Skip to content

build(deps): Bump twig/twig from 3.27.1 to 3.29.0 - #104

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/twig/twig-3.29.0
Open

build(deps): Bump twig/twig from 3.27.1 to 3.29.0#104
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/twig/twig-3.29.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 22, 2026

Copy link
Copy Markdown
Contributor

Bumps twig/twig from 3.27.1 to 3.29.0.

Release notes

Sourced from twig/twig's releases.

v3.29.0

Changelog (twigphp/Twig@v3.28.0...v3.29.0)

v3.28.0

Changelog (twigphp/Twig@v3.27.1...v3.28.0)

... (truncated)

Changelog

Sourced from twig/twig's changelog.

3.29.0 (2026-09-18)

  • Fix the PHP warning and cryptic error when a block or a macro rendered on its own uses macros imported in the template body
  • Fix {% cache %} always missing in the Symfony bundle when framework.cache.app uses a natively tag aware adapter
  • Fix the sandbox resolving use trait templates before checking that the use tag is allowed
  • Fix html_attr dropping style declarations whose value is 0, 0.0 or '0'
  • Fix the default filter fallback emitting an undefined variable warning when it uses the null-safe operator
  • Fix the matches operator silently treating PCRE execution errors as non-matches; it now throws a RuntimeError
  • Fix TemplateWrapper::streamBlock(), TemplateWrapper::hasBlock(), and TemplateWrapper::getBlockNames() omitting environment globals
  • Fix exceptions from dynamic parent expressions escaping without template context
  • Add the BlockChain class to compose blocks from multiple templates without using template internals
  • Fix TemplateWrapper::hasBlock() and TemplateWrapper::getBlockNames() losing the extends line when the parent template does not exist
  • Fix an output buffer leak when a parent block rendered in an expression throws in non-yield mode
  • Add the HtmlExtension::htmlAttrValue() method to resolve a single HTML attribute value the way the html_attr function renders it
  • Fix html_attr JSON encoding a Stringable value in a data-* attribute instead of using its string representation
  • Add documentation comments to attach metadata to nodes (experimental)
  • Fix destructuring patterns containing no variables (empty patterns or sequences with only empty slots) triggering a PHP fatal error instead of a SyntaxError
  • Fix object and mapping destructuring evaluating the right-hand expression more than once
  • Fix sequence destructuring of iterators throwing a TypeError
  • Fix MissingExtensionSuggestor not suggesting the twig/*-extra package to install for some html-extra, intl-extra, and string-extra filters and functions
  • Add TempestMarkdown to use tempest/markdown as the markdown_to_html converter
  • Add the include_only function to render a template without giving it access to the current context
  • Add the Twig\Sandbox\SandboxInterface interface and Twig\Sandbox\Sandbox class to render untrusted templates through a dedicated, always-sandboxed environment crafted for it
  • Reject TemplateWrapper instances created by another Environment
  • Add the Twig\Extension\SandboxBridgeExtension to render sandboxed templates from trusted templates with an explicit output escaping strategy
  • Extract the sandbox runtime enforcement into a new internal Twig\Sandbox\SecurityChecker class used by compiled templates and CoreExtension
  • Mark SandboxExtension as internal, use Twig\Sandbox\Sandbox instead
  • Deprecate the sandboxed argument of the include function, use Twig\Sandbox\Sandbox instead
  • Deprecate SandboxExtension::enableSandbox(), disableSandbox(), and isSandboxedGlobally()
  • Normalize destructuring variable AST nodes as assignment targets
  • Fix IntlExtension ignoring explicit date/time formats and configured calendars when using a date formatter prototype
  • Add a format_list filter to IntlExtension to format a list of strings using PHP 8.5's IntlListFormatter
  • Fix array access with a Stringable key for ArrayObject and ArrayIterator while preserving object keys for SplObjectStorage
  • Fix duplicated macro argument names triggering a PHP fatal error instead of a SyntaxError
  • Deprecate defining a macro more than once in the same template
  • Deprecate TemplateVariable and AssignTemplateVariable; use MacroVariable and AssignMacroVariable instead
  • Deprecate calling or testing a macro with a name whose case differs from its definition; macro names will be case-sensitive in 4.0
  • Deprecate omitting parentheses when calling a macro; it will throw a SyntaxError in 4.0
  • Deprecate using parentheses when testing a macro with the defined test; it will throw a SyntaxError in 4.0
  • Deprecate calling a macro without a value for an argument that has no default value; the argument will be required in 4.0
  • Deprecate passing extra or unknown arguments to a macro that does not declare a variadic argument; it will throw in 4.0
  • Add support for declaring an explicit variadic macro argument ({% macro foo(a, ...rest) %})
  • Compile macros as closures stored in a per-template registry instead of macro_-prefixed PHP methods
  • Represent imported macro namespaces with a narrow capability object instead of template instances
  • Mark Twig\Node\MacroNode as @final; it will be final in Twig 4.0
  • Deprecate not passing a MacrosNode instance as the macros of a ModuleNode constructor
  • Change MacroReferenceExpression to take the bare macro name instead of a macro_-prefixed method name
  • Deprecate resolving a macro through a macro_-prefixed name; pass the bare macro name to MacroReferenceExpression

3.28.0 (2026-07-03)

... (truncated)

Commits
  • 45a3c6e Prepare the 3.29.0 release
  • 15207e0 Update CHANGELOG
  • dea0483 feature #4910 Reject template wrappers from another environment (fabpot)
  • 0f5c902 bug #4927 Report a clear error when using macros imported in a template body ...
  • 56e5c07 Clarify the exception message for nested block chains from another environment
  • 053200b feature #4926 Allow block chains to be composed of other block chains (fabpot)
  • d6b81f9 Allow block chains to be composed of other block chains
  • 72c2f66 Report a clear error when using macros imported in a template body that was n...
  • 83e8f7e Reject cross-environment template wrappers in block chains
  • c1fc112 Reject cross-environment template wrappers
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): Bump twig/twig from 3.27.1 to 3.29.0
2e17b75 
Bumps [twig/twig](https://github.com/twigphp/Twig) from 3.27.1 to 3.29.0.
- [Release notes](https://github.com/twigphp/Twig/releases)
- [Changelog](https://github.com/twigphp/Twig/blob/3.x/CHANGELOG)
- [Commits](twigphp/Twig@v3.27.1...v3.29.0)

---
updated-dependencies:
- dependency-name: twig/twig
  dependency-version: 3.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Sep 22, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: main. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 22, 2026
@dependabot
dependabot Bot requested a review from vitormattos as a code owner September 22, 2026 10:43
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 22, 2026
@dependabot dependabot Bot mentioned this pull request Sep 22, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vitormattos vitormattos Awaiting requested review from vitormattos vitormattos is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants