* 3.x: (26 commits)
Remove the documentation comments compilation overhead
Clarify source function trust requirements
Throw on PCRE errors in the matches operator
Document that reusing a non-rewindable iterator after destructuring is unsupported
Release destructuring temporaries after assignment
Deprecate prefixed macro definedness checks
Fix duplicate macro deprecation wording
Throw when list formatting fails
Document that sequence destructuring consumes one value per pattern slot
Fix the html_attr documentation about iterables in data attributes
Warn about untrusted input with the default Tempest markdown converter
Document that overriding MacroNode::compile() is not supported anymore
Merge overlapping CHANGELOG entries for the destructuring fatal error fix
Document that include_only keeps global variables available
Remove lazy macro import resolution
Honor date formatter prototype calendars
Fix Stringable keys for ArrayAccess implementations
Fix repeated object destructuring evaluation
Restore void return type compatibility for extension points
Reject destructuring patterns containing no variables
...
# Conflicts:
# CHANGELOG
# doc/deprecated.rst
# doc/filters/format_datetime.rst
# extra/twig-extra-bundle/DependencyInjection/Compiler/MissingExtensionSuggestorPass.php
# extra/twig-extra-bundle/DependencyInjection/TwigExtraExtension.php
# extra/twig-extra-bundle/TwigExtraBundle.php
# src/MacroNamespace.php
# src/Node/MacrosNode.php
# src/Parser.php
# src/Test/IntegrationTestCase.php
# src/Test/NodeTestCase.php
# tests/CallMacroTest.php
# tests/ExpressionParserTest.php
# tests/Fixtures/macros/duplicate_definition.legacy.test
# tests/Node/MacrosTest.php
# tests/ParserTest.php
This PR was squashed before being merged into the 3.x branch.
Discussion
----------
Honor date formatter prototype calendars
This fixes calendar selection when an `IntlDateFormatter` prototype is configured.
An explicit calendar now takes precedence, followed by the prototype calendar, with Gregorian used as the final fallback. In particular, the `TRADITIONAL` calendar is no longer mistaken for an absent value because its constant value is zero.
Commits
-------
1de0bfceb4 Honor date formatter prototype calendars
* 3.x:
Add support for tempest/markdown in markdown-extra
Add the include_only function to render a template without access to the current context
Clarify duplicate macro deprecation message
Deduplicate template error handling
# Conflicts:
# .gitignore
# CHANGELOG
# extra/markdown-extra/composer.json
# src/Extension/CoreExtension.php
# src/Parser.php
# src/Template.php
# tests/Fixtures/macros/duplicate_definition.legacy.test
* 3.x:
Reuse assignment targets parsed for the for tag
add shadowing example
Update for.rst
Fix IntlExtension ignoring explicit formats when a date formatter prototype is set
bump Twig version metadata
# Conflicts:
# CHANGELOG
# doc/tags/for.rst
# src/Environment.php
# src/TokenParser/ForTokenParser.php
* 3.x:
Exempt test files from the void_return rule regardless of the config location
fix version in deprecation message for tag usage outside of root template
Fix array access with a Stringable key on ArrayAccess objects using object keys
Throw a SyntaxError instead of a PHP fatal error when a macro argument is defined twice
Bump version
Prepare the 3.28.0 release
Render backed enums using their backing value in the html_attr function
Tweak previous merge
Add documention note about variable scope of override blocks in {% embed ... only %}
Define the macro at the template root in the cache macro fixture
Update CHANGELOG
Fix a PHP 8.5 chr() deprecation when decoding octal string escapes
Fix Markup truthiness in boolean expressions
# Conflicts:
# CHANGELOG
# doc/deprecated.rst
# src/Environment.php
# src/Node/Expression/TempNameExpression.php
# src/Node/IfNode.php
# src/Node/MacroNode.php
# src/NodeVisitor/CorrectnessNodeVisitor.php
# tests/Fixtures/tags/inheritance/extends_in_condition.test
# tests/Fixtures/tags/inheritance/use_in_condition.test
# tests/Fixtures/tags/inheritance/use_in_macro.test
# tests/Fixtures/tags/macro/macro_in_block.test
# tests/Fixtures/tags/macro/macro_in_condition.test
* 3.x:
