From a39714156cd54429d6df1e2e1190048b26c678bb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pavel=20Konvi=C4=8Dka?= <pavel.konvicka@gmail.com>
Date: Wed, 19 Aug 2026 13:43:33 +0200
Subject: [PATCH] Require guzzle 7.15.2+ to fix CVE-2026-69246

Noncanonical host can bypass host-based checks. Patched in guzzle
7.15.2; the 6.x branch has no fix, so it is no longer supported.
---
 composer.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/composer.json b/composer.json
index 0207ae4..c3e60b6 100644
--- a/composer.json
+++ b/composer.json
@@ -10,7 +10,7 @@
     "nette/utils": "^2.0|^3.0|^4.0"
   },
   "require-dev": {
-    "guzzlehttp/guzzle": "^6.3|^7.0",
+    "guzzlehttp/guzzle": "^7.15.2",
     "nette/tester": "^2.4"
   }
 }