Skip to content

Bump the composer group across 2 directories with 7 updates#111

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/php/cakephp5/composer-5b6e49672b
Open

Bump the composer group across 2 directories with 7 updates#111
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/php/cakephp5/composer-5b6e49672b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 19, 2026

Copy link
Copy Markdown
Contributor

Bumps the composer group with 4 updates in the /php/cakephp5 directory: cakephp/cakephp, phpunit/phpunit, composer/composer and twig/markdown-extra.
Bumps the composer group with 1 update in the /php/simple directory: nesbot/carbon.

Updates cakephp/cakephp from 5.0.0 to 5.1.7

Release notes

Sourced from cakephp/cakephp's releases.

CakePHP 5.1.6 released

The CakePHP core team is happy to announce the immediate availability of CakePHP 5.1.6. This is a maintenance release for the 5.1 branch that fixes several community reported issues and regressions. If you are having problems with the framework breaking your application when you upgrade from 5.0.11 to 5.1, please open an issue.

Bugfixes

You can expect the following changes in 5.1.6. See the changelog for every commit.

  • Updated Session::renew() to avoid samesite warnings.
  • Errors caused by requests to URLs like index.php?<>? now have error pages rendered instead of empty 500 responses.
  • Improved behavior of requireFieldPresence in entities.
  • MissingActionException raised in plugins now correctly name the controller + action in the error message.
  • Added IPv6 support to datasource DSN parsing.
  • Http\Client no longer overwrites an explicit content type with application/x-form-urlencoded when an empty request body is provided.
  • FormHelper::postLink() now uses HtmlElement.requestSubmit() instead of .submit(). This allows submit event handlers to intercept requests from postLink() buttons.

Contributors to 5.1.6

Thank you to all the contributors that submitted a pull request:

  • ADmad
  • Alberto G. Rodriguez
  • Kevin Pfeifer
  • Mark Scherer
  • Mark Story
  • Mirko Pagliai
  • othercorey
  • Markus Ramšak

As always, we would like to also thank all the contributors that opened issues, or updated the documentation.

CakePHP 5.1.5 released

The CakePHP core team is happy to announce the immediate availability of CakePHP 5.1.5. This is a maintenance release with a security fix for the 5.1 branch that fixes several community reported issues and regressions. If you are having problems with the framework breaking your application when you upgrade from 5.0.11 to 5.1, please open an issue.

Bugfixes

You can expect the following changes in 5.1.5. See the `changelog for every commit.

  • Streamline composer dependencies. lib-ICU is already an implicit dependency through intl.
  • Improve API docs.
  • Minor optimizations, by removing redundant assignments, empty() and isset() checks.
  • The console package no longer has a hard dependency on Router. Instead Router will only be used if it is installed.
  • Correct column ordering being incorrect in reflected foreign key data with postgres.
  • The EavStrategy behavior now uses the entity class of the attached table instead of the Entity base class.
  • QueryException now includes the problematic SQL that was created the error.
  • The utility package no longer has a hard dependency on the i18n package.
  • Fixed falsey value handling in XmlView.
  • Using cached schema metadata no longer creates a database connection.

... (truncated)

Commits
  • 3b7d95d Update version number to 5.1.7
  • 0e816bd Fix a potential file handling weakness in element()
  • 4b8915c Update version number to 5.1.6
  • abd16cf Use requestSubmit() instead of submit() in postLink (#18198)
  • 319f923 Fixed description for CollectionInterface::unique() (#18194)
  • 6adb62b Don't overwrite content body when request data is empty (#18182)
  • 18253da Merge pull request #18184 from cakephp/cleanup
  • 1860f53 Improve type detection
  • b0da917 Remove code duplication.
  • a3f768c Merge pull request #18174 from cakephp/translate-behavior-require-field-presence
  • Additional commits viewable in compare view

Updates phpunit/phpunit from 10.3.5 to 10.5.62

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 10.5.62

Changed

  • To prevent Poisoned Pipeline Execution (PPE) attacks using prepared .coverage files in pull requests, a PHPT test will no longer be run if the temporary file for writing code coverage information already exists before the test runs

Learn how to install or update PHPUnit 10.5 in the documentation.

