* 3.x: (26 commits)
Remove the documentation comments compilation overhead
Clarify source function trust requirements
Throw on PCRE errors in the matches operator
Document that reusing a non-rewindable iterator after destructuring is unsupported
Release destructuring temporaries after assignment
Deprecate prefixed macro definedness checks
Fix duplicate macro deprecation wording
Throw when list formatting fails
Document that sequence destructuring consumes one value per pattern slot
Fix the html_attr documentation about iterables in data attributes
Warn about untrusted input with the default Tempest markdown converter
Document that overriding MacroNode::compile() is not supported anymore
Merge overlapping CHANGELOG entries for the destructuring fatal error fix
Document that include_only keeps global variables available
Remove lazy macro import resolution
Honor date formatter prototype calendars
Fix Stringable keys for ArrayAccess implementations
Fix repeated object destructuring evaluation
Restore void return type compatibility for extension points
Reject destructuring patterns containing no variables
...
# Conflicts:
# CHANGELOG
# doc/deprecated.rst
# doc/filters/format_datetime.rst
# extra/twig-extra-bundle/DependencyInjection/Compiler/MissingExtensionSuggestorPass.php
# extra/twig-extra-bundle/DependencyInjection/TwigExtraExtension.php
# extra/twig-extra-bundle/TwigExtraBundle.php
# src/MacroNamespace.php
# src/Node/MacrosNode.php
# src/Parser.php
# src/Test/IntegrationTestCase.php
# src/Test/NodeTestCase.php
# tests/CallMacroTest.php
# tests/ExpressionParserTest.php
# tests/Fixtures/macros/duplicate_definition.legacy.test
# tests/Node/MacrosTest.php
# tests/ParserTest.php
Sequence destructuring compiled its right-hand side straight into
array_pad(), which throws "Argument #1 must be of type array" when a
Traversable is provided:
{% do [a, b] = items %}
with an IteratorAggregate/Generator for items crashed with a TypeError.
Coerce Traversables via iterator_to_array() before padding, matching
the behavior of the spread, merge, and slice operations which already
accept Traversables.
* 3.x:
Add support for tempest/markdown in markdown-extra
Add the include_only function to render a template without access to the current context
Clarify duplicate macro deprecation message
Deduplicate template error handling
# Conflicts:
# .gitignore
# CHANGELOG
# extra/markdown-extra/composer.json
# src/Extension/CoreExtension.php
# src/Parser.php
# src/Template.php
# tests/Fixtures/macros/duplicate_definition.legacy.test
* 3.x:
Deprecate using parentheses when testing a macro with the defined test
# Conflicts:
# CHANGELOG
# doc/deprecated.rst
# src/ExpressionParser/Infix/DotExpressionParser.php
# src/ExpressionParser/Infix/FunctionExpressionParser.php
# src/ExpressionParser/Infix/IsExpressionParser.php
# tests/Fixtures/macros/call_without_parentheses.legacy.test
# tests/ParserTest.php
* 3.x:
Make the sandbox a first-class citizen with a dedicated Sandbox class
# Conflicts:
# CHANGELOG
# doc/deprecated.rst
# doc/tags/sandbox.rst
# phpstan-baseline.neon
# src/Extension/CoreExtension.php
# src/Extension/SandboxExtension.php
# src/Sandbox/SecurityPolicy.php
* 3.x:
Exempt test files from the void_return rule regardless of the config location
fix version in deprecation message for tag usage outside of root template
Fix array access with a Stringable key on ArrayAccess objects using object keys
Throw a SyntaxError instead of a PHP fatal error when a macro argument is defined twice
Bump version
Prepare the 3.28.0 release
Render backed enums using their backing value in the html_attr function
Tweak previous merge
Add documention note about variable scope of override blocks in {% embed ... only %}
Define the macro at the template root in the cache macro fixture
Update CHANGELOG
Fix a PHP 8.5 chr() deprecation when decoding octal string escapes
Fix Markup truthiness in boolean expressions
# Conflicts:
# CHANGELOG
# doc/deprecated.rst
# src/Environment.php
# src/Node/Expression/TempNameExpression.php
# src/Node/IfNode.php
# src/Node/MacroNode.php
# src/NodeVisitor/CorrectnessNodeVisitor.php
# tests/Fixtures/tags/inheritance/extends_in_condition.test
# tests/Fixtures/tags/inheritance/use_in_condition.test
# tests/Fixtures/tags/inheritance/use_in_macro.test
# tests/Fixtures/tags/macro/macro_in_block.test
# tests/Fixtures/tags/macro/macro_in_condition.test
* 3.x:
Handle single-node child template bodies in cleanup
Keep captured block definitions supported
Clarify captured block deprecation wording
Simplify correctness visitor checks
Move extends validation into correctness visitor
Fix correctness visitor regressions