Handle single-node child template bodies in cleanup
Keep captured block definitions supported
Clarify captured block deprecation wording
Simplify correctness visitor checks
Move extends validation into correctness visitor
Fix correctness visitor regressions
Fix test assertions that did not verify the intended behavior
Address review: fix block-nesting checks in CorrectnessNodeVisitor
Move the extends-in-block and extends-in-macro errors into the CorrectnessNodeVisitor
Introduce a CorrectnessNodeVisitor to validate that templates are semantically correct
Mark Markup as final
Allow calling a macro with a dynamic name via the dot operator
Add an allow-list for tests to the sandbox security policy
Fix markdown_to_html mangling content that starts with a blank line
# Conflicts:
# CHANGELOG
# doc/deprecated.rst
# doc/sandbox.rst
# src/ExpressionParser/Infix/DotExpressionParser.php
# src/Extension/CoreExtension.php
# src/Markup.php
# src/Node/CheckSecurityNode.php
# src/Node/Expression/Filter/DefaultFilter.php
# src/Node/Expression/NullCoalesceExpression.php
# src/Node/IfNode.php
# src/NodeVisitor/SandboxNodeVisitor.php
# src/Parser.php
# src/Sandbox/SecurityPolicy.php
# tests/Extension/SandboxTest.php
# tests/ParserTest.php
* 3.x: (23 commits)
Bump version
Prepare the 3.26.0 release
Update CHANGELOG
Document that the sandbox doesn't protect against resource exhaustion
Document template_from_string caveats when used in a sandboxed env
Pre-escape HTML input on the `spaceless` filter
Add docs on Markup about the goal of this class in the context of a sandbox
Fix sandbox bypass in the "column" filter
Fix sandbox `__toString` bypasses
Validate macro name in MacroReferenceExpression constructor
Fix sandbox bypass: PHP code injection via _self / import macro reference
Fix deprecations in tests
Fix sandbox bypass in the `{% sandbox %}` tag when including a preloaded template
Encode single quotes as \x27 in Compiler::string()
Fix sandbox bypass: PHP code injection via {% use %} template name
Fix unbounded memoisation of `IntlDateFormatter` / `NumberFormatter`
Fix deprecation
[Profiler] Escape template and profile names in HtmlDumper
Bump version
Fix sandbox bypass: propagate sandbox state to checkArrow for source-policy sandboxing
...
# Conflicts:
# CHANGELOG
# doc/filters/spaceless.rst
# extra/cssinliner-extra/CssInlinerExtension.php
# extra/inky-extra/InkyExtension.php
# extra/markdown-extra/MarkdownExtension.php
# src/Environment.php
# src/ExpressionParser/Infix/DotExpressionParser.php
# src/Extension/CoreExtension.php
# src/Node/Expression/FilterExpression.php
# src/Node/Expression/FunctionExpression.php
# src/Node/Expression/TestExpression.php
# src/Node/ModuleNode.php
# src/NodeVisitor/SandboxNodeVisitor.php
# src/Resources/core.php
# src/TokenParser/SandboxTokenParser.php
# tests/Extension/SandboxTest.php
Both filters consume HTML on the input side. Adding `pre_escape => 'html'`
makes the autoescaper escape attacker-controlled inputs before the filters
process them, so they are no longer reachable via `{{ user_input|inline_css }}`
or `{{ user_input|inky_to_html }}` without an explicit `|raw`.
The `html_to_markdown` filter emits plain Markdown text, so the
`is_safe` annotation is dropped entirely and autoescape now handles
its output according to the surrounding context.
The `markdown_to_html` and `inline_css` filters emit HTML, not text
safe in every escaping context, so `is_safe => ['all']` produced
unescaped HTML when their output was interpolated into a JS, CSS or
URL context. The annotation is now `is_safe => ['html']`.
* 3.x:
Fix tiny typo in CI workflow label
Fix typo
Fix opcache preload warning for unlinked anonymous class
Bump version
Prepare the 3.22.2 release
Add .gitignore & .gitattributes to all .gitattributes
This PR was merged into the 3.x branch.
Discussion
----------
Add .gitignore & .gitattributes to all .gitattributes
Commits
-------
ff327e4163 Add .gitignore & .gitattributes to all .gitattributes
Fabien Potencier
Hugo Alliaume
Simon André
Romain Monteil
Guillaume
Marvin Feldmann
Alexandre Daubois
Nicolas Grekas
Matthias Pigulla
Felds Liscia
hubert.lenoir
Tac Tacelosky
jmsche
Javier Eguiluz
Younes ENNAJI