Keep up to date with PHPUnit:

PHPUnit 10.5.61

Changed

  • PHPUnit\Framework\MockObject exceptions are now subtypes of PHPUnit\Exception

Learn how to install or update PHPUnit 10.5 in the documentation.

Keep up to date with PHPUnit:

PHPUnit 10.5.60

  • No changes; phpunit.phar rebuilt with PHP 8.4 to work around PHP-Scoper issue #1139

Learn how to install or update PHPUnit 10.5 in the documentation.

Keep up to date with PHPUnit:

PHPUnit 10.5.59

Changed

  • #6338: Removed code from PHPUnit\Runner\TestSuiteSorter that was only used in the tests for this class
  • Updated list of deprecated PHP configuration settings for PHP 8.4, PHP 8.5, and PHP 8.6

Learn how to install or update PHPUnit 10.5 in the documentation.

... (truncated)

Changelog

Sourced from phpunit/phpunit's changelog.

[10.5.62] - 2026-01-27

Changed

  • To prevent Poisoned Pipeline Execution (PPE) attacks using prepared .coverage files in pull requests, a PHPT test will no longer be run if the temporary file for writing code coverage information already exists before the test runs

[10.5.61] - 2026-01-24

Changed

  • PHPUnit\Framework\MockObject exceptions are now subtypes of PHPUnit\Exception

[10.5.60] - 2025-12-06

  • No changes; phpunit.phar rebuilt with PHP 8.4 to work around PHP-Scoper issue #1139

[10.5.59] - 2025-12-01

Changed

  • #6338: Removed code from PHPUnit\Runner\TestSuiteSorter that was only used in the tests for this class
  • Updated list of deprecated PHP configuration settings for PHP 8.4, PHP 8.5, and PHP 8.6

[10.5.58] - 2025-09-28

Fixed

  • #6368: failOnPhpunitWarning="false" has no effect

[10.5.57] - 2025-09-24

  • No changes; phpunit.phar rebuilt with updated dependencies

[10.5.56] - 2025-09-23

  • No changes; phpunit.phar rebuilt with updated dependencies

[10.5.55] - 2025-09-14

Changed

  • #6366: Exclude __sleep() and __wakeup() from test double code generation on PHP >= 8.5

[10.5.54] - 2025-09-11

Changed

  • Do not use __sleep() method (which will be deprecated in PHP 8.5)

[10.5.53] - 2025-08-20

... (truncated)

Commits
  • 3f7dd50 Prepare release
  • 9c95cf0 Merge branch '9.6' into 10.5
  • fea0625 Prepare release
  • 1a677f6 Merge branch '8.5' into 9.6
  • 1015741 Prepare release
  • e5cda18 Fix bad merge
  • a8b932b Merge branch '9.6' into 10.5
  • 1cce5f3 Merge branch '8.5' into 9.6
  • 3141742 Do not run PHPT test when its temporary file for code coverage information ex...
  • 0b3170a We do not need to unserialize() objects here
  • Additional commits viewable in compare view

Updates composer/composer from 2.6.3 to 2.10.2

Release notes

Sourced from composer/composer's releases.

2.10.2

  • Security: Validate package names (GHSA-499r-g7pc-vmp9 / CVE-2026-59948)
  • Security: Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx / CVE-2026-59946)
  • Security: Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3 / CVE-2026-59947)
  • Security: Only follow HTTP redirects from HTTP responses (#12948)
  • Security: Prevent phar metadata unserialization on unsafe PHP versions (#12946)
  • Security: Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)
  • Added warning output in self-update command when using a soon-to-be EOL version (#12920)
  • Added download retry when a GitHub codeload URL returns a 400 (#12962)
  • Fixed audit command to output the audit result to stdout (#12904)
  • Fixed backspace characters being output to non-decorated output (#12925)
  • Fixed security advisory blocking causing issues with xdebug enabled (#12935)
  • Fixed provider packages hiding suggestions for the package they provide themselves (#12933)
  • Fixed security advisory blocking causing issues with xdebug enabled (#12935)

