fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
league/commonmark (source)	^2.10.0 → ^2.10.3			require	patch
php	^8.5.10 → ^8.5.11			require	patch
symfony/yaml (source)	^8.1.6 → ^8.1.8			require	patch
twig/twig (source)	^3.28.0 → ^3.30.0			require	minor

---

Release Notes

thephpleague/commonmark (league/commonmark)

v2.10.3

Compare Source

Fixed

• Fixed footnote links and backlinks pointing at the wrong anchor when footnote/footnote_id_prefix or footnote/ref_id_prefix contains an uppercase character; the configured prefix is now emitted verbatim in the href as it already was in the matching id (#​524)
• Fixed inline raw HTML tags being escaped when the tag name or an attribute name contains an uppercase letter, such as <svg viewBox="..."> or <Warning> (#​1096)

v2.10.2

Compare Source

This is a security release to address a denial of service vulnerability in the Table extension and a raw HTML filtering bypass in the DisallowedRawHtml extension.

Changed

• Improved performance of parsing table delimiter rows and splitting table rows into cells by scanning bytes directly instead of stepping a Cursor (roughly 4x faster for delimiter rows and 6x for cell splitting, and more on multibyte rows)

Fixed

• Fixed DisallowedRawHtmlRenderer not blocking raw HTML that ends with a disallowed tag name, such as a line containing only <script (GHSA-97jj-33gv-5xf9)
• Fixed quadratic-time parsing of long paragraphs when the Table extension is enabled (GHSA-3q6v-r5mr-hxv8)
• Fixed table detection to match the GFM spec and reference implementation:
  • Header rows no longer require a | character
  • Header rows must now have the same number of cells as the delimiter row (previously, fewer cells were accepted)

v2.10.1

Compare Source

Fixed

• Accept unordered_list_markers config in InlinesOnlyExtension (#​1015, #​1151)

containerbase/php-prebuild (php)

v8.5.11

Compare Source

Bug Fixes

• deps: update dependency php to v8.5.11

symfony/yaml (symfony/yaml)

v8.1.8

Compare Source

Changelog (symfony/yaml@v8.1.6...v8.1.8)

• bug #​66344 Fix tabs in block scalars and comments after empty ones (@​X-Coder264)
• bug #​66340 Fix !!str and !!float tags on block scalars (@​nicolas-grekas)
• bug #​66342 Fix several parsing edge cases (@​nicolas-grekas)
• bug #​66123 Fix the line offset handed to nested block parsers (@​lazerg)

twigphp/Twig (twig/twig)

v3.30.0

Compare Source

• Fix split, random, and shuffle merging a trailing newline into the last character of a string
• Speed up splitting a string into characters in split, random, and shuffle
• Speed up escaping by fetching the escaper runtime once per template
• Speed up adding extensions to an environment
• Fix the escaping safe analysis retaining every compiled template node for the lifetime of the environment
• Speed up loading a template that the environment has already loaded
• Speed up rendering by compiling a cheaper generator guard into templates
• Speed up compiling filter, function, and test calls
• Fix IntlExtension letting the pattern derived from a date formatter prototype override an explicit locale
• Fix IntlExtension not honoring the locale of a date formatter prototype configured with no date and time styles
• Speed up macro calls
• Fix TemplateWrapper::unwrap() failing when called without arguments, which is now deprecated
• Add TemplateWrapper::getDefaultEscapeStrategy() to know the escaping strategy a template was compiled with
• Report a clear error when random, reverse, shuffle, and split receive a string that is not valid UTF-8
• Fix the deprecation about omitting parentheses when calling a macro being reported twice for the same call
• Add the macro name to the deprecation about omitting parentheses when calling a macro
• Deprecate cloning a Twig\Environment instance
• Fix array access with a Stringable key on subclasses of ArrayObject and ArrayIterator

