Bump the php-prod group across 1 directory with 2 updates

[dependabot]

Bumps the php-prod group with 2 updates in the / directory: guzzlehttp/guzzle and twig/twig.

Updates guzzlehttp/guzzle from 7.12.3 to 7.15.5

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.15.5

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.13.1
• Adjusted guzzlehttp/promises version constraint to ^2.5.3

7.15.4

Added

• Added support for PHP 8.6

Changed

• Replace the deprecated spl_object_hash() in handler stack debug output for PHP 8.6

7.15.3

Changed

• Adjusted guzzlehttp/promises version constraint to ^2.5.2

Fixed

• Fail a cURL multi handler wait with an attributable error when the transfer is no longer tracked
• Fix StreamHandler resolving numeric IPv4 hosts differently from cURL handlers on macOS and Windows
• Fix StreamHandler TLS peer names and proxy authorities for numeric IPv4 hosts on all platforms
• Settle a cURL multi handler transfer displaced by a request reusing its native handle ID

7.15.2

Security

• Reject non-printable-ASCII and percent-escaped URI hosts and Host headers (GHSA-v5mv-p594-2x33)
• Reject request URI hosts that contain a URI authority delimiter (GHSA-v5mv-p594-2x33)
• Reject numeric-looking URI hosts with trailing dots, read as IPv4 addresses (GHSA-v5mv-p594-2x33)
• Treat numeric-in-any-base and percent-escaped cookie domains as exact-match-only (GHSA-f7vp-7xgx-4w4r)
• Regenerate a derived Host header after client URI rewrites (GHSA-v5mv-p594-2x33)

Fixed

• Preserve RequestException when the stream handler rejects a request before opening a stream

7.15.1

Security

• Preserve host-only cookie scope and require explicit persistence markers (GHSA-wm3w-8rrp-j577)
• Bound response cookie admission and generated Cookie headers (GHSA-f283-ghqc-fg79)
• Exclude URI fragments from Referer headers generated for redirects (GHSA-h95v-h523-3mw8)

7.15.0

Added

... (truncated)

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.15.5 - 2026-08-24

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.13.1
• Adjusted guzzlehttp/promises version constraint to ^2.5.3

7.15.4 - 2026-08-24

Added

• Added support for PHP 8.6

Changed

• Replace the deprecated spl_object_hash() in handler stack debug output for PHP 8.6

7.15.3 - 2026-08-05

Changed

• Adjusted guzzlehttp/promises version constraint to ^2.5.2

Fixed

• Fail a cURL multi handler wait with an attributable error when the transfer is no longer tracked
• Fix StreamHandler resolving numeric IPv4 hosts differently from cURL handlers on macOS and Windows
• Fix StreamHandler TLS peer names and proxy authorities for numeric IPv4 hosts on all platforms
• Settle a cURL multi handler transfer displaced by a request reusing its native handle ID

7.15.2 - 2026-07-26

Security

• Reject non-printable-ASCII and percent-escaped URI hosts and Host headers (GHSA-v5mv-p594-2x33)
• Reject request URI hosts that contain a URI authority delimiter (GHSA-v5mv-p594-2x33)
• Reject numeric-looking URI hosts with trailing dots, read as IPv4 addresses (GHSA-v5mv-p594-2x33)
• Treat numeric-in-any-base and percent-escaped cookie domains as exact-match-only (GHSA-f7vp-7xgx-4w4r)
• Regenerate a derived Host header after client URI rewrites (GHSA-v5mv-p594-2x33)

Fixed

• Preserve RequestException when the stream handler rejects a request before opening a stream

7.15.1 - 2026-07-18

Security

... (truncated)

Commits

• ee80339 Release 7.15.5
• fb464ad Bump minimum promises and psr7
• 994a8a0 Release 7.15.4
• 6e73b57 Support PHP 8.6 (#3928)
• ae311b8 Release 7.15.3
• e3d8b4b Adjust the guzzlehttp/promises version constraint to ^2.5.2 (#3920)
• c55971f Settle cURL multi transfers displaced by native handle ID reuse (#3917)
• 04a8319 Fold numeric IPv4 hosts in the stream handler (#3909)
• ae0facb Reject untracked cURL multi handler waits with an attributable error (#3911)
• 7441019 Security fixes 7.15 (#3907)
• Additional commits viewable in compare view

Updates twig/twig from 3.27.1 to 3.28.0

Release notes

Sourced from twig/twig's releases.

v3.28.0

Changelog (twigphp/Twig@v3.27.1...v3.28.0)

