* 3.x:
Add support for tempest/markdown in markdown-extra
Add the include_only function to render a template without access to the current context
Clarify duplicate macro deprecation message
Deduplicate template error handling
# Conflicts:
# .gitignore
# CHANGELOG
# extra/markdown-extra/composer.json
# src/Extension/CoreExtension.php
# src/Parser.php
# src/Template.php
# tests/Fixtures/macros/duplicate_definition.legacy.test
* 3.x:
Handle single-node child template bodies in cleanup
Keep captured block definitions supported
Clarify captured block deprecation wording
Simplify correctness visitor checks
Move extends validation into correctness visitor
Fix correctness visitor regressions
Fix test assertions that did not verify the intended behavior
Address review: fix block-nesting checks in CorrectnessNodeVisitor
Move the extends-in-block and extends-in-macro errors into the CorrectnessNodeVisitor
Introduce a CorrectnessNodeVisitor to validate that templates are semantically correct
Mark Markup as final
Allow calling a macro with a dynamic name via the dot operator
Add an allow-list for tests to the sandbox security policy
Fix markdown_to_html mangling content that starts with a blank line
# Conflicts:
# CHANGELOG
# doc/deprecated.rst
# doc/sandbox.rst
# src/ExpressionParser/Infix/DotExpressionParser.php
# src/Extension/CoreExtension.php
# src/Markup.php
# src/Node/CheckSecurityNode.php
# src/Node/Expression/Filter/DefaultFilter.php
# src/Node/Expression/NullCoalesceExpression.php
# src/Node/IfNode.php
# src/NodeVisitor/SandboxNodeVisitor.php
# src/Parser.php
# src/Sandbox/SecurityPolicy.php
# tests/Extension/SandboxTest.php
# tests/ParserTest.php
* 3.x: (23 commits)
Bump version
Prepare the 3.26.0 release
Update CHANGELOG
Document that the sandbox doesn't protect against resource exhaustion
Document template_from_string caveats when used in a sandboxed env
Pre-escape HTML input on the `spaceless` filter
Add docs on Markup about the goal of this class in the context of a sandbox
Fix sandbox bypass in the "column" filter
Fix sandbox `__toString` bypasses
Validate macro name in MacroReferenceExpression constructor
Fix sandbox bypass: PHP code injection via _self / import macro reference
Fix deprecations in tests
Fix sandbox bypass in the `{% sandbox %}` tag when including a preloaded template
Encode single quotes as \x27 in Compiler::string()
Fix sandbox bypass: PHP code injection via {% use %} template name
Fix unbounded memoisation of `IntlDateFormatter` / `NumberFormatter`
Fix deprecation
[Profiler] Escape template and profile names in HtmlDumper
Bump version
Fix sandbox bypass: propagate sandbox state to checkArrow for source-policy sandboxing
...
# Conflicts:
# CHANGELOG
# doc/filters/spaceless.rst
# extra/cssinliner-extra/CssInlinerExtension.php
# extra/inky-extra/InkyExtension.php
# extra/markdown-extra/MarkdownExtension.php
# src/Environment.php
# src/ExpressionParser/Infix/DotExpressionParser.php
# src/Extension/CoreExtension.php
# src/Node/Expression/FilterExpression.php
# src/Node/Expression/FunctionExpression.php
# src/Node/Expression/TestExpression.php
# src/Node/ModuleNode.php
# src/NodeVisitor/SandboxNodeVisitor.php
# src/Resources/core.php
# src/TokenParser/SandboxTokenParser.php
# tests/Extension/SandboxTest.php
The `html_to_markdown` filter emits plain Markdown text, so the
`is_safe` annotation is dropped entirely and autoescape now handles
its output according to the surrounding context.
The `markdown_to_html` and `inline_css` filters emit HTML, not text
safe in every escaping context, so `is_safe => ['all']` produced
unescaped HTML when their output was interpolated into a JS, CSS or
URL context. The annotation is now `is_safe => ['html']`.
* 3.x:
Fix tiny typo in CI workflow label
Fix typo
Fix opcache preload warning for unlinked anonymous class
Bump version
Prepare the 3.22.2 release
Add .gitignore & .gitattributes to all .gitattributes
* 3.x:
Update CHANGELOG
Fix accessing arrays with stringable objects as key
Update inky_to_html.rst: Updating link
Update replace.rst
[Doc] Tweaks in the escaping article
Compile 'index' with repr (not string) in EmbedNode
Introduce registerUndefinedTestCallback
Fix intl test
Bump minimum Commonmark requirement
Support two words test guard
Bump version
Improve documentation examples for `enum` and `enum_cases`
Avoid errors when failing to guess the template info for an error
Add note to format_datetime explaining how to install required extensions
Fix compatibility layer
This PR was merged into the 3.x branch.
Discussion
----------
Allow usage of other Markdown converters than CommonMark in LeagueMarkdown
Since the `CommonMarkConverter` from `League\CommonMark` doesn't allow customizing the `Environment` class at construct-time, this simple change allows providing an instance the parent class, so we can both inject a config to the converter AND a custom list of extensions (like `CommonMarkCoreExtension`) via the constructor.
This PR fixes#3581
Commits
-------
81e66e96bf Update LeagueMarkdown.php
* 3.x:
Fixing minor typo in Update inline_css.rst
Ignore static properties when using the dot operator
Fix CS
Fix constant() behavior when used with ??
Finish the work
fix indentation
Apply suggestions from code review
typo
fix merge
docs and changelog
typehint instead of checkArrow
checkArrow, typehints
invoke filter
* 3.x:
fix version numbers for deprecations
Require "erusev/parsedown": "dev-master as 1.x-dev"
Support underscores in number literals
Remove deprecate usage of AssignNameExpression in For Node
Update coding standards
* 3.x:
Validate the input of CoreExtension::map()
Rename AbstractTest to ProfilerTestCase
Make data providers static
Prepare IntegrationTestCase for static data providers
This PR was merged into the 3.x branch.
Discussion
----------
Prepare IntegrationTestCase for static data providers
Data providers need to be static in PHPUnit 11. Because of this, I'd like to declare the two methods we use as data providers in `IntegrationTestCase` as static in 4.0. This PR prepares that change:
* The non-static `getFixturesDir()` method is replaced with a static `getFixturesDirectory()`.
* Both methods `getTests()` and `getLegacyTests()` are marked as final, so we can declare them static in the next major.
This however means that we're delaying PHPUnit 11 compatibility of integration tests to Twig 4.0. If that's too late for us, we could deprecate the whole `IntegrationTestCase` in favor of a compatible replacement. That's a bigger change, but I would work on it if you think it's worth it.
Commits
-------
18f42038 Prepare IntegrationTestCase for static data providers
* 3.x:
Bump version to 3.9.4-DEV
Fix a warning
Use ::class everywhere
Auto-close PRs on subtree-splits
Bump version
Prepare the 3.9.3 release
Update CHANGELOG
Ensure Lexer:: is always initialized
fix: #4033 add missing unwrap call when a TemplateWrapper instance can be present
change extended DI extension class
fix: #4029 when use_yield is true CaptureNode use iterator_to_array preserveKeys argument to false
Fabien Potencier
Romain Monteil
Nicolas Grekas
jmsche
Hannes
Alexander M. Turek
Simon André
Kevin Bond