Use version of guzzlehttp/guzzle ^6.5.2

Getting the ball rolling here:

$ composer-lock-diff --no-links
+-------------------------------+---------+----------+
| Production Changes            | From    | To       |
+-------------------------------+---------+----------+
| asm89/stack-cors              | 1.2.0   | 1.3.0    |
| doctrine/annotations          | v1.4.0  | v1.8.0   |
| doctrine/cache                | v1.6.2  | 1.10.0   |
| doctrine/collections          | v1.4.0  | 1.6.4    |
| doctrine/common               | v2.7.3  | v2.11.0  |
| doctrine/inflector            | v1.2.0  | 1.3.1    |
| doctrine/lexer                | 1.0.2   | 1.2.0    |
| egulias/email-validator       | 2.1.11  | 2.1.13   |
| guzzlehttp/guzzle             | 6.3.3   | 6.5.2    |
| pear/console_getopt           | v1.4.2  | v1.4.3   |
| pear/pear-core-minimal        | v1.10.9 | v1.10.10 |
| pear/pear_exception           | v1.0.0  | v1.0.1   |
| psr/log                       | 1.1.0   | 1.1.2    |
| symfony-cmf/routing           | 2.1.0   | 2.1.1    |
| symfony/class-loader          | v3.4.35 | v3.4.36  |
| symfony/console               | v4.4.0  | v4.4.2   |
| symfony/debug                 | v4.4.0  | v4.4.2   |
| symfony/dependency-injection  | v4.4.0  | v4.4.2   |
| symfony/error-handler         | v4.4.0  | v4.4.2   |
| symfony/event-dispatcher      | v4.4.0  | v4.4.2   |
| symfony/http-foundation       | v4.4.0  | v4.4.2   |
| symfony/http-kernel           | v4.4.0  | v4.4.2   |
| symfony/mime                  | v5.0.0  | v5.0.2   |
| symfony/polyfill-ctype        | v1.12.0 | v1.13.1  |
| symfony/polyfill-iconv        | v1.12.0 | v1.13.1  |
| symfony/polyfill-intl-idn     | v1.12.0 | v1.13.1  |
| symfony/polyfill-mbstring     | v1.12.0 | v1.13.1  |
| symfony/polyfill-php72        | v1.12.0 | v1.13.1  |
| symfony/polyfill-php73        | v1.12.0 | v1.13.1  |
| symfony/process               | v4.4.0  | v4.4.2   |
| symfony/routing               | v4.4.0  | v4.4.2   |
| symfony/serializer            | v4.4.0  | v4.4.2   |
| symfony/service-contracts     | v2.0.0  | v2.0.1   |
| symfony/translation           | v4.4.0  | v4.4.2   |
| symfony/translation-contracts | v2.0.0  | v2.0.1   |
| symfony/validator             | v4.4.0  | v4.4.2   |
| symfony/var-dumper            | v5.0.0  | v5.0.2   |
| symfony/yaml                  | v4.4.0  | v4.4.2   |
| twig/twig                     | v2.12.1 | v2.12.3  |
| doctrine/event-manager        | NEW     | 1.1.0    |
| doctrine/persistence          | NEW     | 1.3.3    |
| doctrine/reflection           | NEW     | v1.0.0   |
+-------------------------------+---------+----------+

+-----------------------------------+--------+---------+
| Dev Changes                       | From   | To      |
+-----------------------------------+--------+---------+
| composer/ca-bundle                | 1.2.4  | 1.2.5   |
| composer/xdebug-handler           | 1.3.3  | 1.4.0   |
| doctrine/instantiator             | 1.0.5  | 1.3.0   |
| drupal/coder                      | 8.3.6  | 8.3.7   |
| fabpot/goutte                     | v3.2.3 | v3.3.0  |
| justinrainbow/json-schema         | 5.2.8  | 5.2.9   |
| myclabs/deep-copy                 | 1.7.0  | 1.9.4   |
| phar-io/manifest                  | 1.0.1  | 1.0.3   |
| phar-io/version                   | 1.0.1  | 2.0.1   |
| phpdocumentor/reflection-common   | 1.0.1  | 2.0.0   |
| phpdocumentor/reflection-docblock | 4.3.2  | 4.3.4   |
| phpdocumentor/type-resolver       | 0.5.1  | 1.0.1   |
| phpspec/prophecy                  | 1.9.0  | 1.10.1  |
| phpunit/php-code-coverage         | 5.3.2  | 6.1.4   |
| phpunit/php-file-iterator         | 1.4.5  | 2.0.2   |
| phpunit/php-timer                 | 1.0.9  | 2.1.2   |
| phpunit/php-token-stream          | 2.0.2  | 3.1.1   |
| phpunit/phpunit                   | 6.5.14 | 7.5.18  |
| phpunit/phpunit-mock-objects      | 5.0.10 | REMOVED |
| sebastian/comparator              | 2.1.3  | 3.0.2   |
| sebastian/diff                    | 2.0.1  | 3.0.2   |
| sebastian/environment             | 3.1.0  | 4.2.3   |
| sebastian/resource-operations     | 1.0.0  | 2.0.1   |
| seld/jsonlint                     | 1.7.1  | 1.7.2   |
| squizlabs/php_codesniffer         | 3.5.0  | 3.5.3   |
| symfony/browser-kit               | v4.4.0 | v4.4.2  |
| symfony/css-selector              | v4.4.0 | v4.4.2  |
| symfony/dom-crawler               | v4.4.0 | v4.4.2  |
| symfony/filesystem                | v4.4.0 | v4.4.2  |
| symfony/finder                    | v4.4.0 | v4.4.2  |
| symfony/lock                      | v4.4.0 | v4.4.2  |
| symfony/phpunit-bridge            | v4.4.0 | v4.4.2  |
| webmozart/assert                  | 1.5.0  | 1.6.0   |
+-----------------------------------+--------+---------+

Reroll since #3091418: Update composer dependencies on 9.0.x following PHP 7.2 requirement got in.

$ composer-lock-diff --no-links
+-------------------------+---------+----------+
| Production Changes      | From    | To       |
+-------------------------+---------+----------+
| asm89/stack-cors        | 1.2.0   | 1.3.0    |
| doctrine/annotations    | v1.4.0  | v1.8.0   |
| doctrine/cache          | v1.6.2  | 1.10.0   |
| doctrine/collections    | v1.4.0  | 1.6.4    |
| doctrine/common         | v2.7.3  | v2.11.0  |
| doctrine/inflector      | v1.2.0  | 1.3.1    |
| doctrine/lexer          | 1.0.2   | 1.2.0    |
| egulias/email-validator | 2.1.11  | 2.1.13   |
| pear/console_getopt     | v1.4.2  | v1.4.3   |
| pear/pear-core-minimal  | v1.10.9 | v1.10.10 |
| pear/pear_exception     | v1.0.0  | v1.0.1   |
| psr/log                 | 1.1.0   | 1.1.2    |
| symfony-cmf/routing     | 2.1.0   | 2.1.1    |
| twig/twig               | v2.12.1 | v2.12.3  |
| doctrine/event-manager  | NEW     | 1.1.0    |
| doctrine/persistence    | NEW     | 1.3.3    |
| doctrine/reflection     | NEW     | v1.0.0   |
+-------------------------+---------+----------+

