chore(deps): bump guzzlehttp/guzzle from 7.15.1 to 7.15.3 in /php/example_code/rds

[dependabot]

Bumps guzzlehttp/guzzle from 7.15.1 to 7.15.3.

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.15.3

Changed

• Adjusted guzzlehttp/promises version constraint to ^2.5.2

Fixed

• Fail a cURL multi handler wait with an attributable error when the transfer is no longer tracked
• Fix StreamHandler resolving numeric IPv4 hosts differently from cURL handlers on macOS and Windows
• Fix StreamHandler TLS peer names and proxy authorities for numeric IPv4 hosts on all platforms
• Settle a cURL multi handler transfer displaced by a request reusing its native handle ID

7.15.2

Security

• Reject non-printable-ASCII and percent-escaped URI hosts and Host headers (GHSA-v5mv-p594-2x33)
• Reject request URI hosts that contain a URI authority delimiter (GHSA-v5mv-p594-2x33)
• Reject numeric-looking URI hosts with trailing dots, read as IPv4 addresses (GHSA-v5mv-p594-2x33)
• Treat numeric-in-any-base and percent-escaped cookie domains as exact-match-only (GHSA-f7vp-7xgx-4w4r)
• Regenerate a derived Host header after client URI rewrites (GHSA-v5mv-p594-2x33)

Fixed

• Preserve RequestException when the stream handler rejects a request before opening a stream

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.15.3 - 2026-08-05

Changed

• Adjusted guzzlehttp/promises version constraint to ^2.5.2

Fixed

• Fail a cURL multi handler wait with an attributable error when the transfer is no longer tracked
• Fix StreamHandler resolving numeric IPv4 hosts differently from cURL handlers on macOS and Windows
• Fix StreamHandler TLS peer names and proxy authorities for numeric IPv4 hosts on all platforms
• Settle a cURL multi handler transfer displaced by a request reusing its native handle ID

7.15.2 - 2026-07-26

Security

• Reject non-printable-ASCII and percent-escaped URI hosts and Host headers (GHSA-v5mv-p594-2x33)
• Reject request URI hosts that contain a URI authority delimiter (GHSA-v5mv-p594-2x33)
• Reject numeric-looking URI hosts with trailing dots, read as IPv4 addresses (GHSA-v5mv-p594-2x33)
• Treat numeric-in-any-base and percent-escaped cookie domains as exact-match-only (GHSA-f7vp-7xgx-4w4r)
• Regenerate a derived Host header after client URI rewrites (GHSA-v5mv-p594-2x33)

Fixed

• Preserve RequestException when the stream handler rejects a request before opening a stream

Commits

• ae311b8 Release 7.15.3
• e3d8b4b Adjust the guzzlehttp/promises version constraint to ^2.5.2 (#3920)
• c55971f Settle cURL multi transfers displaced by native handle ID reuse (#3917)
• 04a8319 Fold numeric IPv4 hosts in the stream handler (#3909)
• ae0facb Reject untracked cURL multi handler waits with an attributable error (#3911)
• 7441019 Security fixes 7.15 (#3907)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

🤖 AI Code Example Review

PASS. This is a routine Dependabot dependency bump updating guzzlehttp/guzzle from 7.15.1 to 7.15.3 (including a security fix in 7.15.2) and the transitive guzzlehttp/promises from 2.5.1 to 2.5.2. The change is limited to composer.lock and is correct.

Detailed Review

1. Nature of change: This PR only modifies php/example_code/rds/composer.lock. It is a pure dependency version bump with no changes to example source code, tests, or configuration files.

2. Security relevance: Version 7.15.2 included several security fixes (GHSA-v5mv-p594-2x33, GHSA-f7vp-7xgx-4w4r) related to URI host validation and cookie domain handling. Merging this bump is important for keeping the example code dependencies free of known vulnerabilities.

3. Lock file correctness: The diff correctly updates version strings, git references (source and dist), guzzlehttp/promises minimum constraint from ^2.5.1 to ^2.5.2, support/source URLs, and timestamps for both guzzlehttp/guzzle and guzzlehttp/promises. No inconsistencies detected.

4. No source/test changes: Because this is only a lock file update, there are no code quality, error handling, or guideline conformance concerns to evaluate. The example source code itself is unchanged.

5. composer.json not modified: The composer.json likely already specifies a flexible version constraint (e.g. ^7.x) for guzzlehttp/guzzle, so no change there is expected or needed. This is consistent with standard Dependabot behavior.

6. No blocking issues: There are no issues that would prevent this PR from being merged. The change is straightforward, correct, and beneficial.

---

_{This review was generated automatically using Amazon Bedrock. It compares your changes against existing examples and coding guidelines. Please use your judgment — this is advisory, not authoritative.}