chore(deps): bump guzzlehttp/guzzle from 7.13.2 to 7.14.0 in the minor-and-patch group

[dependabot]

Bumps the minor-and-patch group with 1 update: guzzlehttp/guzzle.

Updates guzzlehttp/guzzle from 7.13.2 to 7.14.0

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.14.0

Added

• Added the on_trailers request option to expose parsed HTTP response trailers
• Added the multiplex request option with Multiplexing::* modes to control or require HTTP/2 multiplexing
• Added rejection of explicit multiplex requests when CURLMOPT_PIPELINING disables multiplexing
• Added the max_host_connections and max_total_connections client and cURL multi handler options

Changed

• Redirects that discard the request body no longer require it to be rewindable
• Synchronous cURL multi handler requests no longer wait for other queued transfers
• Section SOCKS proxy connections by credentials on libcurl before 7.69.0
• Reject request-level CURLOPT_SHARE when combined with authenticated SOCKS proxy configuration
• Redact proxy userinfo containing raw control bytes in cURL errors
• Check linked curl/libcurl NTLM support before applying NTLM auth
• Clarify that NTLM is deprecated by both Guzzle and curl/libcurl
• Remove deprecation for the raw cURL CURLOPT_CERTINFO option
• Warn when a cURL multi option cannot be applied

Deprecated

• Deprecate the raw CURLOPT_PIPEWAIT cURL option in favour of the multiplex request option
• Deprecate unknown handler constructor options
• Deprecate invalid select_timeout cURL multi handler option values
• Deprecate raw cURL multi connection cap options in favour of the named options

7.13.3

Changed

• Adjusted guzzlehttp/promises version constraint to ^2.5.1
• Adjusted guzzlehttp/psr7 version constraint to ^2.12.4
• Pass explicit trim characters ahead of the PHP 8.6 trim default change

Fixed

• Stop matching cookie domains against hosts with a trailing newline
• Reject HTTP status codes and certificate type extensions with a trailing newline
• Treat PCRE engine failures as invalid cookie names during cookie validation
• Report PCRE engine failures when formatting log messages
• Report PCRE engine failures when splitting no_proxy values

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.14.0 - 2026-07-08

Added

• Added the on_trailers request option to expose parsed HTTP response trailers
• Added the multiplex request option with Multiplexing::* modes to control or require HTTP/2 multiplexing
• Added rejection of explicit multiplex requests when CURLMOPT_PIPELINING disables multiplexing
• Added the max_host_connections and max_total_connections client and cURL multi handler options

Changed

• Redirects that discard the request body no longer require it to be rewindable
• Synchronous cURL multi handler requests no longer wait for other queued transfers
• Section SOCKS proxy connections by credentials on libcurl before 7.69.0
• Reject request-level CURLOPT_SHARE when combined with authenticated SOCKS proxy configuration
• Redact proxy userinfo containing raw control bytes in cURL errors
• Check linked curl/libcurl NTLM support before applying NTLM auth
• Clarify that NTLM is deprecated by both Guzzle and curl/libcurl
• Remove deprecation for the raw cURL CURLOPT_CERTINFO option
• Warn when a cURL multi option cannot be applied

Deprecated

• Deprecate the raw CURLOPT_PIPEWAIT cURL option in favour of the multiplex request option
• Deprecate unknown handler constructor options
• Deprecate invalid select_timeout cURL multi handler option values
• Deprecate raw cURL multi connection cap options in favour of the named options

7.13.3 - 2026-07-08

Changed

• Adjusted guzzlehttp/promises version constraint to ^2.5.1
• Adjusted guzzlehttp/psr7 version constraint to ^2.12.4
• Pass explicit trim characters ahead of the PHP 8.6 trim default change

Fixed

• Stop matching cookie domains against hosts with a trailing newline
• Reject HTTP status codes and certificate type extensions with a trailing newline
• Treat PCRE engine failures as invalid cookie names during cookie validation
• Report PCRE engine failures when formatting log messages
• Report PCRE engine failures when splitting no_proxy values

Commits

• aef2424 Release 7.14.0
• 6500b0a Document the synchronous cURL multi handler change (#3808)
• 9cecd3b Redact proxy credentials containing raw separators (#3806)
• 62fce70 Merge branch '7.13' into 7.14
• caa5491 Release 7.13.3
• 307cfe2 Adjust the minimum promises and psr7 versions (#3801) (#3802)
• 1a337c6 Adjust the minimum promises and psr7 versions (#3801)
• 897fb51 Redact proxy credentials containing raw control bytes (#3798)
• 5b1f9c6 Drop package-lock.json as its unused (#3789)
• ef4174e Merge branch '7.13' into 7.14
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[update-docs]

Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes.