Update all non-major dependencies (patch)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
friendsofphp/php-cs-fixer	3.95.17 → 3.95.18
guzzlehttp/guzzle (source)	7.15.1 → 7.15.2
phpstan/phpstan	2.2.5 → 2.2.7

---

Release Notes

PHP-CS-Fixer/PHP-CS-Fixer (friendsofphp/php-cs-fixer)

v3.95.18

Compare Source

• CI: attach provenance and SBOM attestations to the released image (#​9751)
• deps: bump the phpstan group in /dev-tools with 2 updates (#​9748)
• deps: update dev-tools (#​9754)
• perf: Limit token search in simplified_if_return (#​9747)

guzzle/guzzle (guzzlehttp/guzzle)

v7.15.2

Compare Source

Security

• Reject non-printable-ASCII and percent-escaped URI hosts and Host headers (GHSA-v5mv-p594-2x33)
• Reject request URI hosts that contain a URI authority delimiter (GHSA-v5mv-p594-2x33)
• Reject numeric-looking URI hosts with trailing dots, read as IPv4 addresses (GHSA-v5mv-p594-2x33)
• Treat numeric-in-any-base and percent-escaped cookie domains as exact-match-only (GHSA-f7vp-7xgx-4w4r)
• Regenerate a derived Host header after client URI rewrites (GHSA-v5mv-p594-2x33)

Fixed

• Preserve RequestException when the stream handler rejects a request before opening a stream

phpstan/phpstan-phar-composer-source (phpstan/phpstan)

v2.2.7

Compare Source

v2.2.6

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.