Update guzzlehttp/psr7 to 2.12.1 and guzzlehttp/guzzle to 7.12.1

So there's a 2.12.1 security release now: https://github.com/guzzle/psr7/security/advisories/GHSA-vm85-hxw5-5432, so going to update branches to that.

The deprecations are actually coming from within the guzzle client itself. Resolving those would involve updating guzzlehttp/guzzle (and guzzlehttp/promises), which is probably out of scope here since it's likely this will need to be backported for the security updates. For now, suppressing the deprecations.

We can update guzzlehttp/guzzle in a follow up for main and 11.x (and maybe 11.4?).

MRs for main, 11.x, 11.4.x up. I explored going forward with updating guzzlehttp/guzzle for main, but while that fixed the deprecations in guzzlehttp/psr7, in introduced deprecations in Drupal test code because of the use of getConfig(): https://github.com/guzzle/guzzle/issues/2514, so going to kick that to a follow up after all.

MRs for 11.3.x and 10.6.x up as well if we want to do patch releases for them. The SA is not on Packagist yet, but we could possibly have the commits ready for a patch release in preparation.

There's been discussion on Slack based on #3599842-48: guzzlehttp/psr7 needs to be updated to >2.10.2 to fix 2 security issues whether to relax the core/composer.json constraint back to what it was before the security updates, while leaving the core-recommended and composer.lock changes in place.

OK, relaxed the constraints for 11+ to ^2.8.0 and 10.6.x to ^2.4.5, which is what they were before the recent updates.

Missed yesterday that the client library guzzlehttp/guzzle had marked its new 7.12.1 as a security release as well. Will add that here after all.

And today all the SAs have hit composer:

+-------------------+----------------------------------------------------------------------------------+
| Package           | guzzlehttp/guzzle                                                                |
| Severity          | medium                                                                           |
| Advisory ID       | PKSA-93qv-9n9h-6k6p                                                              |
| CVE               | CVE-2026-55767                                                                   |
| Title             | guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts                       |
| URL               | https://github.com/advisories/GHSA-cwxw-98qj-8qjx                                |
| Affected versions | <7.12.1                                                                          |
| Reported at       | 2026-06-19T14:37:29+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | guzzlehttp/guzzle                                                                |
| Severity          | medium                                                                           |
| Advisory ID       | PKSA-k22t-f949-t9g6                                                              |
| CVE               | CVE-2026-55568                                                                   |
| Title             | guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext                     |
| URL               | https://github.com/advisories/GHSA-wpwq-4j6v-78m3                                |
| Affected versions | <7.12.1                                                                          |
| Reported at       | 2026-06-19T14:17:59+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | guzzlehttp/psr7                                                                  |
| Severity          | medium                                                                           |
| Advisory ID       | PKSA-7qs6-zvnz-h66r                                                              |
| CVE               | CVE-2026-55766                                                                   |
| Title             | guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization                 |
| URL               | https://github.com/advisories/GHSA-vm85-hxw5-5432                                |
| Affected versions | <2.12.1                                                                          |
| Reported at       | 2026-06-19T14:35:57+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+

OK, ready again.

I was planning on opening a follow up to address all the guzzle deprecations (the cookies one and the ClientInterface::getConfig() one), but I've updated the MRs per #20. Will create a follow up for getConfig() later.

The release managers are discussing a plan for doing patch releases soon. By the original calendar, 11.4.0 would have been released this past week, so 11.2 and 10.5 should have gone EOL, but the security releases and out of band patch releases the last couple months have contributed to slight delays of 11.4.

In the meantime, the known workarounds are:

• aliasing, see Workaround section in the IS of #3599842: guzzlehttp/psr7 needs to be updated to >2.10.2 to fix 2 security issues as an example
• using the --no-blocking CLI option or COMPOSER_NO_BLOCKING env variable: https://getcomposer.org/doc/03-cli.md#composer-no-blocking
• ignore guzzle security notices in the composer.json config.policy block: https://getcomposer.org/doc/06-config.md#policy

Note that the latter two do not update the packages, but they prevent composer install or update from being blocked.

Related: There is also discussion about relaxing the constraints in drupal.core-recommended: #3600889: Remove all minor constraints from core-recommended