[dependabot]

Bumps the php-deps group in /legacy with 3 updates: guzzlehttp/guzzle, composer/ca-bundle and phpstan/phpstan.

Updates guzzlehttp/guzzle from 7.15.5 to 7.16.0

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.16.0

Changed

• Adjusted guzzlehttp/promises version constraint to ^2.6
• Replace the deprecated Promise\Is with Promise\State for PHP 8.6

7.15.6

Fixed

• Fix PHP 8.6 notices for oversized numeric hosts
• Fix MockHandler truncating fractional delays
• Fix stream handler responses in Swoole coroutines on PHP 8.4+

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.13.2

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.16.0 - 2026-10-18

Changed

• Adjusted guzzlehttp/promises version constraint to ^2.6
• Replace the deprecated Promise\Is with Promise\State for PHP 8.6

7.15.6 - 2026-10-18

Fixed

• Fix PHP 8.6 notices for oversized numeric hosts
• Fix MockHandler truncating fractional delays
• Fix stream handler responses in Swoole coroutines on PHP 8.4+

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.13.2

Commits

• ffb62ec Release 7.16.0
• 9da3cad Replace the deprecated promises Is with State (#3981)
• fd44e32 Setup the 7.16 branch (#3978)
• 786c876 Release 7.15.6
• 4c98cc8 Raise minimum psr7 version (#3976)
• e65b31a Bump psr7 references in the docs (#3974)
• 03ba19d Read stream handler response headers from the opened stream (#3946)
• a8ae648 Fix MockHandler truncating fractional delays (#3940)
• cce576b Avoid PHP 8.6 notices for oversized numeric host parts (#3942)
• See full diff in compare view

Updates composer/ca-bundle from 1.5.14 to 1.6.0

Release notes

Sourced from composer/ca-bundle's releases.

1.6.0

What's Changed

• Distrust compromised eMudhra intermediates by @​Seldaek in composer/ca-bundle#153
• Added CaBundle::findDistrustedCertificate to detect known-bad certificates in a chain of PEM strings in #153
• Update cacert.pem to 2026-10-20 by @​github-actions[bot] in composer/ca-bundle#156

Full Changelog: composer/ca-bundle@1.5.14...1.6.0

Commits

• 2c99cf2 Update cacert.pem (#156)
• a3dc8c7 Distrust compromised eMudhra intermediates (#153)
• d26864b Bump zizmorcore/zizmor-action from 0.6.2 to 0.6.4 (#151)
• 28c0d72 Update cacert.pem (#149)
• 8876b74 Bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 (#147)
• See full diff in compare view

Updates phpstan/phpstan from 2.3.1 to 2.3.2

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions