php-twig (3.28.0-1) unstable; urgency=medium

  [ Fabien Potencier ]
  * Make IntegrationTestCase and NodeTestCase compatible with PHPUnit 11
  * Skip the string cast in PrintNode when the expression is already a string and add tests
  * Stop reporting a skipped test in IntegrationTestCase when there is no legacy test to run
  * Fix nested block() resolution when a directly rendered block calls parent()
  * Make the include() function return a Markup object
  * Fix markdown_to_html mangling content that starts with a blank line
  * Add an always_allowed_in_sandbox flag for filters, functions, and tags
  * Document the criteria for always-allowed sandbox items and list 4.0 built-ins
  * Add regression tests that always-allowed callables still enforce the sandbox __toString policy on arguments
  * Reduce memory usage of the context restoration compiled at the end of for loops
  * Add an allow-list for tests to the sandbox security policy
  * Allow calling a macro with a dynamic name via the dot operator
  * Mark Markup as final
  * Render backed enums using their backing value in the html_attr function
  * Prepare the 3.28.0 release

  [ Alexander Pankratov ]
  * Fix Markup truthiness in boolean expressions

  [ Derrick Austin ]
  * Fix a PHP 8.5 chr() deprecation when decoding octal string escapes

  [ David Prévot ]
  * Track version 3 for now

 -- David Prévot <taffit@debian.org>  Sat, 01 Aug 2026 18:06:29 -0300

php-twig (3.27.1-1) unstable; urgency=medium

  [ Fabien Potencier ]
  * Preserve IteratorAggregate identity in sandbox __toString walker
  * Fix inconsistent array access with a Stringable key
  * Prepare the 3.27.1 release

 -- David Prévot <taffit@debian.org>  Sun, 31 May 2026 07:50:12 +0200

php-twig (3.27.0-1) unstable; urgency=medium

  [ Fabien Potencier ]
  * Fix sandbox bypass in deprecated internal wrappers [CVE-2026-48805]
  * Fix sandbox bypass in the "column" filter under SourcePolicyInterface
    [CVE-2026-48808]
  * Fix sandbox __toString bypass via Traversable in join/replace filters
  * Fix sandbox `__toString` bypass via the `in` and `not in` operators
    [CVE-2026-48807]
  * Fix sandbox __toString policy bypass via dynamic mapping keys
    [CVE-2026-48806]
  * Fix sandbox filter/tag/function allow-list bypass when sandbox state
    changes between renders [CVE-2026-46636]
  * Prepare the 3.27.0 release

  [ David Prévot ]
  * Add missing space in previous changelog entry

 -- David Prévot <taffit@debian.org>  Wed, 27 May 2026 23:07:15 +0200

php-twig (3.26.0-1) unstable; urgency=medium

  [ Fabien Potencier ]
  * Fix sandbox bypass: propagate sandbox state to checkArrow for source-policy
    sandboxing [CVE-2026-24425]
  * Fix sandbox `__toString` bypasses [CVE-2026-47732]
  * Pre-escape HTML input on the `spaceless` filter [CVE-2026-46628]
  * Document template_from_string caveats when used in a sandboxed env
    [CVE-2026-46634]
  * Document that the sandbox doesn't protect against resource exhaustion
    [CVE-2026-46627]
  * Update CHANGELOG
  * Prepare the 3.26.0 release

  [ Alexandre Daubois ]
  * Fix sandbox bypass in object destructuring assignment [CVE-2026-46639]
  * Fix unbounded memoisation of `IntlDateFormatter` / `NumberFormatter`
    [CVE-2026-46629]
  * Fix sandbox bypass: PHP code injection via {% use %} template name
    [CVE-2026-46633]
  * Fix sandbox bypass in the `{% sandbox %}` tag when including a preloaded
    template [CVE-2026-46638]
  * Fix sandbox bypass: PHP code injection via _self / import macro reference
    [CVE-2026-46640]
  * Fix sandbox bypass in the "column" filter [CVE-2026-46635]