Full Changelog: composer/composer@2.10.1...2.10.2

2.10.1

  • Security: Fixed shell escaping when opening an editor (#12903)
  • Security: Verify backup phar signature before restoring it when using self-update --rollback (#12918)
  • Fixed source-fallback also disabling fallbacks to dist install when source is the preferred install method (#12888)
  • Fixed source -> dist package updates wiping the .git dir without checking for local changes first (#12912)
  • Fixed GitHub token prompt happening multiple times on parallel auth failures (#12913)
  • Fixed warnings from Composer repositories being printed twice in some cases (#12907)

Full Changelog: composer/composer@2.10.0...2.10.1

2.10.0

Read the Composer 2.10 Release Announcement for more details on the release highlights.

Full Changelog

  • BC Break / Security: Disabled automatic fallback to source checkout if dist/zip install fails, we have introduced a new source-fallback config option as a temporary way to restore the old behavior, but if you need this talk to us as we plan to remove it entirely in 2.11 (#12885)
  • BC Break: Minor break for audit consumers, the exit code is now always 0 (success) or 1 if anything failed the audit (#12881)
  • Security: Added dependency policies to block package versions where malware was detected on update/install or report it with audit (#12786)
  • Security: Hardened output filtering of URLs to reduce chances of token leaks (#12882, #12886)
  • Security: Fixed handling of uppercase schemes in URL validation that might have allowed https requirement bypass (#12884)
  • Security: Fixed git credentials remaining in git mirror .git/config after clone or update failed (2bcbfc3d)
  • Security: Fixed usage of insecure 3DES ciphers when ext-curl is missing (5e71d77e)
  • Security: Enforce allow-plugins even in non-interactive mode for very old pre-2.2 lock files (#12764)
  • Added support for temporary --with constraints with wildcards in the package name for the update command (#12658)
  • Added --strict-psr-autoloader flag to install and update commands (#12647)
  • Added source-fallback config option to disable or enable source fallback on download failure (#12698)
  • Added --require parameter to create-project to add new packages to the project as it gets installed (#12738)
  • Optimized plugin autoloading by avoiding regenerating classmaps for every package per plugin (#12696)
  • Optimized PoolOptimizer memory usage (#12783)
  • Optimized classmap dumping performance
  • Deprecated most of the audit config in favor of the new policy one (#12804, see #12786 for the RFC and upgrade docs)
  • Fixed update --bump-after-update to only bump packages that actually were updated (#12733)
  • Fixed GitHub API authentication errors not being visible to the user (#12737)

... (truncated)

Changelog

Sourced from composer/composer's changelog.

[2.10.2] 2026-07-01

  • Security: Validate package names (GHSA-499r-g7pc-vmp9)
  • Security: Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx)
  • Security: Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3)
  • Security: Only follow HTTP redirects from HTTP responses (#12948)
  • Security: Prevent phar metadata unserialization on unsafe PHP versions (#12946)
  • Security: Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)
  • Added warning output in self-update command when using a soon-to-be EOL version (#12920)
  • Added download retry when a GitHub codeload URL returns a 400 (#12962)
  • Fixed audit command to output the audit result to stdout (#12904)
  • Fixed backspace characters being output to non-decorated output (#12925)
  • Fixed security advisory blocking causing issues with xdebug enabled (#12935)
  • Fixed provider packages hiding suggestions for the package they provide themselves (#12933)
  • Fixed security advisory blocking causing issues with xdebug enabled (#12935)

[2.10.1] 2026-06-04

  • Security: Fixed shell escaping when opening an editor (#12903)
  • Security: Verify backup phar signature before restoring it when using self-update --rollback (#12918)
  • Fixed source-fallback also disabling fallbacks to dist install when source is the preferred install method (#12888)
  • Fixed source -> dist package updates wiping the .git dir without checking for local changes first (#12912)
  • Fixed GitHub token prompt happening multiple times on parallel auth failures (#12913)
  • Fixed warnings from Composer repositories being printed twice in some cases (#12907)