v3.29.0

Compare Source

• Fix the PHP warning and cryptic error when a block or a macro rendered on its own uses macros imported in the template body
• Fix {% cache %} always missing in the Symfony bundle when framework.cache.app uses a natively tag aware adapter
• Fix the sandbox resolving use trait templates before checking that the use tag is allowed
• Fix html_attr dropping style declarations whose value is 0, 0.0 or '0'
• Fix the default filter fallback emitting an undefined variable warning when it uses the null-safe operator
• Fix the matches operator silently treating PCRE execution errors as non-matches; it now throws a RuntimeError
• Fix TemplateWrapper::streamBlock(), TemplateWrapper::hasBlock(), and TemplateWrapper::getBlockNames() omitting environment globals
• Fix exceptions from dynamic parent expressions escaping without template context
• Add the BlockChain class to compose blocks from multiple templates without using template internals
• Fix TemplateWrapper::hasBlock() and TemplateWrapper::getBlockNames() losing the extends line when the parent template does not exist
• Fix an output buffer leak when a parent block rendered in an expression throws in non-yield mode
• Add the HtmlExtension::htmlAttrValue() method to resolve a single HTML attribute value the way the html_attr function renders it
• Fix html_attr JSON encoding a Stringable value in a data-* attribute instead of using its string representation
• Add documentation comments to attach metadata to nodes (experimental)
• Fix destructuring patterns containing no variables (empty patterns or sequences with only empty slots) triggering a PHP fatal error instead of a SyntaxError
• Fix object and mapping destructuring evaluating the right-hand expression more than once
• Fix sequence destructuring of iterators throwing a TypeError
• Fix MissingExtensionSuggestor not suggesting the twig/*-extra package to install for some html-extra, intl-extra, and string-extra filters and functions
• Add TempestMarkdown to use tempest/markdown as the markdown_to_html converter
• Add the include_only function to render a template without giving it access to the current context
• Add the Twig\Sandbox\SandboxInterface interface and Twig\Sandbox\Sandbox class to render untrusted templates through a dedicated, always-sandboxed environment crafted for it
• Reject TemplateWrapper instances created by another Environment
• Add the Twig\Extension\SandboxBridgeExtension to render sandboxed templates from trusted templates with an explicit output escaping strategy
• Extract the sandbox runtime enforcement into a new internal Twig\Sandbox\SecurityChecker class used by compiled templates and CoreExtension
• Mark SandboxExtension as internal, use Twig\Sandbox\Sandbox instead
• Deprecate the sandboxed argument of the include function, use Twig\Sandbox\Sandbox instead
• Deprecate SandboxExtension::enableSandbox(), disableSandbox(), and isSandboxedGlobally()
• Normalize destructuring variable AST nodes as assignment targets
• Fix IntlExtension ignoring explicit date/time formats and configured calendars when using a date formatter prototype
• Add a format_list filter to IntlExtension to format a list of strings using PHP 8.5's IntlListFormatter
• Fix array access with a Stringable key for ArrayObject and ArrayIterator while preserving object keys for SplObjectStorage
• Fix duplicated macro argument names triggering a PHP fatal error instead of a SyntaxError
• Deprecate defining a macro more than once in the same template
• Deprecate TemplateVariable and AssignTemplateVariable; use MacroVariable and AssignMacroVariable instead
• Deprecate calling or testing a macro with a name whose case differs from its definition; macro names will be case-sensitive in 4.0
• Deprecate omitting parentheses when calling a macro; it will throw a SyntaxError in 4.0
• Deprecate using parentheses when testing a macro with the defined test; it will throw a SyntaxError in 4.0
• Deprecate calling a macro without a value for an argument that has no default value; the argument will be required in 4.0
• Deprecate passing extra or unknown arguments to a macro that does not declare a variadic argument; it will throw in 4.0
• Add support for declaring an explicit variadic macro argument ({% macro foo(a, ...rest) %})
• Compile macros as closures stored in a per-template registry instead of macro_-prefixed PHP methods
• Represent imported macro namespaces with a narrow capability object instead of template instances
• Mark Twig\Node\MacroNode as @final; it will be final in Twig 4.0
• Deprecate not passing a MacrosNode instance as the macros of a ModuleNode constructor
• Change MacroReferenceExpression to take the bare macro name instead of a macro_-prefixed method name
• Deprecate resolving a macro through a macro_-prefixed name; pass the bare macro name to MacroReferenceExpression

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.