Bump the php-dependencies group with 4 updates

[dependabot]

Bumps the php-dependencies group with 4 updates: filament/filament, guzzlehttp/guzzle, nunomaduro/collision and tightenco/duster.

Updates filament/filament from 5.6.8 to 5.7.1

Commits

• 71a5fae docs
• d40069b Merge branch '4.x' into 5.x
• a116605 Update notification.js
• 7c083b7 Merge branch '5.x' into 5.7-beta
• See full diff in compare view

Updates guzzlehttp/guzzle from 7.14.2 to 7.15.1

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.15.1

Security

• Preserve host-only cookie scope and require explicit persistence markers (GHSA-wm3w-8rrp-j577)
• Bound response cookie admission and generated Cookie headers (GHSA-f283-ghqc-fg79)
• Exclude URI fragments from Referer headers generated for redirects (GHSA-h95v-h523-3mw8)

7.15.0

Added

• Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.13
• Use locale-independent ASCII folding for all case normalization and comparison
• Bound cURL upload reads to the declared Content-Length
• Sanitize the cURL error text exposed through exception handler context
• Fail closed when a named cURL multi connection cap cannot be applied
• Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured
• Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles
• Isolate HTTP proxy tunnels from opaque shared connection caches
• Trigger runtime deprecations for previously deprecated functionality in 7.1.0

Deprecated

• Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
• Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array
• Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support

Fixed

• Defer cURL requests created from multi callbacks until native execution unwinds
• Fail synchronous waits from native cURL callbacks promptly instead of self-deadlocking
• Guard cURL multi handle removal against progress callbacks re-entering the handler
• Scope promise waits on the cURL multi handler to the awaited transfer
• Strip Content-Length and Transfer-Encoding when redirects discard the request body
• Stop re-applying the delay request option to followed redirects

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.15.1 - 2026-07-18

Security

• Preserve host-only cookie scope and require explicit persistence markers (GHSA-wm3w-8rrp-j577)
• Bound response cookie admission and generated Cookie headers (GHSA-f283-ghqc-fg79)
• Exclude URI fragments from Referer headers generated for redirects (GHSA-h95v-h523-3mw8)

7.15.0 - 2026-07-17

Added

• Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.13
• Use locale-independent ASCII folding for all case normalization and comparison
• Bound cURL upload reads to the declared Content-Length
• Sanitize the cURL error text exposed through exception handler context
• Fail closed when a named cURL multi connection cap cannot be applied
• Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured
• Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles
• Isolate HTTP proxy tunnels from opaque shared connection caches
• Trigger runtime deprecations for previously deprecated functionality in 7.1.0

Deprecated

• Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
• Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array
• Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support

Fixed

• Defer cURL requests created from multi callbacks until native execution unwinds
• Fail synchronous waits from native cURL callbacks promptly instead of self-deadlocking
• Guard cURL multi handle removal against progress callbacks re-entering the handler
• Scope promise waits on the cURL multi handler to the awaited transfer
• Strip Content-Length and Transfer-Encoding when redirects discard the request body
• Stop re-applying the delay request option to followed redirects

Commits

• 61443df Release 7.15.1
• 7b68220 Security fixes 7.15 (#3901)
• 90bd104 Release 7.15.0
• e8c879e Require guzzlehttp/psr7 ^2.13 (#3870)
• 0d578f5 Trigger runtime deprecations for legacy functions and methods (#3896)
• d5fcd1e Deprecate JSON utility methods (#3889)
• 3281fe2 Go with "guzzlehttp/test-server": "^0.7" (#3890)
• ba662c9 Remove stale framing from redirected requests (#3881)
• dd32f84 Bound cURL uploads to declared lengths (#3882)
• a29e961 Merge branch '7.14' into 7.15
• Additional commits viewable in compare view

Updates nunomaduro/collision from 8.9.4 to 8.9.5

Commits

• fb53eac chore: paratest dep
• 046ef18 chore: bumps deps
• 930ac94 chore: style changes
• 05d18b2 chore(deps): bump shivammathur/setup-php from 2.37.0 to 2.37.1 (#352)
• 1593eb6 chore: style
• f990d01 chore: security actions
• 62db0fc Revert "wip"
• 825f7fa wip
• d90252f Merge pull request #350 from nunomaduro/fix/test-case-boundary-on-pre-prep-ev...
• b279c0a bump dependencies
• Additional commits viewable in compare view

Updates tightenco/duster from 3.4.5 to 3.4.6

Release notes

Sourced from tightenco/duster's releases.

v3.4.6

What's Changed

• Exclude the tests directory from env() ban by @​mattstauffer in tighten/duster#202
• Fix TLint reporter imports by @​gcavanunez in tighten/duster#212
• Escape . in regex by @​mattstauffer in tighten/duster#205

New Contributors

• @​gcavanunez made their first contribution in tighten/duster#212

Full Changelog: tighten/duster@v3.4.5...v3.4.6

Commits

• 28c5a95 Merge pull request #213 from tighten/gc/version-bump
• 5137bbe Build v3.4.6
• 4a72f76 Merge pull request #205 from tighten/mes/fix-ruleset-regex
• 472fdff Escape public index exclusion pattern
• ad70018 Merge pull request #212 from tighten/gc/fix-ci-tlint
• 4971a8e Fix TLint reporter imports
• e97f2a2 Merge pull request #202 from tighten/mes/exclude-tests-env-check
• c777408 Add tests to cover new ruleset changes
• 2228e79 Escape . in regex
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions