chore(deps): bump guzzlehttp/psr7 from 2.8.0 to 2.13.0 in /php/example_code/dynamodb/partiql_basics

[dependabot]

Bumps guzzlehttp/psr7 from 2.8.0 to 2.13.0.

Release notes

Sourced from guzzlehttp/psr7's releases.

2.13.0

Added

• Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

• Use locale-independent ASCII case folding everywhere case is normalized
• Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

2.12.4

Changed

• Pass explicit trim characters ahead of the PHP 8.6 trim default change

2.12.3

Security

• Validate the URI host so getHost() matches the URI authority (GHSA-c2w2-prh8-qm98)

2.12.2

Fixed

• Report URI parsing, filtering, and normalization PCRE failures explicitly
• Report HTTP message parser PCRE failures explicitly
• Fail closed when PCRE validation fails for request targets and hosts

2.12.1

Security

• Reject CR/LF in HTTP method, protocol version, and reason phrase (GHSA-vm85-hxw5-5432)

2.12.0

Deprecated

• Deprecated non-finite float values in Query::build() that guzzlehttp/psr7 3.0 rejects
• Deprecated non-finite float multipart contents that guzzlehttp/psr7 3.0 rejects
• Deprecated non-string scalar bodies in Utils::streamFor(); cast them to a string for 3.0
• Deprecated non-string Uri::withQueryValues() values; cast them to a string for 3.0

2.11.1

Fixed

• Fixed non-finite float values emitting coercion warnings on PHP 8.5

2.11.0

Changed

• Changed Utils::modifyRequest() to reject conflicting URI and Host header changes in the same call
• Changed Header::parse() to split semicolon-separated parameters without repeated regular expression lookaheads

... (truncated)

Changelog

Sourced from guzzlehttp/psr7's changelog.

2.13.0 - 2026-07-16

Added

• Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

• Use locale-independent ASCII case folding everywhere case is normalized
• Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

2.12.5 - 2026-07-13

Fixed

• Compare header names and hosts with locale-independent ASCII lowercasing
• Compare hosts without locale sensitivity when detecting cross-origin redirects

2.12.4 - 2026-07-08

Changed

• Pass explicit trim characters ahead of the PHP 8.6 trim default change

Fixed

• Anchor server port and response start-line patterns to the true end of input
• Treat host-less origin-form request targets starting with // as paths in Message::parseRequest()
• Reject raw DEL bytes in bracketed IP-literal hosts instead of parsing a mutated host
• Reject invalid bytes after a bracketed IP-literal host instead of reparsing a different host

2.12.3 - 2026-06-23

Security

• Validate the URI host so getHost() matches the URI authority (GHSA-c2w2-prh8-qm98)

2.12.2 - 2026-06-23

Fixed

• Report URI parsing, filtering, and normalization PCRE failures explicitly
• Report HTTP message parser PCRE failures explicitly
• Fail closed when PCRE validation fails for request targets and hosts

2.12.1 - 2026-06-18

Security

• Reject CR/LF in HTTP method, protocol version, and reason phrase (GHSA-vm85-hxw5-5432)

... (truncated)

Commits

• dad8962 Release 2.13.0
• 1bc4f53 Trigger a runtime deprecation for Header::normalize() (#866)
• a1372ea Add tests locking in no-file upload handling (#856)
• d9561d1 Merge branch '2.12' into 2.13
• 9365d57 Release 2.12.5
• b82bac4 Add caseless comparison and asciiUcFirst helpers (#854)
• 2cf293e Merge branch '2.12' into 2.13
• c685419 Fold cross-origin host comparison without locale sensitivity (#852)
• 226b5b3 Add locale-independent ASCII case folding helpers (#850)
• 1acfa28 Use locale-independent ASCII folding for header and host names (#849)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

🤖 AI Code Example Review

Pass. This is a straightforward Dependabot-generated dependency bump of guzzlehttp/psr7 from 2.8.0 to 2.13.0 in the composer.lock file, including several security fixes and improvements. The change is mechanical and low-risk.

Detailed Review

1. Nature of change: This PR is a pure dependency update to composer.lock only — no application code, tests, or composer.json were modified. This is expected behavior from Dependabot.

