Bump guzzlehttp/psr7 from 1.9.1 to 2.10.2

[dependabot]

Bumps guzzlehttp/psr7 from 1.9.1 to 2.10.2.

Release notes

Sourced from guzzlehttp/psr7's releases.

2.10.2

Security

• Reject control and whitespace characters in URI host components (GHSA-hq7v-mx3g-29hw)
• Reject malformed Host values when constructing request URIs (GHSA-34xg-wgjx-8xph)

Fixed

• Make ServerRequest::fromGlobals() robust against unexpected HTTP header value types in $_SERVER

2.10.1

Fixed

• Fix Utils::modifyRequest() with numeric header names

2.10.0

• Harden ServerRequest::fromGlobals() against malformed $_SERVER values
• Prevent custom stream metadata from affecting internal size handling
• Throw when StreamWrapper::getResource() cannot create a resource
• Preserve custom request implementations in Utils::modifyRequest()
• Preserve custom URI implementations in UriResolver::resolve()
• Make Uri::__toString() side-effect-free

2.9.1

• Fix parsing of relative path references containing a colon in a non-initial path segment
• Fix CachingStream::detach() returning an incomplete resource before the decorated stream has been fully read
• Fix Message::bodySummary() returning null when truncating printable UTF-8 bodies inside a multibyte character

2.9.0

Added

• Added nested array expansion support to MultipartStream
• Added @return static to MessageTrait methods

Changed

• Updated MIME type mappings

---

See also the change log for changes.

2.8.1

Fixed

• Encode + signs in Uri::withQueryValue() and Uri::withQueryValues() to prevent them being interpreted as spaces

---

See also the change log for changes.

... (truncated)

Changelog

Sourced from guzzlehttp/psr7's changelog.

2.10.2 - 2026-05-25

Security

• Reject control and whitespace characters in URI host components (GHSA-hq7v-mx3g-29hw)
• Reject malformed Host values when constructing request URIs (GHSA-34xg-wgjx-8xph)

Fixed

• Make ServerRequest::fromGlobals() robust against unexpected HTTP header value types in $_SERVER

2.10.1 - 2026-05-20

Fixed

• Fix Utils::modifyRequest() with numeric header names

2.10.0 - 2026-05-19

Changed

• Harden ServerRequest::fromGlobals() against malformed $_SERVER values
• Prevent custom stream metadata from affecting internal size handling
• Throw when StreamWrapper::getResource() cannot create a resource
• Preserve custom request implementations in Utils::modifyRequest()
• Preserve custom URI implementations in UriResolver::resolve()
• Make Uri::__toString() side-effect-free

2.9.1 - 2026-05-19

Fixed

• Fix parsing of relative path references containing a colon in a non-initial path segment
• Fix CachingStream::detach() returning an incomplete resource before the decorated stream has been fully read
• Fix Message::bodySummary() returning null when truncating printable UTF-8 bodies inside a multibyte character

2.9.0 - 2026-03-10

Added

• Added nested array expansion support to MultipartStream
• Added @return static to MessageTrait methods

Changed

• Updated MIME type mappings

2.8.1 - 2026-03-10

Fixed

... (truncated)

Commits

• a1bbdc1 Release 2.10.2
• c68fe44 Reject malformed Host authorities (#717)
• a0fda81 Normalize global header values (#718)
• 12caca7 Reject control characters in URI hosts (#715)
• 73ab136 Release 2.10.1
• 52ce6eb Fix modifyRequest with numeric header names (#667)
• d5ddaf5 Release 2.10.0
• de80dd8 Throw when StreamWrapper resource creation fails (#662)
• 913f97f Use native stream URI for size cache (#661)
• ed659d5 Harden ServerRequest globals handling (#660)
• Additional commits viewable in compare view