Bump the dependencies group with 2 updates

[dependabot]

Bumps the dependencies group with 2 updates: guzzlehttp/guzzle and phpro/grumphp.

Updates guzzlehttp/guzzle from 7.12.1 to 7.13.0

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.13.0

Added

• Added the crypto_method_max request option to cap the maximum TLS protocol version
• Added HTTP QUERY redirect support, preserving method and body on 301 and 302

Changed

• Section proxy tunnel connection reuse by credential so distinct credentials never share a tunnel
• Isolate concurrent foreign cURL proxy tunnels added while another owner's tunnel is active
• Route credentialed HTTP(S) proxy Proxy-Authorization headers through cURL proxy header handling
• Reject request-level CURLOPT_SHARE when combined with authenticated HTTP/HTTPS proxy tunnel configuration
• Remove deprecation for raw cURL CURLOPT_PREREQFUNCTION callbacks when defined by PHP cURL
• Route TLS 1.2 crypto_method requests to the stream handler when cURL cannot select TLS 1.2
• Reject final request URIs missing a scheme or host before transfer

Deprecated

• Deprecate invalid protocols, force_ip_resolve, delay, cookies, and allow_redirects values

7.12.3

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.12.3

Security

• Treat IP and numeric cookie domains as exact-match-only (GHSA-g446-98w2-8p5w)

7.12.2

Fixed

• Clamp out-of-range Max-Age so a very large value no longer overflows to an already-expired timestamp
• Use strict comparison in CookieJar conflict resolution so distinct numeric-string names don't overwrite
• Store a cookie whose Domain has a trailing dot on the origin host instead of silently discarding it
• Fix StreamHandler hard-failing on bracketed IPv6 literal hosts when force_ip_resolve is set
• Use strict cookie Path comparison so CookieJar::clear() with a numeric path keeps a distinct-path cookie
• Fixed cookie handling for falsey Domain, Max-Age, path, and name values
• Fixed decode_content handling for falsey string values
• Fixed deprecated request option values reaching built-in handlers before normalization

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.13.0 - 2026-06-29

Added

• Added the crypto_method_max request option to cap the maximum TLS protocol version
• Added HTTP QUERY redirect support, preserving method and body on 301 and 302

Changed

• Section proxy tunnel connection reuse by credential so distinct credentials never share a tunnel
• Isolate concurrent foreign cURL proxy tunnels added while another owner's tunnel is active
• Route credentialed HTTP(S) proxy Proxy-Authorization headers through cURL proxy header handling
• Reject request-level CURLOPT_SHARE when combined with authenticated HTTP/HTTPS proxy tunnel configuration
• Remove deprecation for raw cURL CURLOPT_PREREQFUNCTION callbacks when defined by PHP cURL
• Route TLS 1.2 crypto_method requests to the stream handler when cURL cannot select TLS 1.2
• Reject final request URIs missing a scheme or host before transfer

Deprecated

• Deprecate invalid protocols, force_ip_resolve, delay, cookies, and allow_redirects values

7.12.3 - 2026-06-23

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.12.3

Security

• Treat IP and numeric cookie domains as exact-match-only (GHSA-g446-98w2-8p5w)

7.12.2 - 2026-06-23

Fixed

• Clamp out-of-range Max-Age so a very large value no longer overflows to an already-expired timestamp
• Use strict comparison in CookieJar conflict resolution so distinct numeric-string names don't overwrite
• Store a cookie whose Domain has a trailing dot on the origin host instead of silently discarding it
• Fix StreamHandler hard-failing on bracketed IPv6 literal hosts when force_ip_resolve is set
• Use strict cookie Path comparison so CookieJar::clear() with a numeric path keeps a distinct-path cookie
• Fixed cookie handling for falsey Domain, Max-Age, path, and name values
• Fixed decode_content handling for falsey string values
• Fixed deprecated request option values reaching built-in handlers before normalization

Commits

• a4decaa Release 7.13.0
• a5e7069 Stop deprecating CURLOPT_PREREQFUNCTION (#3718)
• bc34e93 Reject CURLOPT_SHARE with authenticated proxy tunnel (#3711)
• f748c62 Route Proxy-Authorization through cURL proxy headers (#3710)
• 69fc262 Harden cURL header list options (#3716)
• cef051a Reject final URIs missing scheme or host (#3715)
• 586ddfb Harden CurlMultiHandler proxy tunnel isolation (#3708)
• e064f4e Deprecate invalid numeric-string delay values (#3707)
• 6fde276 Fix crypto_method_max deprecation version and document PHP requirements (#3706)
• 6e4dc82 Support QUERY redirects (#3702)
• Additional commits viewable in compare view

Updates phpro/grumphp from 2.21.0 to 2.22.0

Release notes

Sourced from phpro/grumphp's releases.

Version 2.22.0

Say hi to Mago 🦊

GrumPHP just made a new friend. Starting this release, you can run Mago straight from your hooks.

Mago is a PHP toolchain written in Rust. The name means "wizard," which fits: it does the work of four tools at once. A formatter, a linter, a static analyzer, and an architectural guard, all in a single fast binary. It's already showing up in places like Drupal.

We didn't bolt it on as one big task. Each part gets its own, so you turn on only what you want and configure them separately:

• mago_format keeps your code style consistent
• mago_lint catches style slips, smells, and likely bugs
• mago_analyze does the deeper work: types, control flow, logic errors
• mago_guard enforces your architecture and layer rules

Format, lint, and analyze run read-only by default. When one fails, GrumPHP offers to re-run it with fixes applied, so you stay in control. Guard only reports, because you can't auto-fix an architecture problem (Mago won't pretend otherwise).

Add it to your project like any other tool:

composer require --dev carthage-software/mago
vendor/bin/mago init

Then point your grumphp.yml at whichever tasks you want. Full setup and options live in the Mago task docs.

The grump approves. Welcome to the family, Mago. 🧙‍🦊

What's Changed

• Add cache CLI options for eslint by @​rodrigoaguilera in phpro/grumphp#1223
• Support git autosquash amend! prefix in commit message task by @​reynkonig in phpro/grumphp#1224
• Add Mago as task by @​johnatas-x in phpro/grumphp#1216

New Contributors

• @​rodrigoaguilera made their first contribution in phpro/grumphp#1223
• @​reynkonig made their first contribution in phpro/grumphp#1224
• @​johnatas-x made their first contribution in phpro/grumphp#1216

Full Changelog: phpro/grumphp@v2.21.0...v2.22.0

Commits

• 738616a 2.22.0 release
• c364ee4 Merge pull request #1216 from johnatas-x/mago-task
• ccf187b Merge pull request #1224 from reynkonig/feature/commit-message-amend-prefix
• ea60826 Support git autosquash amend! prefix in commit message task
• 7c9292f Merge pull request #1223 from rodrigoaguilera/eslint-cache
• ed5cac9 Fix ESLint cache test expected binary name
• 75b50c8 Refactor Mago into standalone per-command tasks
• 815490c Refactor Mago tasks based on threads
• a75b3f8 Add tests for new eslint cache config
• c5a134f Add docs
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.45%. Comparing base (a3ad8e5) to head (d4ec252).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##               main    #2014   +/-   ##
=========================================
  Coverage     92.45%   92.45%           
  Complexity     1960     1960           
=========================================
  Files           123      123           
  Lines          7114     7114           
=========================================
  Hits           6577     6577           
  Misses          537      537           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

Try the dev build for this PR: https://acquia-cli.s3.amazonaws.com/build/pr/2014/acli.phar

curl -OL https://acquia-cli.s3.amazonaws.com/build/pr/2014/acli.phar
chmod +x acli.phar