2. Security relevance: The upgrade from 2.8.0 to 2.13.0 includes multiple security fixes (GHSA-c2w2-prh8-qm98 for URI host validation, GHSA-vm85-hxw5-5432 for CR/LF injection in HTTP methods), making this upgrade strongly advisable.

3. New transitive dependency — symfony/polyfill-php80: The upgrade introduces symfony/polyfill-php80 (v1.37.0) as a new transitive dependency. This is a well-known, low-risk Symfony polyfill library, but it is worth noting as a net-new addition to the dependency tree.

4. symfony/deprecation-contracts bump: Also bumped from v3.6.0 to v3.7.1 as a side effect. This is minor and low-risk.

5. composer.json not changed: The composer.json constraints presumably already allow this version range (since Dependabot resolved it). No action needed, but reviewers should confirm composer.json still reflects accurate constraints.

6. No example code changes: Because only composer.lock is modified, there is no impact on the SDK example code quality, structure, error handling, or documentation. Evaluation criteria around tested/runnable/guidelines/quality are not applicable here.

7. Plugin API version bump (2.6.0 → 2.9.0): This reflects the Composer version used to regenerate the lock file. Harmless, but confirms the lock was regenerated with a newer Composer.

8. No breaking changes expected: The 2.x→2.x upgrade is semver-compatible. The release notes indicate only additive features and deprecation notices for future 3.0 removal — no breaking changes.

9. Dependabot compatibility score: The PR description includes a Dependabot compatibility badge, indicating automated compatibility checking was performed.

10. Recommendation: Approve and merge. This is a routine, beneficial security-motivated dependency upgrade with no application code impact.

---

_{This review was generated automatically using Amazon Bedrock. It compares your changes against existing examples and coding guidelines. Please use your judgment — this is advisory, not authoritative.}

[github-actions]

🤖 AI Code Example Review

Pass. This is a routine Dependabot dependency bump of guzzlehttp/psr7 from 2.8.0 to 2.13.0 in the composer.lock file, including associated transitive dependency updates. No example code is changed, and the update includes several security fixes.

Detailed Review

1. Nature of change: This PR only modifies php/example_code/dynamodb/partiql_basics/composer.lock. No application source code, tests, or composer.json are changed. This is a pure dependency version lock update generated by Dependabot.

2. Security relevance: The bump spans multiple minor/patch versions and includes security fixes: GHSA-c2w2-prh8-qm98 (URI host validation, 2.12.3) and GHSA-vm85-hxw5-5432 (CR/LF injection in HTTP method, 2.12.1). Merging this is recommended from a security hygiene standpoint.

3. New transitive dependencies: guzzlehttp/psr7 2.13.0 now requires symfony/polyfill-php80 (^1.25) and symfony/deprecation-contracts (^2.5 || ^3.0) as direct runtime dependencies. Both are added to composer.lock correctly. The composer.json constraint ("guzzlehttp/psr7": "^2.x") should already accommodate 2.13.0 without changes.

4. Lock file integrity: The lock file changes look mechanically correct — updated version, reference, url, time, and require fields for guzzlehttp/psr7, plus updated symfony/deprecation-contracts from v3.6.0 to v3.7.1 and the new symfony/polyfill-php80 v1.37.0 entry. The plugin-api-version bump from 2.6.0 to 2.9.0 reflects a newer Composer version was used to regenerate the lock; this is benign.

5. No example code impact: The update does not touch any PHP source files, scenario scripts, or test files. The functional behavior of the DynamoDB PartiQL example code is unaffected.

6. No composer.json change needed: Since the lock file already pins the version, and the composer.json presumably has a compatible constraint (e.g., ^2.0), no composer.json modification is required. If the constraint were restrictive (e.g., ~2.8.0), the update would fail — the absence of a composer.json change implies it's already compatible.

7. Minor note: The composer.lock was regenerated with a newer version of Composer (plugin-api-version 2.9.0 vs 2.6.0). This is normal and not a concern, but worth noting if the team standardizes on a specific Composer version in CI.

8. No test gap introduced: Since no logic changes were made, no new tests are needed for this PR.

---

_{This review was generated automatically using Amazon Bedrock. It compares your changes against existing examples and coding guidelines. Please use your judgment — this is advisory, not authoritative.}