[2.10.0] 2026-05-28

  • BC Break / Security: Disabled automatic fallback to source checkout if dist/zip install fails, we have introduced a new source-fallback config option as a temporary way to restore the old behavior, but if you need this talk to us as we plan to remove it entirely in 2.11 (#12885)
  • BC Break: Minor break for audit consumers, the exit code is now always 0 (success) or 1 if anything failed the audit (#12881)
  • Security: Hardened output filtering of URLs to reduce chances of token leaks (#12882, #12886)
  • Security: Fixed handling of uppercase schemes in URL validation that might have allowed https requirement bypass (#12884)
  • Fixed audit command returning a success code when the vendor dir was not present (#12880)

[2.10.0-RC2] 2026-05-20

  • Since 2.10.0-RC1, fixes in 2.9.6 - 2.9.8, many of which security relevant, are also included
  • Since 2.10.0-RC1 a lot of the new filter list config format was modified - see #12786 for the latest state of this new feature
  • Added a new policy config block to control all security related update/install/audit policies. This replaces and deprecates most of the audit config (#12804 for implementation, #12786 for RFC/upgrade docs)
  • Enabled blocking of malware packages at install time by default
  • Fixed --no-plugins handling regression (#12789)
  • Fixed regression in startup performance when many scripts are defined (#12832)
  • Improved classmap dumping performance

[2.10.0-RC1] 2026-04-01

  • Security: Added filter lists to block package versions where malware was detected on update or report it with audit (#12786)
  • Security: Fixed git credentials remaining in git mirror .git/config after clone or update failed (2bcbfc3d)
  • Security: Fixed usage of insecure 3DES ciphers when ext-curl is missing (5e71d77e)
  • Security: Enforce allow-plugins even in non-interactive mode for very old pre-2.2 lock files (#12764)
  • Added support for temporary --with constraints with wildcards in the package name for the update command (#12658)

... (truncated)

Commits
  • 8d4439f Release 2.10.2
  • 79d92f0 Update changelog
  • 8887ad7 Merge commit from fork
  • 502c6c4 Merge commit from fork
  • 145e74d Update deps
  • e42b4f1 Retry downloads failing with HTTP 400 on a fresh connection (#12962)
  • 8c3eba8 Add basic command level telemetry (#12952)
  • c5f92a0 Bump actions/checkout from 6.0.3 to 7.0.0 (#12949)
  • b7c4e39 Sanitize JSON parse errors in Http\Response to avoid leaking response bodies ...
  • 6665153 Add VersionsTest for self update behavior
  • Additional commits viewable in compare view

Updates symfony/process from 6.3.4 to 6.4.41

Release notes

Sourced from symfony/process's releases.

v6.4.41

Changelog (symfony/process@v6.4.39...v6.4.41)

v6.4.39

Changelog (symfony/process@v6.4.33...v6.4.39)

v6.4.33

Changelog (symfony/process@v6.4.32...v6.4.33)

v6.4.32

Changelog (symfony/process@v6.4.31...v6.4.32)

v6.4.31

Changelog (symfony/process@v6.4.30...v6.4.31)

v6.4.26

Changelog (symfony/process@v6.4.25...v6.4.26)

v6.4.25

Changelog (symfony/process@v6.4.24...v6.4.25)

v6.4.24

Changelog (symfony/process@v6.4.23...v6.4.24)

  • no significant changes

v6.4.20

Changelog (symfony/process@v6.4.19...v6.4.20)

v6.4.19

Changelog (symfony/process@v6.4.18...v6.4.19)

  • no significant changes

... (truncated)

Changelog

Sourced from symfony/process's changelog.