  [ Nicolas Grekas ]
  * Fix XSS by adjusting `is_safe` annotation on HTML-emitting filters
    [CVE-2026-46637]
  * Pre-escape HTML input on `inline_css` and `inky_to_html` filters
  * [Profiler] Escape template and profile names in HtmlDumper [CVE-2026-47730]

  [ David Prévot ]
  * Use full version with RequiresPhp
  * Update standards version to 4.7.4

 -- David Prévot <taffit@debian.org>  Thu, 21 May 2026 07:30:58 +0200

php-twig (3.24.0-1) unstable; urgency=medium

  [ Fabien Potencier ]
  * Add support for renaming variables in object destructuring
  * Deprecate passing a non-AbstractExpression node to Parser::setParent()
  * Deprecate passing non AbstractExpression nodes to MatchesBinary
  * Add getOperatorTokens() to ExpressionParserInterface to separate operator
    token registration from parser identity
  * Prepare the 3.24.0 release

  [ HypeMC ]
  * Support short-circuiting in null-safe operator chains

  [ Matthias Pigulla ]
  * Add `html_attr_relaxed` escaping strategy
  * Add an `html_attr` function to make outputting HTML attributes easier

  [ David Prévot ]
  * Refresh patches
  * Reorder Files paragraphs in debian/copyright by directory depth
  * Upgrade upstream signing key to new packet format

 -- David Prévot <taffit@debian.org>  Thu, 19 Mar 2026 22:10:38 +0100

php-twig (3.23.0-2) unstable; urgency=medium

  * Compatibility with recent PHPUnit (13)

 -- David Prévot <taffit@debian.org>  Sat, 07 Feb 2026 11:55:14 +0100

php-twig (3.23.0-1) unstable; urgency=medium

  [ Fabien Potencier ]
  * Fix spread operator behavior
  * Add === and !== operators
  * Add the = assignment operator
  * Add support for object and mapping destructuring
  * Update CHANGELOG

  [ Ondřej Machulda ]
  * Fix opcache preload warning for unlinked anonymous class

  [ Felds Liscia ]
  * Add null-safe operator

  [ David Prévot ]
  * Convert d/watch to version 5
  * Update build for related path
  * Update Standards-Version to 4.7.3

 -- David Prévot <taffit@debian.org>  Sat, 24 Jan 2026 11:29:15 +0100

php-twig (3.22.2-2) unstable; urgency=medium

  * Source-only upload

 -- David Prévot <taffit@debian.org>  Mon, 15 Dec 2025 09:53:23 +0100

php-twig (3.22.2-1) unstable; urgency=medium

  [ Fabien Potencier ]
  * Update CHANGELOG
  * Prepare the 3.22.2 release

  [ Younes ENNAJI ]
  * [Core] Fix cycle() with non-countable ArrayAccess+Traversable objects

  [ Tac Tacelosky ]
  * use getShareDir as an indicator of Symfony version

  [ Andreas ]
  * Avoid ord deprecation in PHP 8.5

  [ David Prévot ]
  * Revert "Require recent php-symfony-intl for changed tests"

 -- David Prévot <taffit@debian.org>  Sun, 14 Dec 2025 14:22:16 +0100

php-twig (3.22.1-3) unstable; urgency=medium

  * [Intl] Update data to ICU 78.1
  * Require recent php-symfony-intl for changed tests

 -- David Prévot <taffit@debian.org>  Fri, 05 Dec 2025 18:49:10 +0100

php-twig (3.22.1-2) unstable; urgency=medium

  * Source-only upload

 -- David Prévot <taffit@debian.org>  Mon, 17 Nov 2025 08:39:08 +0100

php-twig (3.22.1-1) unstable; urgency=medium

  [ Fabien Potencier ]
  * Prepare the 3.22.1 release

  [ Javier Eguiluz ]
  * Allow Symfony 8 packages in Twig extra packages

  [ Andreas Erhard ]
  * Add caution note for random function usage

 -- David Prévot <taffit@debian.org>  Mon, 17 Nov 2025 08:12:49 +0100

php-twig (3.22.0-2) unstable; urgency=medium

  * Source-only upload for testing migration

 -- David Prévot <taffit@debian.org>  Sat, 01 Nov 2025 09:53:03 +0100

php-twig (3.22.0-1) unstable; urgency=medium

  [ Fabien Potencier ]
  * Fix compatibility layer
  * Update CHANGELOG

  [ Simon André ]
  * Compile 'index' with repr (not string) in EmbedNode

  [ Doeke Norg ]
  * Update configuration keys + allow extra keys for extensions

  [ Vincent Langlet ]
  * Support two words test guard

  [ Nicolas Grekas ]
  * Fix compatibility with Symfony 8
  * Fix accessing arrays with stringable objects as key

  [ Christophe Coevoet ]
  * Avoid errors when failing to guess the template info for an error

  [ David Prévot ]
  * Make phpab tolerant
  * debian/control: Document nocheck flags

 -- David Prévot <taffit@debian.org>  Sat, 01 Nov 2025 09:35:31 +0100

php-twig (3.21.1-3) unstable; urgency=medium

  * Source-only upload for testing migration

 -- David Prévot <taffit@debian.org>  Sun, 21 Sep 2025 13:49:13 +0200

php-twig (3.21.1-2) unstable; urgency=medium

  * Upload to unstable now that trixie has been released
  * PHPunit 12 compatibility: additional fixes
  * Remove Rules-Requires-Root
  * Fix intl test

 -- David Prévot <taffit@debian.org>  Fri, 19 Sep 2025 11:59:25 +0200

php-twig (3.21.1-1) experimental; urgency=medium

  * Upload to experimental during the freeze

  [ Fabien Potencier ]
  * Introduce operator classes to describe operators provided by extensions
    instead of arrays
  * Fix testing and expression when it evaluates to an instance of Markup
  * Prepare the 3.21.1 release

  [ Jérôme Tamarelle ]
  * Create attributes `AsTwigFilter`, `AsTwigFunction` and `AsTwigTest` to
    ease extension development

  [ David Prévot ]
  * Update Standards-Version to 4.7.2

 -- David Prévot <taffit@debian.org>  Sat, 03 May 2025 23:07:16 +0200

php-twig (3.20.0-2) unstable; urgency=medium

  * Restore autoload template building
  * Use php-parsedown 1 for tests

 -- David Prévot <taffit@debian.org>  Wed, 19 Feb 2025 07:20:19 +0100

php-twig (3.20.0-1) unstable; urgency=medium

  * Source-only upload for testing migration

 -- David Prévot <taffit@debian.org>  Sat, 15 Feb 2025 16:18:25 +0100

php-twig (3.20.0-1~bootstrap) unstable; urgency=medium

  [ Doeke Norg ]
  * Added configuration for commonmark use in twig-extra-bundle.

  [ Fabien Potencier ]
  * Bump min PHP version to 8.1
  * Prepare the 3.20.0 release

  [ Christophe Coevoet ]
  * Add support for registered undefined element callbacks in tests
  * Fix support for ignoring syntax erros in an undefined handler in guard

  [ PrinsFrank ]
  * Fix timezone conversion on strings

  [ David Prévot ]
  * Compatibility with recent PHPUnit (12)

 -- David Prévot <taffit@debian.org>  Sat, 15 Feb 2025 15:55:48 +0100

php-twig (3.19.0-1) unstable; urgency=medium

  * Source-only upload for testing migration

 -- David Prévot <taffit@debian.org>  Wed, 29 Jan 2025 23:32:18 +0100

php-twig (3.19.0-1~bootstrap) unstable; urgency=medium

  [ Fabien Potencier ]
  * Make {} optional for the types tag
  * Fix constant() behavior when used with ??
  * Deprecate Twig\ExpressionParser::parseOnlyArguments() and
    Twig\ExpressionParser::parseArguments()
  * Add ForElseNode
  * Deprecate Token::getType()
  * [SECURITY] Fix a security issue where escaping was missing when using ??
    [CVE-2025-24374]
  * Prepare the 3.19.0 release

  [ Jérôme Tamarelle ]
  * Add `LastModifiedExtensionInterface` and implementation in
    `AbstractExtension` to track modification of runtime classes

  [ Lorenz ]
  * invoke filter

  [ Nicolas Grekas ]
  * Ignore static properties when using the dot operator

  [ David Prévot ]
  * Drop versioned dependency for autopkgtest

 -- David Prévot <taffit@debian.org>  Wed, 29 Jan 2025 18:59:21 +0100

php-twig (3.18.0-7) unstable; urgency=medium

  * Expect recent PHPUnit for debci

 -- David Prévot <taffit@debian.org>  Wed, 15 Jan 2025 09:25:20 +0100

php-twig (3.18.0-6) unstable; urgency=medium

  * Source-only upload for testing migration

 -- David Prévot <taffit@debian.org>  Mon, 13 Jan 2025 08:01:46 +0100

php-twig (3.18.0-5) unstable; urgency=medium

  * arch:all upload for bootstrapping

 -- David Prévot <taffit@debian.org>  Sun, 12 Jan 2025 22:22:23 +0100

php-twig (3.18.0-4) unstable; urgency=medium

  * Compatibility with PHPUnit 11 (Closes: #1039841)

 -- David Prévot <taffit@debian.org>  Sun, 12 Jan 2025 12:56:00 +0100

php-twig (3.18.0-3) unstable; urgency=medium

  * Drop listeners from phpunit.xml (Closes: #1039841)

 -- David Prévot <taffit@debian.org>  Sat, 11 Jan 2025 14:17:29 +0100

php-twig (3.18.0-2) unstable; urgency=medium

  * Source-only upload for testing migration

 -- David Prévot <taffit@debian.org>  Wed, 01 Jan 2025 12:50:20 +0100

php-twig (3.18.0-1) unstable; urgency=medium

  [ Fabien Potencier ]
  * Add a way to stream template rendering
  * Ignore exceptions from undefined handlers when using the guard tag
  * Fix unary operator precedence change
  * Prepare the 3.18.0 release

 -- David Prévot <taffit@debian.org>  Wed, 01 Jan 2025 12:21:13 +0100

php-twig (3.17.1-2) unstable; urgency=medium

  * Source-only upload

 -- David Prévot <taffit@debian.org>  Thu, 19 Dec 2024 22:34:40 +0100

php-twig (3.17.1-1) unstable; urgency=medium

  [ Fabien Potencier ]
  * Prepare the 3.17.1 release

  [ Nicolas Grekas ]
  * Add BC break note in CHANGELOG for 3.15

 -- David Prévot <taffit@debian.org>  Thu, 19 Dec 2024 19:11:34 +0100

php-twig (3.15.0-2) unstable; urgency=medium

  * Source-only upload

 -- David Prévot <taffit@debian.org>  Wed, 27 Nov 2024 13:21:41 +0100

php-twig (3.15.0-1) unstable; urgency=medium

  [ Fabien Potencier ]
  * Prepare the 3.15.0 release

  [ David Prévot ]
  * Drop tests related to SpanishInflector

 -- David Prévot <taffit@debian.org>  Thu, 21 Nov 2024 13:32:20 +0100

php-twig (3.14.2-3) unstable; urgency=medium

  * Update expected output
  * Depend on latest symfony for debci

 -- David Prévot <taffit@debian.org>  Sun, 17 Nov 2024 09:43:48 +0100

php-twig (3.14.2-2) unstable; urgency=medium

  * Source-only upload for testing migration
  * Update previous changelog entry to document #1086884.

 -- David Prévot <taffit@debian.org>  Fri, 08 Nov 2024 10:29:34 +0100

php-twig (3.14.2-1) unstable; urgency=medium

  [ Fabien Potencier ]
  * Fix a security issue when an included sandboxed template has been loaded
    before without the sandbox context [CVE-2024-51754] (Closes: #1086884)
  * Prepare the 3.14.2 release

  [ Nicolas Grekas ]
  * Sandbox ArrayAccess and do sandbox checks before isset() checks
    [CVE-2024-51755]

 -- David Prévot <taffit@debian.org>  Fri, 08 Nov 2024 08:01:21 +0100

php-twig (3.14.0-4) unstable; urgency=medium

  * Use installed package even for tests (Closes: #1085000)
  * Force recent symfony for debci

 -- David Prévot <taffit@debian.org>  Sun, 13 Oct 2024 09:20:42 +0100

php-twig (3.14.0-3) unstable; urgency=medium

  * Upload to unstable
  * Update expected test output (Closes: #1084317)

 -- David Prévot <taffit@debian.org>  Thu, 10 Oct 2024 12:00:24 +0100

php-twig (3.14.0-2) experimental; urgency=medium

  * Ship missing CallableArgumentsExtractor.php file

 -- David Prévot <taffit@debian.org>  Sun, 22 Sep 2024 11:56:40 +0200

php-twig (3.14.0-1) experimental; urgency=medium

  [ Fabien Potencier ]
  * Deprecate Environment::mergeGlobals()
  * Add the possibility to reset globals
  * Fix a security issue when an included sandboxed template has been loaded
    before without the sandbox context [CVE-2024-45411] (Closes: #1081561)
  * Prepare the 3.14.0 release

 -- David Prévot <taffit@debian.org>  Sat, 14 Sep 2024 09:40:39 +0200

php-twig (3.13.0-1) experimental; urgency=medium

  [ Fabien Potencier ]
  * Prepare the 3.13.0 release

  [ Jeroen Versteeg ]
  * Add types tag

 -- David Prévot <taffit@debian.org>  Mon, 09 Sep 2024 07:53:45 +0200

php-twig (3.11.0-1) experimental; urgency=medium

  [ Fabien Potencier ]
  * Deprecate CallExpression::compileArguments
  * Add support for yielding from a generator in PrintNode
  * Fix optimizer mode validation in OptimizerNodeVisitor
  * Add the possibility to deprecate attributes and nodes on Node
  * Prepare the 3.11.0 release

  [ Pierre ]
  * Issue #3828: Add sequence and mapping tests

  [ Simon André ]
  * Deprecate NameExpression internal methods
  * Add new "find" filter

  [ Mathieu Santostefano ]
  * feat(string-extra): Add singularize and pluralize filter

  [ sarah-eit ]
  * Add shuffle filter

  [ Quentin D. ]
  * Introduce ChainCache and ReadOnlyFilesystemCache

 -- David Prévot <taffit@debian.org>  Mon, 12 Aug 2024 12:19:27 +0200

php-twig (3.10.3-1) experimental; urgency=medium

  [ Fabien Potencier ]
  * Fix old escaper signature + add docs
  * Prepare the 3.10.3 release

  [ Nicolas Grekas ]
  * Fix parse error in generated code when using CaptureNode

 -- David Prévot <taffit@debian.org>  Thu, 16 May 2024 18:42:12 +0200

php-twig (3.10.1-1) experimental; urgency=medium

  [ Fabien Potencier ]
  * Extract the escaping logic to a runtime
  * Add needs_charset option for filters and functions
  * Make some CoreExtension methods part of the public API
  * Fix EscaperExtension constructor to not change from previous releases
    (will be the same in 4.x as well)
  * Fix constant return type
  * Fix BC break on escaper extension
  * Prepare the 3.10.1 release

  [ Daniel Penning ]
  * synchronize sourceContext

  [ Nicolas Grekas ]
  * Fix capturing output from extensions that still use echo

 -- David Prévot <taffit@debian.org>  Mon, 13 May 2024 08:54:52 +0200

php-twig (3.9.3-1) experimental; urgency=medium

  * Upgrade to experimental since it breaks current phpmyadmin

  [ Fabien Potencier ]
  * Throws proper Twig exception when using cycle on an empty array
  * Add a deprecation notice when using AbstractNodeVisitor
    (deprecated since 2.9)
  * Deprecate passing a Template instance in Environment::resolveTemplate()
    and Template::loadTemplate()
  * Fix compat with PHP 8.4
  * Fix CaptureNode for some use cases
  * Fix usage of display_end hook
  * Prepare the 3.9.3 release

  [ Francesco Sardara ]
  * Add twig_escape_filter_is_safe() as deprecated.

  [ David Prévot ]
  * Drop signature check (latest upstream tag is not GPG-signed)
  * Update Standards-Version to 4.7.0
  * Update autoload build and dependencies

 -- David Prévot <taffit@debian.org>  Fri, 26 Apr 2024 07:48:39 +0200

php-twig (3.8.0-3) unstable; urgency=medium

  * Force system dependencies loading

 -- David Prévot <taffit@debian.org>  Wed, 06 Mar 2024 12:10:24 +0100

php-twig (3.8.0-2) unstable; urgency=medium

  * Skip failing test without composer install

 -- David Prévot <taffit@debian.org>  Mon, 08 Jan 2024 22:52:03 +0100

php-twig (3.8.0-1) unstable; urgency=medium

  [ Fabien Potencier ]
  * Prepare the 3.8.0 release

  [ Christian Flothmann ]
  * allow Symfony 7 packages to be installed
  * restore return type annotations

  [ Jérôme Tamarelle ]
  * Use is_iterable when possible

  [ Michael Bolli ]
  * fix `NumberFormatter::TYPE_CURRENCY` being deprecated in PHP 8.3

  [ Yaakov Saxon ]
  * Fix premature loop exit in Security Policy lookup of allowed
    methods/properties

  [ Jeroen Versteeg ]
  * Fix IntlExtension::formatDateTime use of date formatter prototype

  [ Drew Richards ]
  * Catch errors thrown during template rendering

  [ David Prévot ]
  * Revert "Require recent php-symfony-intl for changed tests"

 -- David Prévot <taffit@debian.org>  Fri, 24 Nov 2023 08:09:13 +0100

php-twig (3.7.1-3) unstable; urgency=medium

  * Require recent php-symfony-intl for changed tests

 -- David Prévot <taffit@debian.org>  Mon, 20 Nov 2023 07:47:02 +0100

php-twig (3.7.1-2) unstable; urgency=medium

  * Fix tests with current Symfony

 -- David Prévot <taffit@debian.org>  Fri, 10 Nov 2023 07:33:55 +0100

php-twig (3.7.1-1) unstable; urgency=medium

  [ Fabien Potencier ]
  * Prepare the 3.7.1 release

  [ David Prévot ]
  * Clean .phpunit.cache/ directory

 -- David Prévot <taffit@debian.org>  Sun, 03 Sep 2023 03:23:36 +0530

php-twig (3.7.0-1) unstable; urgency=medium

  [ Fabien Potencier ]
  * Prepare the 3.7.0 release

  [ Ryan Weaver ]
  * Adding support for the ...spread operator on arrays and hashes

 -- David Prévot <taffit@debian.org>  Thu, 27 Jul 2023 13:58:54 +0200

php-twig (3.6.1-1) unstable; urgency=medium

  * Upload to unstable now that bookworm has been released

  [ Fabien Potencier ]
  * Prepare the 3.6.1 release

  [ Phil E. Taylor ]
  * suppress native return type deprecation msg

 -- David Prévot <taffit@debian.org>  Sat, 10 Jun 2023 08:54:30 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog php-twig`.
