Merge branch '3.x' into 4.x

* 3.x:
  Add a strict mode to SecurityPolicy to opt-in to the 4.0 sandbox behavior for the extends/use tags and the parent/block/attribute functions

# Conflicts:
#	CHANGELOG
#	doc/deprecated.rst
#	doc/sandbox.rst
#	src/Sandbox/SecurityPolicy.php
#	tests/Extension/SandboxTest.php

src/Sandbox/SecurityPolicy.php

@@ -79,6 +79,19 @@ final class SecurityPolicy implements SecurityPolicyInterface
         $this->allowedFunctions = $functions;
     }
 
+    /**
+     * Kept as a no-op for forward compatibility with 3.x code bases.
+     *
+     * In 3.x, this method toggled an opt-in to the 4.0 sandbox behavior for the
+     * ``extends`` and ``use`` tags and the ``parent``, ``block``, and ``attribute``
+     * functions. In 4.0 that behavior is the default and cannot be turned off, so
+     * calling this method has no effect; it exists only to let user code run
+     * unmodified on both 3.x and 4.0.
+     */
+    public function setStrict(bool $strict): void
+    {
+    }
+
     public function checkSecurity($tags, $filters, $functions): void
     {
         foreach ($tags as $tag) {

tests/Extension/SandboxTest.php

@@ -963,6 +963,20 @@ EOF
         $this->assertSame('bar', $twig->load('index')->render($params));
     }
 
+    /**
+     * Kept for forward compatibility with 3.x: code calling setStrict() must keep working.
+     */
+    public function testSetStrictIsANoOp()
+    {
+        $policy = new SecurityPolicy([], [], [], [], []);
+        $policy->setStrict(true);
+        $policy->setStrict(false);
+
+        // 4.0 behavior is the default and unaffected by setStrict()
+        $this->expectException(SecurityNotAllowedTagError::class);
+        $policy->checkSecurity(['extends'], [], []);
+    }
+
     protected function getEnvironment($sandboxed, $options, $templates, $tags = [], $filters = [], $methods = [], $properties = [], $functions = [])
     {
         $loader = new ArrayLoader($templates);