CHANGELOG

7.3

  • Add RunProcessMessage::fromShellCommandline() to instantiate a Process via the fromShellCommandline method

7.1

  • Add Process::setIgnoredSignals() to disable signal propagation to the child process

6.4

  • Add PhpSubprocess to handle PHP subprocesses that take over the configuration from their parent
  • Add RunProcessMessage and RunProcessMessageHandler

5.2.0

  • added Process::setOptions() to set Process specific options
  • added option create_new_console to allow a subprocess to continue to run after the main script exited, both on Linux and on Windows

5.1.0

  • added Process::getStartTime() to retrieve the start time of the process as float

5.0.0

  • removed Process::inheritEnvironmentVariables()
  • removed PhpProcess::setPhpBinary()
  • Process must be instantiated with a command array, use Process::fromShellCommandline() when the command should be parsed by the shell
  • removed Process::setCommandLine()

4.4.0

  • deprecated Process::inheritEnvironmentVariables(): env variables are always inherited.
  • added Process::getLastOutputTime() method

4.2.0

... (truncated)

Commits
  • c8fc09b [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses
  • 6c93071 [Process] Ignore array env values before proc_open
  • 7b8e6e8 More CS fixes
  • 5731331 CS fixes - native_function_invocation & static_lambda
  • 736ed52 [CS] Back config from 8.1 and apply heredoc_indentation rule
  • c46e854 [Process] Fix escaping for MSYS on Windows
  • c593135 [Process] Adjust Process mustRun method phpdoc
  • e579464 [Process] Ignore invalid env var names
  • 8541b73 [Process] Fix dealing with broken stdin pipes
  • 48bad91 Replace __sleep/wakeup() by __(un)serialize() for throwing and internal usages
  • Additional commits viewable in compare view

Updates twig/markdown-extra from 3.7.1 to 3.28.0

Release notes

Sourced from twig/markdown-extra's releases.

v3.28.0

Changelog (twigphp/markdown-extra@v3.26.0...v3.28.0)

  • bug #4835 Fix markdown_to_html mangling content that starts with a blank line (@​fabpot)

v3.26.0

Changelog (twigphp/markdown-extra@v3.22.0...v3.26.0)

v3.24.0

Changelog (twigphp/markdown-extra@v3.23.0...v3.24.0)

  • no significant changes

v3.23.0

No release notes provided.

Commits
  • 5f7b27e Fix markdown_to_html mangling content that starts with a blank line
  • e3f3fd0 Fix XSS by adjusting is_safe annotation on HTML-emitting filters
  • 67a1112 Fix CS
  • faf069b Add .gitignore & .gitattributes to all .gitattributes
  • fb6f952 Bump minimum Commonmark requirement
  • 9abd3ef bug #4653 Allow usage of other Markdown converters than CommonMark in LeagueM...
  • eee96e5 CS fixes
  • cd4dca0 Update LeagueMarkdown.php
  • f4616e1 Bump min PHP version to 8.1
  • 6c464fc Fix CS
  • Additional commits viewable in compare view

Updates twig/twig from 3.7.1 to 3.28.0

Release notes

Sourced from twig/twig's releases.

v3.28.0

Changelog (twigphp/Twig@v3.27.1...v3.28.0)

  • bug #4850 Render backed enums using their backing value in the html_attr function (@​fabpot)
  • minor #4845 Add documention note about variable scope of override blocks in { embed ... only } (@​andy-blum)
  • minor #4843 Define macros at the template root in the cache macro fixture (@​fabpot)
  • bug #4841 Fix Markup truthiness in boolean expressions (@​xtrime-ru)
  • bug #4842 Fix a PHP 8.5 chr() deprecation when decoding octal string escapes (@​austinderrick)
  • feature #4292 Introduce a CorrectnessNodeVisitor to validate that templates are semantically correct (@​fabpot)
  • feature #4840 Mark Markup as final (@​fabpot)
  • feature #4838 Allow calling a macro with a dynamic name via the dot operator (@​fabpot)
  • bug #4835 Fix markdown_to_html mangling content that starts with a blank line (@​fabpot)
  • feature #4819 Add an allow-list for tests to the sandbox security policy (@​fabpot)
  • minor #4837 Reduce memory usage of the context restoration compiled at the end of for loops (@​fabpot)
  • feature #4816 Add an always_allowed_in_sandbox flag for filters, functions, and tags (@​fabpot)
  • feature #4834 Track the source offset of each token and expose it in syntax errors (@​fabpot)
  • minor #4836 Document how to customize the markdown_to_html converter (@​fabpot)
  • minor #4662 CoreExtension::getAttribute: small improvement regarding getter/isser/hasser (@​gharlan)
  • bug #4825 Make the include() function return a Markup object (@​fabpot)
  • bug #4830 Fix nested block() resolution when a directly rendered block calls parent() (@​fabpot)
  • minor #4827 Document {#--#} as the replacement for the deprecated spaceless filter (@​fabpot)
  • bug #4828 Stop reporting a skipped test in IntegrationTestCase when there is no legacy test to run (@​fabpot)
  • minor #4829 Document storing an enum in a variable to avoid repeating its FQCN (@​fabpot)
  • bug #4824 Cast printed expressions to string so values that cannot be converted to a string (arrays, non-Stringable objects, ...) report a usable stack trace at the print location (@​stof, @​fabpot)
  • feature #4826 Make IntegrationTestCase and NodeTestCase compatible with PHPUnit 11 (@​fabpot)
  • feature #4823 Skip the sandbox __toString check on arguments whose PHP parameter type cannot implicitly coerce to string (@​fabpot)

v3.27.1

Changelog (twigphp/Twig@v3.27.0...v3.27.1)

  • bug #4822 Fix inconsistent array access with a Stringable key (@​fabpot)
  • bug #4821 Preserve IteratorAggregate identity in sandbox __toString walker (@​fabpot)

v3.27.0

Changelog (twigphp/Twig@v3.26.0...v3.27.0)

  • security #558 Fix sandbox filter/tag/function allow-list bypass when sandbox state changes between renders (@​fabpot)
  • security #cve-2026-48805 Fix sandbox bypass in deprecated internal wrappers (@​fabpot)
  • security #552 Fix sandbox __toString policy bypass via dynamic mapping keys (@​fabpot)
  • security #535 Fix sandbox __toString bypasses via Traversable in join/replace filters and the in/not in operators (@​fabpot)
  • security #534 Fix sandbox bypass in the "column" filter under SourcePolicyInterface (@​fabpot)
  • feature #4817 Add a strict mode to SecurityPolicy to opt-in to the 4.0 sandbox behavior for the extends/use tags and the parent/block/attribute functions (@​fabpot)
  • feature #4813 Deprecate the fact that the parent, block, and attribute functions are always allowed in a sandboxed template (@​fabpot)
  • bug #4812 Fix PHP 8.1+ implicit float-to-int deprecation in sandboxed array access (@​fabpot)
  • bug #4807 Escape root profile name in HtmlDumper (@​fabpot)
  • bug #4808 Restrict allowed classes in Profile::unserialize() (@​fabpot)
  • feature #4803 Deprecate the "Twig\Sandbox\SourcePolicyInterface" interface (@​fabpot)

v3.26.0

Changelog (twigphp/Twig@v3.25.0...v3.26.0)

... (truncated)

Changelog

Sourced from twig/twig's changelog.

3.28.0 (2026-07-03)