• bug #4850 Render backed enums using their backing value in the html_attr function (@​fabpot)
• minor #4845 Add documention note about variable scope of override blocks in { embed ... only } (@​andy-blum)
• minor #4843 Define macros at the template root in the cache macro fixture (@​fabpot)
• bug #4841 Fix Markup truthiness in boolean expressions (@​xtrime-ru)
• bug #4842 Fix a PHP 8.5 chr() deprecation when decoding octal string escapes (@​austinderrick)
• feature #4292 Introduce a CorrectnessNodeVisitor to validate that templates are semantically correct (@​fabpot)
• feature #4840 Mark Markup as final (@​fabpot)
• feature #4838 Allow calling a macro with a dynamic name via the dot operator (@​fabpot)
• bug #4835 Fix markdown_to_html mangling content that starts with a blank line (@​fabpot)
• feature #4819 Add an allow-list for tests to the sandbox security policy (@​fabpot)
• minor #4837 Reduce memory usage of the context restoration compiled at the end of for loops (@​fabpot)
• feature #4816 Add an always_allowed_in_sandbox flag for filters, functions, and tags (@​fabpot)
• feature #4834 Track the source offset of each token and expose it in syntax errors (@​fabpot)
• minor #4836 Document how to customize the markdown_to_html converter (@​fabpot)
• minor #4662 CoreExtension::getAttribute: small improvement regarding getter/isser/hasser (@​gharlan)
• bug #4825 Make the include() function return a Markup object (@​fabpot)
• bug #4830 Fix nested block() resolution when a directly rendered block calls parent() (@​fabpot)
• minor #4827 Document {#--#} as the replacement for the deprecated spaceless filter (@​fabpot)
• bug #4828 Stop reporting a skipped test in IntegrationTestCase when there is no legacy test to run (@​fabpot)
• minor #4829 Document storing an enum in a variable to avoid repeating its FQCN (@​fabpot)
• bug #4824 Cast printed expressions to string so values that cannot be converted to a string (arrays, non-Stringable objects, ...) report a usable stack trace at the print location (@​stof, @​fabpot)
• feature #4826 Make IntegrationTestCase and NodeTestCase compatible with PHPUnit 11 (@​fabpot)
• feature #4823 Skip the sandbox __toString check on arguments whose PHP parameter type cannot implicitly coerce to string (@​fabpot)

Changelog

Sourced from twig/twig's changelog.

3.28.0 (2026-07-03)

• Render backed enums using their backing value in the html_attr function
• Fix empty Markup values being treated as truthy in and, or, xor, not, ternary, and elvis expressions
• Fix a PHP 8.5 chr() deprecation when decoding an octal string escape sequence larger than \377 (such as "\777")
• Mark Twig\Markup as @final; it will be final in Twig 4.0
• Reduce memory usage and speed up the context restoration compiled at the end of for loops
• Allow calling a macro with a dynamic name via the dot operator (macros.(name)(args))
• Report the column number in syntax errors and expose it via Error::getTemplateColumn()
• Track the source offset of each token and expose it via Token::getOffset()
• Fix nested block() calls to resolve against the overriding template when a block rendered through block(name, template) calls parent()
• Deprecate the possibility to use a block tag within a capture node (like set)
• Deprecate the possibility to use a block tag within a capture node (like set) in child templates
• Deprecate using a macro, extends, or use tag outside the root of a template
• Stop reporting a skipped test in IntegrationTestCase when there is no legacy test to run
• Fix markdown_to_html to strip the indentation shared by all lines instead of mangling content that starts with a blank line
• Make the IntegrationTestCase and NodeTestCase test helpers compatible with PHPUnit 11
• Cast printed expressions to string so values that cannot be converted to a string (arrays, non-Stringable objects, ...) report a usable stack trace at the print location
• Make the include() function return a Markup object so an assigned result is not re-escaped when printed
• Skip the sandbox __toString check on arguments whose PHP parameter type cannot implicitly coerce to string
• Document the criteria for marking a callable or tag as always allowed in a sandbox, and the list of built-in tags, filters, and functions that will be always allowed in Twig 4.0
• Add an always_allowed_in_sandbox option for filters, functions, and tests, and an isAlwaysAllowedInSandbox() method for token parsers, to let authors mark callables and tags that are always allowed in sandbox mode without explicit allow-listing
• Add an allow-list for tests to Twig\Sandbox\SecurityPolicy, with the safe built-in tests flagged as always allowed so they keep working without allow-listing

Commits

• 597c12e Prepare the 3.28.0 release
• 6a175a5 bug #4850 Render backed enums using their backing value in the html_attr func...
• 9323a82 Render backed enums using their backing value in the html_attr function
• ec0f5d5 Tweak previous merge
• 4007231 minor #4845 Add documention note about variable scope of override blocks in {...
• 068a2e6 Add documention note about variable scope of override blocks in {% embed ... ...
• f6152fe minor #4843 Define macros at the template root in the cache macro fixture (fa...
• 424d2f1 Define the macro at the template root in the cache macro fixture
• e3b8e15 Update CHANGELOG
• 2f202b0 bug #4841 Fix Markup truthiness in boolean expressions (xtrime-ru)
• Additional commits viewable in compare view

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.