chore(deps-dev): bump the baggage-php group across 1 directory with 2 updates

[dependabot]

Bumps the baggage-php group with 2 updates in the /libs/baggage-php directory: phpunit/phpunit and guzzlehttp/guzzle.

Updates phpunit/phpunit from 11.5.55 to 11.5.56

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 11.5.56

Changed

• #6797: Adapt code generated for test double of interface with constructor for PHP 8.6

---

Learn how to install or update PHPUnit 11.5 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​[email protected] to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

Changelog

Sourced from phpunit/phpunit's changelog.

[11.5.56] - 2026-07-06

Changed

• #6797: Adapt code generated for test double of interface with constructor for PHP 8.6

Commits

• 5f83edf Prepare release
• 2f3b5e4 Merge branch '10.5' into 11.5
• 0e8c1d1 Prepare release
• 6724240 Merge branch '9.6' into 10.5
• 0edba2f Prepare release
• c3984ec Merge branch '8.5' into 9.6
• 17cd429 Prepare release
• c9acef1 Merge branch '10.5' into 11.5
• ffa9aba Merge branch '9.6' into 10.5
• 4b8adcd Merge branch '8.5' into 9.6
• Additional commits viewable in compare view

Updates guzzlehttp/guzzle from 7.10.0 to 7.15.5

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.15.5

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.13.1
• Adjusted guzzlehttp/promises version constraint to ^2.5.3

7.15.4

Added

• Added support for PHP 8.6

Changed

• Replace the deprecated spl_object_hash() in handler stack debug output for PHP 8.6

7.15.3

Changed

• Adjusted guzzlehttp/promises version constraint to ^2.5.2

Fixed

• Fail a cURL multi handler wait with an attributable error when the transfer is no longer tracked
• Fix StreamHandler resolving numeric IPv4 hosts differently from cURL handlers on macOS and Windows
• Fix StreamHandler TLS peer names and proxy authorities for numeric IPv4 hosts on all platforms
• Settle a cURL multi handler transfer displaced by a request reusing its native handle ID

7.15.2

Security

• Reject non-printable-ASCII and percent-escaped URI hosts and Host headers (GHSA-v5mv-p594-2x33)
• Reject request URI hosts that contain a URI authority delimiter (GHSA-v5mv-p594-2x33)
• Reject numeric-looking URI hosts with trailing dots, read as IPv4 addresses (GHSA-v5mv-p594-2x33)
• Treat numeric-in-any-base and percent-escaped cookie domains as exact-match-only (GHSA-f7vp-7xgx-4w4r)
• Regenerate a derived Host header after client URI rewrites (GHSA-v5mv-p594-2x33)

Fixed

• Preserve RequestException when the stream handler rejects a request before opening a stream

7.15.1

Security

• Preserve host-only cookie scope and require explicit persistence markers (GHSA-wm3w-8rrp-j577)
• Bound response cookie admission and generated Cookie headers (GHSA-f283-ghqc-fg79)
• Exclude URI fragments from Referer headers generated for redirects (GHSA-h95v-h523-3mw8)

7.15.0

Added

... (truncated)

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.15.5 - 2026-08-24

Changed

• Adjusted guzzlehttp/psr7 version constraint to ^2.13.1
• Adjusted guzzlehttp/promises version constraint to ^2.5.3

7.15.4 - 2026-08-24

Added

• Added support for PHP 8.6

Changed

• Replace the deprecated spl_object_hash() in handler stack debug output for PHP 8.6

7.15.3 - 2026-08-05

Changed

• Adjusted guzzlehttp/promises version constraint to ^2.5.2

Fixed

• Fail a cURL multi handler wait with an attributable error when the transfer is no longer tracked
• Fix StreamHandler resolving numeric IPv4 hosts differently from cURL handlers on macOS and Windows
• Fix StreamHandler TLS peer names and proxy authorities for numeric IPv4 hosts on all platforms
• Settle a cURL multi handler transfer displaced by a request reusing its native handle ID

7.15.2 - 2026-07-26

Security

• Reject non-printable-ASCII and percent-escaped URI hosts and Host headers (GHSA-v5mv-p594-2x33)
• Reject request URI hosts that contain a URI authority delimiter (GHSA-v5mv-p594-2x33)
• Reject numeric-looking URI hosts with trailing dots, read as IPv4 addresses (GHSA-v5mv-p594-2x33)
• Treat numeric-in-any-base and percent-escaped cookie domains as exact-match-only (GHSA-f7vp-7xgx-4w4r)
• Regenerate a derived Host header after client URI rewrites (GHSA-v5mv-p594-2x33)

Fixed

• Preserve RequestException when the stream handler rejects a request before opening a stream

7.15.1 - 2026-07-18

Security

... (truncated)

Commits

• ee80339 Release 7.15.5
• fb464ad Bump minimum promises and psr7
• 994a8a0 Release 7.15.4
• 6e73b57 Support PHP 8.6 (#3928)
• ae311b8 Release 7.15.3
• e3d8b4b Adjust the guzzlehttp/promises version constraint to ^2.5.2 (#3920)
• c55971f Settle cURL multi transfers displaced by native handle ID reuse (#3917)
• 04a8319 Fold numeric IPv4 hosts in the stream handler (#3909)
• ae0facb Reject untracked cURL multi handler waits with an attributable error (#3911)
• 7441019 Security fixes 7.15 (#3907)
• Additional commits viewable in compare view