  • Render backed enums using their backing value in the html_attr function
  • Fix empty Markup values being treated as truthy in and, or, xor, not, ternary, and elvis expressions
  • Fix a PHP 8.5 chr() deprecation when decoding an octal string escape sequence larger than \377 (such as "\777")
  • Mark Twig\Markup as @final; it will be final in Twig 4.0
  • Reduce memory usage and speed up the context restoration compiled at the end of for loops
  • Allow calling a macro with a dynamic name via the dot operator (macros.(name)(args))
  • Report the column number in syntax errors and expose it via Error::getTemplateColumn()
  • Track the source offset of each token and expose it via Token::getOffset()
  • Fix nested block() calls to resolve against the overriding template when a block rendered through block(name, template) calls parent()
  • Deprecate the possibility to use a block tag within a capture node (like set)
  • Deprecate the possibility to use a block tag within a capture node (like set) in child templates
  • Deprecate using a macro, extends, or use tag outside the root of a template
  • Stop reporting a skipped test in IntegrationTestCase when there is no legacy test to run
  • Fix markdown_to_html to strip the indentation shared by all lines instead of mangling content that starts with a blank line
  • Make the IntegrationTestCase and NodeTestCase test helpers compatible with PHPUnit 11
  • Cast printed expressions to string so values that cannot be converted to a string (arrays, non-Stringable objects, ...) report a usable stack trace at the print location
  • Make the include() function return a Markup object so an assigned result is not re-escaped when printed
  • Skip the sandbox __toString check on arguments whose PHP parameter type cannot implicitly coerce to string
  • Document the criteria for marking a callable or tag as always allowed in a sandbox, and the list of built-in tags, filters, and functions that will be always allowed in Twig 4.0
  • Add an always_allowed_in_sandbox option for filters, functions, and tests, and an isAlwaysAllowedInSandbox() method for token parsers, to let authors mark callables and tags that are always allowed in sandbox mode without explicit allow-listing
  • Add an allow-list for tests to Twig\Sandbox\SecurityPolicy, with the safe built-in tests flagged as always allowed so they keep working without allow-listing

3.27.1 (2026-05-30)

  • Fix array access with a Stringable key to coerce the key to string consistently instead of throwing in the optimized path
  • Fix sandbox replacing IteratorAggregate arguments (e.g. Symfony's FormView) by a plain array

3.27.0 (2026-05-27)

  • Add a strict mode to Twig\Sandbox\SecurityPolicy to opt-in to the 4.0 behavior for the extends/use tags and the parent/block/attribute functions, which are otherwise still implicitly allowed in a sandbox
  • Deprecate the fact that the parent, block, and attribute functions are always allowed in a sandboxed template
  • Fix sandbox filter/tag/function allow-list bypass when the sandbox state changed between renders of a cached Template instance
  • Fix PHP 8.1+ implicit float-to-int deprecation triggered by sandboxed ArrayAccess attribute access with a float key
  • Restrict allowed classes in Twig\Profiler\Profile::unserialize() to prevent arbitrary class instantiation
  • Escape root profile name in HtmlDumper
  • Fix sandbox bypass in deprecated internal wrappers twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() (src/Resources/core.php)
  • Deprecate the Twig\Sandbox\SourcePolicyInterface interface with no replacement
  • Fix sandbox bypass in the "column" filter when sandboxing is enabled via SourcePolicyInterface
  • Fix sandbox __toString bypass via Traversable arguments to the join and replace filters (also covers containers that implement both Stringable and Traversable)
  • Fix sandbox __toString bypass via the in and not in operators
  • Prevent a stack overflow in SandboxExtension::ensureToStringAllowed() when a self-referencing iterable is passed to a sandboxed template
  • Add support for any expression as a dynamic mapping key (attribute access, filters, ...)
  • Fix sandbox __toString policy bypass via dynamic mapping keys

3.26.0 (2026-05-20)

  • Document that the sandbox doesn't protect against resource exhaustion
  • Document template_from_string caveats when used in a sandboxed environment

... (truncated)

Commits
  • 597c12e Prepare the 3.28.0 release
  • 6a175a5 bug #4850 Render backed enums using their backing value in the html_attr func...
  • 9323a82 Render backed enums using their backing value in the html_attr function
  • ec0f5d5 Tweak previous merge
  • 4007231 minor #4845 Add documention note about variable scope of override blocks in {...
  • 068a2e6 Add documention note about variable scope of override blocks in {% embed ... ...
  • f6152fe minor #4843 Define macros at the template root in the cache macro fixture (fa...
  • 424d2f1 Define the macro at the template root in the cache macro fixture
  • e3b8e15 Update CHANGELOG
  • 2f202b0 bug #4841 Fix Markup truthiness in boolean expressions (xtrime-ru)
  • Additional commits viewable in compare view

Updates nesbot/carbon from 3.4.0 to 3.8.4

Release notes

Sourced from nesbot/carbon's releases.