+-----------------------------------+--------+---------+
| Dev Changes                       | From   | To      |
+-----------------------------------+--------+---------+
| composer/ca-bundle                | 1.2.4  | 1.2.5   |
| composer/xdebug-handler           | 1.3.3  | 1.4.0   |
| doctrine/instantiator             | 1.0.5  | 1.3.0   |
| fabpot/goutte                     | v3.2.3 | v3.3.0  |
| justinrainbow/json-schema         | 5.2.8  | 5.2.9   |
| myclabs/deep-copy                 | 1.7.0  | 1.9.4   |
| phar-io/manifest                  | 1.0.1  | 1.0.3   |
| phar-io/version                   | 1.0.1  | 2.0.1   |
| phpdocumentor/reflection-common   | 1.0.1  | 2.0.0   |
| phpdocumentor/reflection-docblock | 4.3.2  | 4.3.4   |
| phpdocumentor/type-resolver       | 0.5.1  | 1.0.1   |
| phpspec/prophecy                  | 1.9.0  | 1.10.1  |
| phpunit/php-code-coverage         | 5.3.2  | 6.1.4   |
| phpunit/php-file-iterator         | 1.4.5  | 2.0.2   |
| phpunit/php-timer                 | 1.0.9  | 2.1.2   |
| phpunit/php-token-stream          | 2.0.2  | 3.1.1   |
| phpunit/phpunit                   | 6.5.14 | 7.5.18  |
| phpunit/phpunit-mock-objects      | 5.0.10 | REMOVED |
| sebastian/comparator              | 2.1.3  | 3.0.2   |
| sebastian/diff                    | 2.0.1  | 3.0.2   |
| sebastian/environment             | 3.1.0  | 4.2.3   |
| sebastian/resource-operations     | 1.0.0  | 2.0.1   |
| seld/jsonlint                     | 1.7.1  | 1.7.2   |
| squizlabs/php_codesniffer         | 3.5.0  | 3.5.3   |
| webmozart/assert                  | 1.5.0  | 1.6.0   |
+-----------------------------------+--------+---------+

#3104265: Update Composer dependencies on Doctrine components in 9.0.x was split off from #3091418: Update composer dependencies on 9.0.x following PHP 7.2 requirement to address issues with Doctrine dependencies, so we should not be updating Doctrine here. This patch should only update Guzzle; the composer.lock should not have any additional changes (save perhaps any additional dependency updates required by Guzzle, if any).

Ah yes of course, let's try this again...

Steps taken for this patch (let me know if it makes sense):
1. Checked out 9.0.x
2. Bumped the version of guzzle to ^6.5.2 on core/composer.json
3. Removed the vendor directory.
4. Ran composer update guzzlehttp/guzzle

I noticed that running composer-lock-diff throws no results, which is strange, since clearly the lock file has changes reflecting the upgrading of guzzle... not sure what's going on there (bug in the tool?)

The lock file has only changed to reflect the new minimum version; the version itself was already upgraded to 6.5.2 in #3091418: Update composer dependencies on 9.0.x following PHP 7.2 requirement, so composer-lock-diff correctly shows no changes.

+++ b/composer.lock
@@ -4165,6 +4165,9 @@
+            "bin": [
+                "bin/composer"
+            ],

If I repeat the steps locally I don't get this change, I am not sure why it is added here.

Ah that makes sense, thanks @longwave for the kind explanation and for having a look at this.

Regarding the bin section being added to composer.lock, I have repeated the process a couple of times and it gets added every time. I also just did these steps after doing the steps on #6:

1. Manually removed the bin section from composer.lock
2. Deleted the vendor directory.
3. Ran composer install.

I then checked the composer.lock file and the bin section was not re-added, so I'm not sure what's going on.

In any case, I'm uploading the patch without the bin configuration getting added to composer.lock in case its just something on my local set up that's causing this.

#8: Running composer install never updates the composer.lock file.

In general I am -1 on hand-editing the composer.lock file; however, I repeated the steps above, and got a lock file that looked like #8, so RTBC I guess.

Were you on the 9.0.x branch when you ran composer update? If you check out a feature branch, then you must set COMPOSER_ROOT_VERSION=9.0.x to get the correct result.

Re #9: Thanks for RTBCing @greg.1.anderson

True about composer install... not sure what I was thinking... 🤦‍♂️

I was indeed on the 9.0.x branch (updated to latest changes) when I ran composer update guzzlehttp/guzzle.

Anyway, so long as you get the same changes to the lock file I assume we should be ok.

OK, this looks more like the patch I was expecting. :)

Committed and pushed to 9.0.x. Thanks!