Fix test assertions that did not verify the intended behavior
Address review: fix block-nesting checks in CorrectnessNodeVisitor
Move the extends-in-block and extends-in-macro errors into the CorrectnessNodeVisitor
Introduce a CorrectnessNodeVisitor to validate that templates are semantically correct
Mark Markup as final
Allow calling a macro with a dynamic name via the dot operator
Add an allow-list for tests to the sandbox security policy
Fix markdown_to_html mangling content that starts with a blank line
# Conflicts:
# CHANGELOG
# doc/deprecated.rst
# doc/sandbox.rst
# src/ExpressionParser/Infix/DotExpressionParser.php
# src/Extension/CoreExtension.php
# src/Markup.php
# src/Node/CheckSecurityNode.php
# src/Node/Expression/Filter/DefaultFilter.php
# src/Node/Expression/NullCoalesceExpression.php
# src/Node/IfNode.php
# src/NodeVisitor/SandboxNodeVisitor.php
# src/Parser.php
# src/Sandbox/SecurityPolicy.php
# tests/Extension/SandboxTest.php
# tests/ParserTest.php
* 3.x:
Reduce memory usage of the context restoration compiled at the end of for loops
Clarify sandbox always-allowed trust boundary
Bump version to 3.28.0 for the always_allowed_in_sandbox feature
Add regression tests that always-allowed callables still enforce the sandbox __toString policy on arguments
Document the criteria for always-allowed sandbox items and list 4.0 built-ins
Add an always_allowed_in_sandbox flag for filters, functions, and tags
Remove issue references in tests
Avoid allocating a normalized copy when counting newlines without carriage returns
Report columns in syntax errors
Track the source offset of each token
# Conflicts:
# CHANGELOG
# doc/deprecated.rst
# doc/sandbox.rst
# src/Environment.php
# src/Error/Error.php
# src/Lexer.php
# src/Node/ForNode.php
# src/Token.php
# src/TwigCallableInterface.php
# tests/Extension/SandboxTest.php
# tests/Node/ForTest.php
This PR was squashed before being merged into the 3.x branch.
Discussion
----------
Track the source offset of each token and expose it in syntax errors
Commits
-------
3868bac531 Avoid allocating a normalized copy when counting newlines without carriage returns
a82782ac30 Report columns in syntax errors
4943bb405c Track the source offset of each token
* 3.x:
Document how to customize the markdown_to_html converter
Make the include() function return a Markup object
Fix nested block() resolution when a directly rendered block calls parent()
Fix nested block() resolution when a directly rendered block calls parent()
Document storing an enum in a variable to avoid repeating its FQCN
Stop reporting a skipped test in IntegrationTestCase when there is no legacy test to run
Document {#--#} as the replacement for the deprecated spaceless filter
Skip the string cast in PrintNode when the expression is already a string and add tests
Ensure PrintNode is yielding string content
CoreExtension::getAttribute: small improvement regarding getter/isser/hasser
# Conflicts:
# CHANGELOG
# tests/Node/ForTest.php
This PR was merged into the 3.x branch.
Discussion
----------
Fix nested block() resolution when a directly rendered block calls parent()
Closes#3321
Commits
-------
279fe13b22 Fix nested block() resolution when a directly rendered block calls parent()
* 3.x:
Skip the sandbox `__toString` check on arguments whose PHP parameter type cannot implicitly coerce to string
Fix CS
Bump version
Prepare the 3.27.1 release
Fix inconsistent array access with a Stringable key
Preserve IteratorAggregate identity in sandbox __toString walker
Fix tests
Bump version
Prepare the 3.27.0 release
Fix sandbox filter/tag/function allow-list bypass when sandbox state changes between renders
Document new support for any expression as a dynamic mapping key
Fix sandbox __toString policy bypass via dynamic mapping keys
Fix deprecation notices in tests
Guard sandbox `__toString` walker against self-referencing iterables
Fix sandbox `__toString` bypass via `Stringable` + `Traversable` containers
Fix sandbox `__toString` bypass via the `in` and `not in` operators
Fix sandbox __toString bypass via Traversable in join/replace filters
Mark new SourcePolicyInterface column filter tests as @group legacy
Fix sandbox bypass in the "column" filter under SourcePolicyInterface
Fix sandbox bypass in deprecated internal wrappers
# Conflicts:
# CHANGELOG
# src/Environment.php
# src/Node/Expression/ArrayExpression.php
# src/Node/Expression/CallExpression.php
# src/Resources/core.php
# src/Template.php
# src/Util/CallableArgumentsExtractor.php
# src/Util/ReflectionCallable.php
# tests/Extension/SandboxTest.php
# tests/Resources/LegacyCoreTest.php
# tests/TemplateTest.php
Fabien Potencier
Ilia Alshanetsky
Guillaume
Matthieu Lempereur
Alexander Pankratov