build(deps-dev): bump the composer group across 1 directory with 2 updates

[dependabot]

Bumps the composer group with 2 updates in the / directory: squizlabs/php_codesniffer and twig/twig.

Updates squizlabs/php_codesniffer from 3.13.5 to 3.13.6

Release notes

Sourced from squizlabs/php_codesniffer's releases.

3.13.6 - 2026-08-06

This is a security release and all users are advised to update their install(s) as soon as possible.

Changed

• Various housekeeping, including improvements to the tests and documentation.
  • Thanks to Sergei Morozov and Juliette Reinders Folmer for their contributions.

Fixed

• SECURITY FIX: Running PHP_CodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer machine reviewing third-party code, could result in attacker-controlled shell commands being executed when the Gitblame, Hgblame or Svnblame report(s) would process a file whose name contains shell metacharacters. #1473
  • Users using the default Full report, or any of the other non-*blame reports, are not affected.
  • For more details, see the security advisory.
  • Thanks go to Faze-up and Volker Dusch for responsibly disclosing the vulnerability.
  • Additionally, thanks go to Volker Dusch, Rodrigo Primo, Dan Wallis and Juliette Reinders Folmer for creating and testing the fix.

Other

• The GPG signature for the PHAR files has been rotated. The new fingerprint is: 5CB4F778BF9BC4FB67AE511D96E91A992CF22FF4.

---

Statistics

Closed: 0 issues Merged: 46 pull requests

Follow @​phpcs on Mastodon or @​PHP_CodeSniffer on X to stay informed.

Please consider funding the PHP_CodeSniffer project. If you already do so: thank you!

Changelog

Sourced from squizlabs/php_codesniffer's changelog.

[3.13.6] - 2026-08-06

This is a security release and all users are advised to update their install(s) as soon as possible.

Changed

• Various housekeeping, including improvements to the tests and documentation.
  • Thanks to [Sergei Morozov][@​morozov] and [Juliette Reinders Folmer][@​jrfnl] for their contributions.

Fixed

• SECURITY FIX: Running PHP_CodeSniffer over untrusted files, for example, in a CI pipeline that scans pull requests, or on a developer machine reviewing third-party code, could result in attacker-controlled shell commands being executed when the Gitblame, Hgblame or Svnblame report(s) would process a file whose name contains shell metacharacters. #1473
  • Users using the default Full report, or any of the other non-*blame reports, are not affected.
  • For more details, see the security advisory.
  • Thanks go to [Faze-up][@​Faze-up] and [Volker Dusch][@​edorian] for responsibly disclosing the vulnerability.
  • Additionally, thanks go to [Volker Dusch][@​edorian], [Rodrigo Primo][@​rodrigoprimo], [Dan Wallis][@​fredden] and [Juliette Reinders Folmer][@​jrfnl] for creating and testing the fix.

Other

• The GPG signature for the PHAR files has been rotated. The new fingerprint is: 5CB4F778BF9BC4FB67AE511D96E91A992CF22FF4.

#1473: PHPCSStandards/PHP_CodeSniffer#1473

Commits

• 4c378e1 Merge pull request #1474 from PHPCSStandards/feature/changelog-3.13.6
• ddbf849 Merge pull request #1473 from PHPCSStandards/security/cve-2026-67434
• 742a068 Changelog for the 3.13.6 release
• 7a3a6bb Reports/*blame: properly escape file name
• b5ce04f Merge pull request #1470 from PHPCSStandards/dependabot/github_actions/3.x/ac...
• 5f72703 GH Actions: Bump the action-runners group with 2 updates
• 20d0f55 Merge pull request #1466 from PHPCSStandards/dependabot/github_actions/3.x/ac...
• 2a2ac29 Merge pull request #1469 from PHPCSStandards/feature/ghactions-setup-php-fail...
• 6df695f Merge pull request #1467 from PHPCSStandards/dependabot/github_actions/3.x/ac...
• 4da0184 GH Actions: fail "setup-php" if requested tooling could not be installed
• Additional commits viewable in compare view

Updates twig/twig from 3.26.0 to 3.28.0

Release notes

Sourced from twig/twig's releases.

v3.28.0

Changelog (twigphp/Twig@v3.27.1...v3.28.0)

• bug #4850 Render backed enums using their backing value in the html_attr function (@​fabpot)
• minor #4845 Add documention note about variable scope of override blocks in { embed ... only } (@​andy-blum)
• minor #4843 Define macros at the template root in the cache macro fixture (@​fabpot)
• bug #4841 Fix Markup truthiness in boolean expressions (@​xtrime-ru)
• bug #4842 Fix a PHP 8.5 chr() deprecation when decoding octal string escapes (@​austinderrick)
• feature #4292 Introduce a CorrectnessNodeVisitor to validate that templates are semantically correct (@​fabpot)
• feature #4840 Mark Markup as final (@​fabpot)
• feature #4838 Allow calling a macro with a dynamic name via the dot operator (@​fabpot)
• bug #4835 Fix markdown_to_html mangling content that starts with a blank line (@​fabpot)
• feature #4819 Add an allow-list for tests to the sandbox security policy (@​fabpot)
• minor #4837 Reduce memory usage of the context restoration compiled at the end of for loops (@​fabpot)
• feature #4816 Add an always_allowed_in_sandbox flag for filters, functions, and tags (@​fabpot)
• feature #4834 Track the source offset of each token and expose it in syntax errors (@​fabpot)
• minor #4836 Document how to customize the markdown_to_html converter (@​fabpot)
• minor #4662 CoreExtension::getAttribute: small improvement regarding getter/isser/hasser (@​gharlan)
• bug #4825 Make the include() function return a Markup object (@​fabpot)
• bug #4830 Fix nested block() resolution when a directly rendered block calls parent() (@​fabpot)
• minor #4827 Document {#--#} as the replacement for the deprecated spaceless filter (@​fabpot)
• bug #4828 Stop reporting a skipped test in IntegrationTestCase when there is no legacy test to run (@​fabpot)
• minor #4829 Document storing an enum in a variable to avoid repeating its FQCN (@​fabpot)
• bug #4824 Cast printed expressions to string so values that cannot be converted to a string (arrays, non-Stringable objects, ...) report a usable stack trace at the print location (@​stof, @​fabpot)
• feature #4826 Make IntegrationTestCase and NodeTestCase compatible with PHPUnit 11 (@​fabpot)
• feature #4823 Skip the sandbox __toString check on arguments whose PHP parameter type cannot implicitly coerce to string (@​fabpot)

v3.27.1

Changelog (twigphp/Twig@v3.27.0...v3.27.1)

• bug #4822 Fix inconsistent array access with a Stringable key (@​fabpot)
• bug #4821 Preserve IteratorAggregate identity in sandbox __toString walker (@​fabpot)

v3.27.0

Changelog (twigphp/Twig@v3.26.0...v3.27.0)

• security #558 Fix sandbox filter/tag/function allow-list bypass when sandbox state changes between renders (@​fabpot)
• security #cve-2026-48805 Fix sandbox bypass in deprecated internal wrappers (@​fabpot)
• security #552 Fix sandbox __toString policy bypass via dynamic mapping keys (@​fabpot)
• security #535 Fix sandbox __toString bypasses via Traversable in join/replace filters and the in/not in operators (@​fabpot)
• security #534 Fix sandbox bypass in the "column" filter under SourcePolicyInterface (@​fabpot)
• feature #4817 Add a strict mode to SecurityPolicy to opt-in to the 4.0 sandbox behavior for the extends/use tags and the parent/block/attribute functions (@​fabpot)
• feature #4813 Deprecate the fact that the parent, block, and attribute functions are always allowed in a sandboxed template (@​fabpot)
• bug #4812 Fix PHP 8.1+ implicit float-to-int deprecation in sandboxed array access (@​fabpot)
• bug #4807 Escape root profile name in HtmlDumper (@​fabpot)
• bug #4808 Restrict allowed classes in Profile::unserialize() (@​fabpot)
• feature #4803 Deprecate the "Twig\Sandbox\SourcePolicyInterface" interface (@​fabpot)

Changelog

Sourced from twig/twig's changelog.

3.28.0 (2026-07-03)

• Render backed enums using their backing value in the html_attr function
• Fix empty Markup values being treated as truthy in and, or, xor, not, ternary, and elvis expressions
• Fix a PHP 8.5 chr() deprecation when decoding an octal string escape sequence larger than \377 (such as "\777")
• Mark Twig\Markup as @final; it will be final in Twig 4.0
• Reduce memory usage and speed up the context restoration compiled at the end of for loops
• Allow calling a macro with a dynamic name via the dot operator (macros.(name)(args))
• Report the column number in syntax errors and expose it via Error::getTemplateColumn()
• Track the source offset of each token and expose it via Token::getOffset()
• Fix nested block() calls to resolve against the overriding template when a block rendered through block(name, template) calls parent()
• Deprecate the possibility to use a block tag within a capture node (like set)
• Deprecate the possibility to use a block tag within a capture node (like set) in child templates
• Deprecate using a macro, extends, or use tag outside the root of a template
• Stop reporting a skipped test in IntegrationTestCase when there is no legacy test to run
• Fix markdown_to_html to strip the indentation shared by all lines instead of mangling content that starts with a blank line
• Make the IntegrationTestCase and NodeTestCase test helpers compatible with PHPUnit 11
• Cast printed expressions to string so values that cannot be converted to a string (arrays, non-Stringable objects, ...) report a usable stack trace at the print location
• Make the include() function return a Markup object so an assigned result is not re-escaped when printed
• Skip the sandbox __toString check on arguments whose PHP parameter type cannot implicitly coerce to string
• Document the criteria for marking a callable or tag as always allowed in a sandbox, and the list of built-in tags, filters, and functions that will be always allowed in Twig 4.0
• Add an always_allowed_in_sandbox option for filters, functions, and tests, and an isAlwaysAllowedInSandbox() method for token parsers, to let authors mark callables and tags that are always allowed in sandbox mode without explicit allow-listing
• Add an allow-list for tests to Twig\Sandbox\SecurityPolicy, with the safe built-in tests flagged as always allowed so they keep working without allow-listing

3.27.1 (2026-05-30)

• Fix array access with a Stringable key to coerce the key to string consistently instead of throwing in the optimized path
• Fix sandbox replacing IteratorAggregate arguments (e.g. Symfony's FormView) by a plain array

3.27.0 (2026-05-27)

• Add a strict mode to Twig\Sandbox\SecurityPolicy to opt-in to the 4.0 behavior for the extends/use tags and the parent/block/attribute functions, which are otherwise still implicitly allowed in a sandbox
• Deprecate the fact that the parent, block, and attribute functions are always allowed in a sandboxed template
• Fix sandbox filter/tag/function allow-list bypass when the sandbox state changed between renders of a cached Template instance
• Fix PHP 8.1+ implicit float-to-int deprecation triggered by sandboxed ArrayAccess attribute access with a float key
• Restrict allowed classes in Twig\Profiler\Profile::unserialize() to prevent arbitrary class instantiation
• Escape root profile name in HtmlDumper
• Fix sandbox bypass in deprecated internal wrappers twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() (src/Resources/core.php)
• Deprecate the Twig\Sandbox\SourcePolicyInterface interface with no replacement
• Fix sandbox bypass in the "column" filter when sandboxing is enabled via SourcePolicyInterface
• Fix sandbox __toString bypass via Traversable arguments to the join and replace filters (also covers containers that implement both Stringable and Traversable)
• Fix sandbox __toString bypass via the in and not in operators
• Prevent a stack overflow in SandboxExtension::ensureToStringAllowed() when a self-referencing iterable is passed to a sandboxed template
• Add support for any expression as a dynamic mapping key (attribute access, filters, ...)
• Fix sandbox __toString policy bypass via dynamic mapping keys

Commits

• 597c12e Prepare the 3.28.0 release
• 6a175a5 bug #4850 Render backed enums using their backing value in the html_attr func...
• 9323a82 Render backed enums using their backing value in the html_attr function
• ec0f5d5 Tweak previous merge
• 4007231 minor #4845 Add documention note about variable scope of override blocks in {...
• 068a2e6 Add documention note about variable scope of override blocks in {% embed ... ...
• f6152fe minor #4843 Define macros at the template root in the cache macro fixture (fa...
• 424d2f1 Define the macro at the template root in the cache macro fixture
• e3b8e15 Update CHANGELOG
• 2f202b0 bug #4841 Fix Markup truthiness in boolean expressions (xtrime-ru)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.