$ composer update --no-dev 141 ↵ Loading composer repositories with package information Updating dependencies Your requirements could not be resolved to an installable set of packages. Problem 1 - Root composer.json requires guzzlehttp/guzzle 7.10.0 (exact version match: 7.10.0 or 7.10.0.0), found guzzlehttp/guzzle[7.10.0] but these were not loaded, because they are affected by security advisories ("PKSA-93qv-9n9h-6k6p", "PKSA-k22t-f949-t9g6"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config. Problem 2 - Root composer.json requires guzzlehttp/psr7 2.11.1 (exact version match: 2.11.1 or 2.11.1.0), found guzzlehttp/psr7[2.11.1] but these were not loaded, because they are affected by security advisories ("PKSA-7qs6-zvnz-h66r"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config. Problem 3 - Root composer.json requires wikimedia/codex 0.7.1 -> satisfiable by wikimedia/codex[v0.7.1]. - wikimedia/codex v0.7.1 requires guzzlehttp/psr7 ^2.7 -> found guzzlehttp/psr7[2.7.0, ..., 2.12.1] but these were not loaded, because they are affected by security advisories ("PKSA-7qs6-zvnz-h66r", "PKSA-gm5x-j3mz-71n9", "PKSA-jj5t-2zs1-dcfm"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config. Problem 4 - Root composer.json requires wikimedia/shellbox 4.4.0 -> satisfiable by wikimedia/shellbox[4.4.0]. - wikimedia/shellbox 4.4.0 requires guzzlehttp/guzzle ^7.9.2 -> found guzzlehttp/guzzle[7.9.2, ..., 7.12.1] but these were not loaded, because they are affected by security advisories ("PKSA-93qv-9n9h-6k6p", "PKSA-k22t-f949-t9g6"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config. Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions. Running update with --no-dev does not mean require-dev is ignored, it just means the packages will not be installed. If dev requirements are blocking the update you have to resolve those problems.
https://packagist.org/packages/guzzlehttp/guzzle/advisories?version=9302804 seems to be the relevant advisory for guzzlehttp/guzzle
https://packagist.org/packages/guzzlehttp/psr7/advisories?version=10263896 for guzzlehttp/psr7