* 3.x:
Skip the sandbox `__toString` check on arguments whose PHP parameter type cannot implicitly coerce to string
Fix CS
Bump version
Prepare the 3.27.1 release
Fix inconsistent array access with a Stringable key
Preserve IteratorAggregate identity in sandbox __toString walker
Fix tests
Bump version
Prepare the 3.27.0 release
Fix sandbox filter/tag/function allow-list bypass when sandbox state changes between renders
Document new support for any expression as a dynamic mapping key
Fix sandbox __toString policy bypass via dynamic mapping keys
Fix deprecation notices in tests
Guard sandbox `__toString` walker against self-referencing iterables
Fix sandbox `__toString` bypass via `Stringable` + `Traversable` containers
Fix sandbox `__toString` bypass via the `in` and `not in` operators
Fix sandbox __toString bypass via Traversable in join/replace filters
Mark new SourcePolicyInterface column filter tests as @group legacy
Fix sandbox bypass in the "column" filter under SourcePolicyInterface
Fix sandbox bypass in deprecated internal wrappers
# Conflicts:
# CHANGELOG
# src/Environment.php
# src/Node/Expression/ArrayExpression.php
# src/Node/Expression/CallExpression.php
# src/Resources/core.php
# src/Template.php
# src/Util/CallableArgumentsExtractor.php
# src/Util/ReflectionCallable.php
# tests/Extension/SandboxTest.php
# tests/Resources/LegacyCoreTest.php
# tests/TemplateTest.php
* 3.x:
Deprecate using Node directly, introduce EmptyNode and Nodes
Add support for inline comments
Update plural.rst: Fixing(?) broken links
Fix CS
Add support for accessing class constants with the dot operator
Fix getting a property on an object casted to an array
Replace strtr() by strtolower()
Improve escape deprecation message
Remove useless assign in compiled code
Add fixture filename as key
Be more precise about double-escaping
Fix template name in error for an unknown dynamic extends called from an include
* 3.x:
[Doc] Document about `html` and `html_attr` strategies
Improve date methods phpdoc
Fix deprecation messages
Use a more precise return type in AbstractTwigCallable
fix the handling of predefined arguments in CallExpression
Allow Twig callable arguments to use camel or snake names
fix intl-extra tests
fix typo
* 3.x:
Improve the way one can deprecate a Twig callable
Bump version
Prepare the 3.14.0 release
Fix a security issue when an included sandboxed template has been loaded before without the sandbox context
Fix test
fix the version mergeGlobals() is deprecated since
Tweak code
Fix CS
Add more tests
Remove unused private methods
Bump version
Guillaume
Fabien Potencier
Nicolas Grekas
Ruud Kamphuis
Alexander M. Turek
Alex Pott