3.8.4

Complete commits list: briannesbitt/Carbon@3.8.3...3.8.4

Summary:

  • Validate locale earlier

3.8.3

Complete commits list: briannesbitt/Carbon@3.8.2...3.8.3

Summary:

New Contributors

3.8.2

Complete commits list: briannesbitt/Carbon@3.8.1...3.8.2

Summary:

3.8.1

Complete commits list: briannesbitt/Carbon@3.8.0...3.8.1

Summary:

3.8.0

Complete commits list: briannesbitt/Carbon@3.7.0...3.8.0

Summary:

... (truncated)

Commits

@dependabot
Bump the composer group across 2 directories with 7 updates
5f96820 
Bumps the composer group with 4 updates in the /php/cakephp5 directory: [cakephp/cakephp](https://github.com/cakephp/cakephp), [phpunit/phpunit](https://github.com/sebastianbergmann/phpunit), [composer/composer](https://github.com/composer/composer) and [twig/markdown-extra](https://github.com/twigphp/markdown-extra).
Bumps the composer group with 1 update in the /php/simple directory: [nesbot/carbon](https://github.com/briannesbitt/Carbon).


Updates `cakephp/cakephp` from 5.0.0 to 5.1.7
- [Release notes](https://github.com/cakephp/cakephp/releases)
- [Commits](cakephp/cakephp@5.0.0...5.1.7)

Updates `phpunit/phpunit` from 10.3.5 to 10.5.62
- [Release notes](https://github.com/sebastianbergmann/phpunit/releases)
- [Changelog](https://github.com/sebastianbergmann/phpunit/blob/10.5.62/ChangeLog-10.5.md)
- [Commits](sebastianbergmann/phpunit@10.3.5...10.5.62)

Updates `composer/composer` from 2.6.3 to 2.10.2
- [Release notes](https://github.com/composer/composer/releases)
- [Changelog](https://github.com/composer/composer/blob/main/CHANGELOG.md)
- [Commits](composer/composer@2.6.3...2.10.2)

Updates `symfony/process` from 6.3.4 to 6.4.41
- [Release notes](https://github.com/symfony/process/releases)
- [Changelog](https://github.com/symfony/process/blob/8.2/CHANGELOG.md)
- [Commits](symfony/process@v6.3.4...v6.4.41)

Updates `twig/markdown-extra` from 3.7.1 to 3.28.0
- [Release notes](https://github.com/twigphp/markdown-extra/releases)
- [Commits](twigphp/markdown-extra@v3.7.1...v3.28.0)

Updates `twig/twig` from 3.7.1 to 3.28.0
- [Release notes](https://github.com/twigphp/Twig/releases)
- [Changelog](https://github.com/twigphp/Twig/blob/3.x/CHANGELOG)
- [Commits](twigphp/Twig@v3.7.1...v3.28.0)

Updates `nesbot/carbon` from 3.4.0 to 3.8.4
- [Release notes](https://github.com/briannesbitt/Carbon/releases)
- [Commits](briannesbitt/Carbon@3.4.0...3.8.4)

---
updated-dependencies:
- dependency-name: cakephp/cakephp
  dependency-version: 5.1.7
  dependency-type: direct:production
  dependency-group: composer
- dependency-name: phpunit/phpunit
  dependency-version: 10.5.62
  dependency-type: direct:development
  dependency-group: composer
- dependency-name: composer/composer
  dependency-version: 2.10.2
  dependency-type: indirect
  dependency-group: composer
- dependency-name: symfony/process
  dependency-version: 6.4.41
  dependency-type: indirect
  dependency-group: composer
- dependency-name: twig/markdown-extra
  dependency-version: 3.28.0
  dependency-type: indirect
  dependency-group: composer
- dependency-name: twig/twig
  dependency-version: 3.28.0
  dependency-type: indirect
  dependency-group: composer
- dependency-name: nesbot/carbon
  dependency-version: 3.8.4
  dependency-type: direct:production
  dependency-group: composer
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update Php code labels Jul 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file php Pull requests that update Php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants