Bump the dependencies group with 3 updates

[dependabot]

Bumps the dependencies group with 3 updates: ramsey/uuid, phpstan/phpstan and twig/twig.

Updates ramsey/uuid from 4.9.3 to 4.9.4

Release notes

Sourced from ramsey/uuid's releases.

4.9.4

Fixed

• Add support for brick/math ^0.19, ^0.20, and ^1.0; fixed in #642.

Full Changelog: ramsey/uuid@4.9.3...4.9.4

Changelog

Sourced from ramsey/uuid's changelog.

4.9.4 - 2026-09-16

Fixed

• Add support for brick/math ^0.19, ^0.20, and ^1.0; fixed in #642.

Commits

• 75d73f4 Prepare release 4.9.4
• 40988c5 Fix: Add support for brick/math:^0.19, brick/math:^0.20, and `brick/math:...
• da5b521 Fix brick/math support (#640)
• See full diff in compare view

Updates phpstan/phpstan from 2.2.13 to 2.2.14

Commits

• See full diff in compare view

Updates twig/twig from 3.28.0 to 3.29.0

Release notes

Sourced from twig/twig's releases.

v3.29.0

Changelog (twigphp/Twig@v3.28.0...v3.29.0)

• feature #4910 Reject template wrappers from another environment (@​fabpot)
• bug #4927 Report a clear error when using macros imported in a template body that was not rendered (@​fabpot)
• feature #4926 Allow block chains to be composed of other block chains (@​fabpot)
• feature #4925 Resolve block chains against the render context (@​fabpot)
• bug #4924 Resolve constant parent templates once instead of on every lookup (@​fabpot)
• bug #4923 Fix wrapping the Twig cache pool in a second tag aware adapter (@​nicolas-grekas)
• feature #4917 Template runtime and block composition (@​fabpot)
• bug #4918 Check that the use tag is allowed before resolving trait templates (@​fabpot)
• bug #4922 Wrap dynamic parent expression errors (@​fabpot)
• bug #4921 Fix TemplateWrapper::hasBlock() and TemplateWrapper::getBlockNames() omitting environment globals (@​fabpot)
• bug #4916 Fix html_attr dropping style declarations whose value is zero (@​dylanpulver)
• bug #4915 Fix the default filter fallback reusing a null-safe temporary variable (@​lazerg, @​fabpot)
• minor #4908 Remove the documentation comments compilation overhead (@​fabpot)
• minor #4904 Release destructuring temporaries after assignment (@​fabpot)
• bug #4909 Report regular expression errors from the matches operator (@​fabpot)
• bug #4906 Deprecate prefixed macro definedness checks (@​fabpot)
• bug #4907 Fix duplicate macro deprecation wording (@​fabpot)
• bug #4905 Throw when list formatting fails (@​fabpot)
• feature #4902 Remove lazy macro import resolution (@​fabpot)
• bug #4900 Honor date formatter prototype calendars (@​fabpot)
• bug #4899 Fix Stringable keys for ArrayAccess implementations (@​fabpot)
• bug #4901 Evaluate object destructuring expressions once (@​fabpot)
• bug #4896 Restore void return type compatibility for extension points (@​fabpot)
• bug #4898 Reject destructuring patterns containing no variables (@​fabpot)
• feature #4895 Extract htmlAttrValue() from html_attr for standalone attribute rendering (@​Kocal)
• bug #4894 Fix an empty destructuring pattern triggering a PHP fatal error instead of a SyntaxError (@​fabpot)
• feature #4893 Fix array destructuring from a Traversable (@​iliaal, @​fabpot)
• bug #4892 Register the missing extra callables in MissingExtensionSuggestor (@​smnandre)
• bug #4891 Fix the empty comment "{##}" being lexed as a documentation comment opening (@​Amoifr)
• feature #4871 Attach documentation comments to nodes (@​fabpot)
• feature #4434 Add the include_only function (@​fabpot)
• feature #4890 Add support for tempest/markdown in markdown-extra (@​ker0x)
• feature #4881 Nested macro imports (@​fabpot)
• feature #4878 Deprecate using parentheses when testing a macro with the defined test (@​fabpot)
• feature #4851 Redesign macro calls and argument handling (@​fabpot)
• feature #4854 Make the sandbox a first-class citizen with a dedicated Sandbox class (@​fabpot)
• feature #4877 Deprecate macro calls without parentheses (@​fabpot)
• feature #4876 Rename macro variable AST nodes (@​fabpot)
• feature #4874 Normalize destructuring assignment targets (@​fabpot)
• feature #4873 Deprecate duplicate macro definitions (@​fabpot)
• bug #4859 Fix IntlExtension ignoring explicit formats when a date formatter prototype is set (@​fabpot)
• feature #4852 [Intl] Add format_list filter using PHP 8.5's IntlListFormatter (@​BreyndotEchse)
• bug #4856 Fix array access with a Stringable key on ArrayAccess objects using object keys (@​fabpot)
• bug #4853 Throw a SyntaxError instead of a PHP fatal error when a macro argument is defined twice (@​fabpot)

Changelog

Sourced from twig/twig's changelog.

3.29.0 (2026-09-18)

• Fix the PHP warning and cryptic error when a block or a macro rendered on its own uses macros imported in the template body
• Fix {% cache %} always missing in the Symfony bundle when framework.cache.app uses a natively tag aware adapter
• Fix the sandbox resolving use trait templates before checking that the use tag is allowed
• Fix html_attr dropping style declarations whose value is 0, 0.0 or '0'
• Fix the default filter fallback emitting an undefined variable warning when it uses the null-safe operator
• Fix the matches operator silently treating PCRE execution errors as non-matches; it now throws a RuntimeError
• Fix TemplateWrapper::streamBlock(), TemplateWrapper::hasBlock(), and TemplateWrapper::getBlockNames() omitting environment globals
• Fix exceptions from dynamic parent expressions escaping without template context
• Add the BlockChain class to compose blocks from multiple templates without using template internals
• Fix TemplateWrapper::hasBlock() and TemplateWrapper::getBlockNames() losing the extends line when the parent template does not exist
• Fix an output buffer leak when a parent block rendered in an expression throws in non-yield mode
• Add the HtmlExtension::htmlAttrValue() method to resolve a single HTML attribute value the way the html_attr function renders it
• Fix html_attr JSON encoding a Stringable value in a data-* attribute instead of using its string representation
• Add documentation comments to attach metadata to nodes (experimental)
• Fix destructuring patterns containing no variables (empty patterns or sequences with only empty slots) triggering a PHP fatal error instead of a SyntaxError
• Fix object and mapping destructuring evaluating the right-hand expression more than once
• Fix sequence destructuring of iterators throwing a TypeError
• Fix MissingExtensionSuggestor not suggesting the twig/*-extra package to install for some html-extra, intl-extra, and string-extra filters and functions
• Add TempestMarkdown to use tempest/markdown as the markdown_to_html converter
• Add the include_only function to render a template without giving it access to the current context
• Add the Twig\Sandbox\SandboxInterface interface and Twig\Sandbox\Sandbox class to render untrusted templates through a dedicated, always-sandboxed environment crafted for it
• Reject TemplateWrapper instances created by another Environment
• Add the Twig\Extension\SandboxBridgeExtension to render sandboxed templates from trusted templates with an explicit output escaping strategy
• Extract the sandbox runtime enforcement into a new internal Twig\Sandbox\SecurityChecker class used by compiled templates and CoreExtension
• Mark SandboxExtension as internal, use Twig\Sandbox\Sandbox instead
• Deprecate the sandboxed argument of the include function, use Twig\Sandbox\Sandbox instead
• Deprecate SandboxExtension::enableSandbox(), disableSandbox(), and isSandboxedGlobally()
• Normalize destructuring variable AST nodes as assignment targets
• Fix IntlExtension ignoring explicit date/time formats and configured calendars when using a date formatter prototype
• Add a format_list filter to IntlExtension to format a list of strings using PHP 8.5's IntlListFormatter
• Fix array access with a Stringable key for ArrayObject and ArrayIterator while preserving object keys for SplObjectStorage
• Fix duplicated macro argument names triggering a PHP fatal error instead of a SyntaxError
• Deprecate defining a macro more than once in the same template
• Deprecate TemplateVariable and AssignTemplateVariable; use MacroVariable and AssignMacroVariable instead
• Deprecate calling or testing a macro with a name whose case differs from its definition; macro names will be case-sensitive in 4.0
• Deprecate omitting parentheses when calling a macro; it will throw a SyntaxError in 4.0
• Deprecate using parentheses when testing a macro with the defined test; it will throw a SyntaxError in 4.0
• Deprecate calling a macro without a value for an argument that has no default value; the argument will be required in 4.0
• Deprecate passing extra or unknown arguments to a macro that does not declare a variadic argument; it will throw in 4.0
• Add support for declaring an explicit variadic macro argument ({% macro foo(a, ...rest) %})
• Compile macros as closures stored in a per-template registry instead of macro_-prefixed PHP methods
• Represent imported macro namespaces with a narrow capability object instead of template instances
• Mark Twig\Node\MacroNode as @final; it will be final in Twig 4.0
• Deprecate not passing a MacrosNode instance as the macros of a ModuleNode constructor
• Change MacroReferenceExpression to take the bare macro name instead of a macro_-prefixed method name
• Deprecate resolving a macro through a macro_-prefixed name; pass the bare macro name to MacroReferenceExpression

Commits

• 45a3c6e Prepare the 3.29.0 release
• 15207e0 Update CHANGELOG
• dea0483 feature #4910 Reject template wrappers from another environment (fabpot)
• 0f5c902 bug #4927 Report a clear error when using macros imported in a template body ...
• 56e5c07 Clarify the exception message for nested block chains from another environment
• 053200b feature #4926 Allow block chains to be composed of other block chains (fabpot)
• d6b81f9 Allow block chains to be composed of other block chains
• 72c2f66 Report a clear error when using macros imported in a template body that was n...
• 83e8f7e Reject cross-environment template wrappers in block chains
• c1fc112 Reject cross-environment template wrappers
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.76%. Comparing base (1718399) to head (5f9a0ca).

Additional details and impacted files

@@            Coverage Diff            @@
##               main    #2048   +/-   ##
=========================================
  Coverage     92.76%   92.76%           
  Complexity     2032     2032           
=========================================
  Files           126      126           
  Lines          7337     7337           
=========================================
  Hits           6806     6806           
  Misses          531      531           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

Try the dev build for this PR: https://acquia-cli.s3.amazonaws.com/build/pr/2048/acli.phar

curl -OL https://acquia-cli.s3.amazonaws.com/build/pr/2048/acli.phar
chmod +x acli.phar