* 3.x:
Reuse the template wrapper of an already loaded template
Stop the escaping safe analysis from retaining every analyzed node
Allow to call TemplateWrapper::unwrap() without arguments
Expose the escaping strategy a template was compiled with
Improve macro call performance
Fix IntlExtension inheriting values derived by ICU from a date formatter prototype
Fix array access with a Stringable key on subclasses of ArrayObject and ArrayIterator
Ignore the PHPUnit 10+ cache directory
Cover and document the matches operator throwing on an invalid UTF-8 subject
Report a clear error when a string cannot be split into characters
Deprecate cloning a Twig environment
Report the macro call parentheses deprecation once per call site and name the macro
Bump version
Prepare the 3.29.0 release
Update CHANGELOG
# Conflicts:
# .gitignore
# CHANGELOG
# doc/deprecated.rst
# src/Environment.php
# src/NodeVisitor/CorrectnessNodeVisitor.php
# src/NodeVisitor/SafeAnalysisNodeVisitor.php
# src/Template.php
# tests/Fixtures/macros/call_without_parentheses.legacy.test
# tests/ParserTest.php
# tests/TemplateTest.php
# tests/TwigMacroTest.php
* 3.x: (23 commits)
Bump version
Prepare the 3.26.0 release
Update CHANGELOG
Document that the sandbox doesn't protect against resource exhaustion
Document template_from_string caveats when used in a sandboxed env
Pre-escape HTML input on the `spaceless` filter
Add docs on Markup about the goal of this class in the context of a sandbox
Fix sandbox bypass in the "column" filter
Fix sandbox `__toString` bypasses
Validate macro name in MacroReferenceExpression constructor
Fix sandbox bypass: PHP code injection via _self / import macro reference
Fix deprecations in tests
Fix sandbox bypass in the `{% sandbox %}` tag when including a preloaded template
Encode single quotes as \x27 in Compiler::string()
Fix sandbox bypass: PHP code injection via {% use %} template name
Fix unbounded memoisation of `IntlDateFormatter` / `NumberFormatter`
Fix deprecation
[Profiler] Escape template and profile names in HtmlDumper
Bump version
Fix sandbox bypass: propagate sandbox state to checkArrow for source-policy sandboxing
...
# Conflicts:
# CHANGELOG
# doc/filters/spaceless.rst
# extra/cssinliner-extra/CssInlinerExtension.php
# extra/inky-extra/InkyExtension.php
# extra/markdown-extra/MarkdownExtension.php
# src/Environment.php
# src/ExpressionParser/Infix/DotExpressionParser.php
# src/Extension/CoreExtension.php
# src/Node/Expression/FilterExpression.php
# src/Node/Expression/FunctionExpression.php
# src/Node/Expression/TestExpression.php
# src/Node/ModuleNode.php
# src/NodeVisitor/SandboxNodeVisitor.php
# src/Resources/core.php
# src/TokenParser/SandboxTokenParser.php
# tests/Extension/SandboxTest.php
Both filters consume HTML on the input side. Adding `pre_escape => 'html'`
makes the autoescaper escape attacker-controlled inputs before the filters
process them, so they are no longer reachable via `{{ user_input|inline_css }}`
or `{{ user_input|inky_to_html }}` without an explicit `|raw`.
The `html_to_markdown` filter emits plain Markdown text, so the
`is_safe` annotation is dropped entirely and autoescape now handles
its output according to the surrounding context.
The `markdown_to_html` and `inline_css` filters emit HTML, not text
safe in every escaping context, so `is_safe => ['all']` produced
unescaped HTML when their output was interpolated into a JS, CSS or
URL context. The annotation is now `is_safe => ['html']`.
* 3.x:
Fix tiny typo in CI workflow label
Fix typo
Fix opcache preload warning for unlinked anonymous class
Bump version
Prepare the 3.22.2 release
Add .gitignore & .gitattributes to all .gitattributes
* 3.x:
Validate the input of CoreExtension::map()
Rename AbstractTest to ProfilerTestCase
Make data providers static
Prepare IntegrationTestCase for static data providers
* 3.x:
Bump version to 3.9.4-DEV
Fix a warning
Use ::class everywhere
Auto-close PRs on subtree-splits
Bump version
Prepare the 3.9.3 release
Update CHANGELOG
Ensure Lexer:: is always initialized
fix: #4033 add missing unwrap call when a TemplateWrapper instance can be present
change extended DI extension class
fix: #4029 when use_yield is true CaptureNode use iterator_to_array preserveKeys argument to false
* 3.x:
Fix CS
Move functions for CoreExtension
Move functions for EscaperExtension
Move functions for StringLoaderExtension
Move functions for DebugExtension
Move functions for MarkdownExtension
Move functions for InkyExtension
Move functions for CssInlinerExtension
Move functions for HtmlExtension
Deprecate internal extension functions in favor of methods on the extension classes
Tweak deprecated docs
Fabien Potencier
Nicolas Grekas
jmsche
Alexander M. Turek
Simon André
Kevin Bond
Christian Flothmann
noniagriconomie