guzzlehttp/psr7 needs to be updated to >2.10.2 to fix 2 security issues

Problem/Motivation

composer audit currently fails for projects using drupal/core-recommended:

Found 2 security vulnerability advisories affecting 1 package:
+-------------------+-----------------------------------------------------------+
| Package           | guzzlehttp/psr7                                           |
| Severity          | medium                                                    |
| CVE               | CVE-2026-48998                                            |
| Title             | guzzlehttp/psr7 has Host Confusion via Authority Reinte...|
| URL               | https://github.com/advisories/GHSA-34xg-wgjx-8xph         |
| Affected versions | <2.10.2                                                   |
| Reported at       | 2026-06-11T13:04:53+00:00                                 |
+-------------------+-----------------------------------------------------------+
+-------------------+-----------------------------------------------------------+
| Package           | guzzlehttp/psr7                                           |
| Severity          | medium                                                    |
| CVE               | CVE-2026-49214                                            |
| Title             | guzzlehttp/psr7 has CRLF Injection via URI Host Component |
| URL               | https://github.com/advisories/GHSA-hq7v-mx3g-29hw         |
| Affected versions | <2.10.2                                                   |
| Reported at       | 2026-06-11T13:04:47+00:00                                 |
+-------------------+-----------------------------------------------------------+

While these were fixed a few weeks ago (see https://github.com/advisories/GHSA-hq7v-mx3g-29hw), we can see the composer datasource was only registered with the vulnerabilities on June 11th.

I'm marking this as critical because even though core and contrib are unlikely to use Guzzle in a way to expose these issues, we can't know what code downstream users are bringing into their sites.

Steps to reproduce

composer create-project drupal/recommended-project:11.3.11 drupal && cd drupal && composer audit

Proposed resolution

drupal/core-recommended currently tracks ~2.8.0 making it impossible to upgrade to 2.10.2 without removing drupal/core-recommended. That line should probably be bumped to ~2.10.

Remaining tasks

Release notes snippet

Workaround

You can temporarily fetch the 2.11.0 version of guzzlehttp/psr and alias it to 2.8.1 with this:

composer require "guzzlehttp/psr7:2.11.0 as 2.8.1"

Revert this once a new Drupal core is released by deleting the guzzlehttp/psr7": "2.11.0 as 2.8.1", line in composer.json, and then updating Drupal core.

For details, see https://getcomposer.org/doc/articles/aliases.md.