) | `7.4.8` | `7.4.13` |

Bumps the composer group with 1 update in the /WordPress Extension/libs directory: [guzzlehttp/guzzle](https://github.com/guzzle/guzzle).


Updates `guzzlehttp/guzzle` from 7.10.0 to 7.12.1
- [Release notes](https://github.com/guzzle/guzzle/releases)
- [Changelog](https://github.com/guzzle/guzzle/blob/7.12/CHANGELOG.md)
- [Commits](guzzle/guzzle@7.10.0...7.12.1)

Updates `phpoffice/phpspreadsheet` from 4.5.0 to 5.7.0
- [Release notes](https://github.com/PHPOffice/PhpSpreadsheet/releases)
- [Changelog](https://github.com/PHPOffice/PhpSpreadsheet/blob/master/CHANGELOG.md)
- [Commits](PHPOffice/PhpSpreadsheet@4.5.0...5.7.0)

Updates `phpseclib/phpseclib` from 3.0.50 to 3.0.54
- [Release notes](https://github.com/phpseclib/phpseclib/releases)
- [Changelog](https://github.com/phpseclib/phpseclib/blob/master/CHANGELOG.md)
- [Commits](phpseclib/phpseclib@3.0.50...3.0.54)

Updates `guzzlehttp/psr7` from 2.9.0 to 2.12.1
- [Release notes](https://github.com/guzzle/psr7/releases)
- [Changelog](https://github.com/guzzle/psr7/blob/2.12/CHANGELOG.md)
- [Commits](guzzle/psr7@2.9.0...2.12.1)

Updates `symfony/cache` from 7.4.8 to 7.4.13
- [Release notes](https://github.com/symfony/cache/releases)
- [Changelog](https://github.com/symfony/cache/blob/8.2/CHANGELOG.md)
- [Commits](symfony/cache@v7.4.8...v7.4.13)

Updates `symfony/dom-crawler` from 7.4.8 to 7.4.12
- [Release notes](https://github.com/symfony/dom-crawler/releases)
- [Changelog](https://github.com/symfony/dom-crawler/blob/8.2/CHANGELOG.md)
- [Commits](symfony/dom-crawler@v7.4.8...v7.4.12)

Updates `symfony/http-foundation` from 6.4.35 to 6.4.41
- [Release notes](https://github.com/symfony/http-foundation/releases)
- [Changelog](https://github.com/symfony/http-foundation/blob/8.2/CHANGELOG.md)
- [Commits](symfony/http-foundation@v6.4.35...v6.4.41)

Updates `symfony/mailer` from 6.4.34 to 6.4.40
- [Release notes](https://github.com/symfony/mailer/releases)
- [Changelog](https://github.com/symfony/mailer/blob/8.2/CHANGELOG.md)
- [Commits](symfony/mailer@v6.4.34...v6.4.40)

Updates `symfony/mime` from 6.4.36 to 6.4.41
- [Release notes](https://github.com/symfony/mime/releases)
- [Changelog](https://github.com/symfony/mime/blob/8.2/CHANGELOG.md)
- [Commits](symfony/mime@v6.4.36...v6.4.41)

Updates `symfony/polyfill-intl-idn` from 1.33.0 to 1.38.1
- [Release notes](https://github.com/symfony/polyfill-intl-idn/releases)
- [Commits](symfony/polyfill-intl-idn@v1.33.0...v1.38.1)

Updates `symfony/routing` from 6.4.34 to 6.4.41
- [Release notes](https://github.com/symfony/routing/releases)
- [Changelog](https://github.com/symfony/routing/blob/8.2/CHANGELOG.md)
- [Commits](symfony/routing@v6.4.34...v6.4.41)

Updates `symfony/yaml` from 7.4.8 to 7.4.13
- [Release notes](https://github.com/symfony/yaml/releases)
- [Changelog](https://github.com/symfony/yaml/blob/8.2/CHANGELOG.md)
- [Commits](symfony/yaml@v7.4.8...v7.4.13)

Updates `guzzlehttp/guzzle` from 7.10.0 to 7.12.1
- [Release notes](https://github.com/guzzle/guzzle/releases)
- [Changelog](https://github.com/guzzle/guzzle/blob/7.12/CHANGELOG.md)
- [Commits](guzzle/guzzle@7.10.0...7.12.1)

Updates `guzzlehttp/psr7` from 2.9.0 to 2.12.1
- [Release notes](https://github.com/guzzle/psr7/releases)
- [Changelog](https://github.com/guzzle/psr7/blob/2.12/CHANGELOG.md)
- [Commits](guzzle/psr7@2.9.0...2.12.1)

---
updated-dependencies:
- dependency-name: guzzlehttp/guzzle
  dependency-version: 7.12.1
  dependency-type: direct:production
  dependency-group: composer
- dependency-name: phpoffice/phpspreadsheet
  dependency-version: 5.7.0
  dependency-type: direct:production
  dependency-group: composer
- dependency-name: phpseclib/phpseclib
  dependency-version: 3.0.54
  dependency-type: direct:production
  dependency-group: composer
- dependency-name: guzzlehttp/psr7
  dependency-version: 2.12.1
  dependency-type: indirect
  dependency-group: composer
- dependency-name: symfony/cache
  dependency-version: 7.4.13
  dependency-type: indirect
  dependency-group: composer
- dependency-name: symfony/dom-crawler
  dependency-version: 7.4.12
  dependency-type: indirect
  dependency-group: composer
- dependency-name: symfony/http-foundation
  dependency-version: 6.4.41
  dependency-type: indirect
  dependency-group: composer
- dependency-name: symfony/mailer
  dependency-version: 6.4.40
  dependency-type: indirect
  dependency-group: composer
- dependency-name: symfony/mime
  dependency-version: 6.4.41
  dependency-type: indirect
  dependency-group: composer
- dependency-name: symfony/polyfill-intl-idn
  dependency-version: 1.38.1
  dependency-type: indirect
  dependency-group: composer
- dependency-name: symfony/routing
  dependency-version: 6.4.41
  dependency-type: indirect
  dependency-group: composer
- dependency-name: symfony/yaml
  dependency-version: 7.4.13
  dependency-type: indirect
  dependency-group: composer
- dependency-name: guzzlehttp/guzzle
  dependency-version: 7.12.1
  dependency-type: indirect
  dependency-group: composer
- dependency-name: guzzlehttp/psr7
  dependency-version: 2.12.1
  dependency-type: indirect
  dependency-group: composer
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update php code labels Jun 22, 2026
@dependabot dependabot Bot mentioned this pull request Jun 22, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file php Pull requests that update php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants