build(deps-dev): bump twig/twig from 3.28.0 to 3.29.0

[dependabot]

Bumps twig/twig from 3.28.0 to 3.29.0.

Release notes

Sourced from twig/twig's releases.

v3.29.0

Changelog (twigphp/Twig@v3.28.0...v3.29.0)

• feature #4910 Reject template wrappers from another environment (@​fabpot)
• bug #4927 Report a clear error when using macros imported in a template body that was not rendered (@​fabpot)
• feature #4926 Allow block chains to be composed of other block chains (@​fabpot)
• feature #4925 Resolve block chains against the render context (@​fabpot)
• bug #4924 Resolve constant parent templates once instead of on every lookup (@​fabpot)
• bug #4923 Fix wrapping the Twig cache pool in a second tag aware adapter (@​nicolas-grekas)
• feature #4917 Template runtime and block composition (@​fabpot)
• bug #4918 Check that the use tag is allowed before resolving trait templates (@​fabpot)
• bug #4922 Wrap dynamic parent expression errors (@​fabpot)
• bug #4921 Fix TemplateWrapper::hasBlock() and TemplateWrapper::getBlockNames() omitting environment globals (@​fabpot)
• bug #4916 Fix html_attr dropping style declarations whose value is zero (@​dylanpulver)
• bug #4915 Fix the default filter fallback reusing a null-safe temporary variable (@​lazerg, @​fabpot)
• minor #4908 Remove the documentation comments compilation overhead (@​fabpot)
• minor #4904 Release destructuring temporaries after assignment (@​fabpot)
• bug #4909 Report regular expression errors from the matches operator (@​fabpot)
• bug #4906 Deprecate prefixed macro definedness checks (@​fabpot)
• bug #4907 Fix duplicate macro deprecation wording (@​fabpot)
• bug #4905 Throw when list formatting fails (@​fabpot)
• feature #4902 Remove lazy macro import resolution (@​fabpot)
• bug #4900 Honor date formatter prototype calendars (@​fabpot)
• bug #4899 Fix Stringable keys for ArrayAccess implementations (@​fabpot)
• bug #4901 Evaluate object destructuring expressions once (@​fabpot)
• bug #4896 Restore void return type compatibility for extension points (@​fabpot)
• bug #4898 Reject destructuring patterns containing no variables (@​fabpot)
• feature #4895 Extract htmlAttrValue() from html_attr for standalone attribute rendering (@​Kocal)
• bug #4894 Fix an empty destructuring pattern triggering a PHP fatal error instead of a SyntaxError (@​fabpot)
• feature #4893 Fix array destructuring from a Traversable (@​iliaal, @​fabpot)
• bug #4892 Register the missing extra callables in MissingExtensionSuggestor (@​smnandre)
• bug #4891 Fix the empty comment "{##}" being lexed as a documentation comment opening (@​Amoifr)
• feature #4871 Attach documentation comments to nodes (@​fabpot)
• feature #4434 Add the include_only function (@​fabpot)
• feature #4890 Add support for tempest/markdown in markdown-extra (@​ker0x)
• feature #4881 Nested macro imports (@​fabpot)
• feature #4878 Deprecate using parentheses when testing a macro with the defined test (@​fabpot)
• feature #4851 Redesign macro calls and argument handling (@​fabpot)
• feature #4854 Make the sandbox a first-class citizen with a dedicated Sandbox class (@​fabpot)
• feature #4877 Deprecate macro calls without parentheses (@​fabpot)
• feature #4876 Rename macro variable AST nodes (@​fabpot)
• feature #4874 Normalize destructuring assignment targets (@​fabpot)
• feature #4873 Deprecate duplicate macro definitions (@​fabpot)
• bug #4859 Fix IntlExtension ignoring explicit formats when a date formatter prototype is set (@​fabpot)
• feature #4852 [Intl] Add format_list filter using PHP 8.5's IntlListFormatter (@​BreyndotEchse)
• bug #4856 Fix array access with a Stringable key on ArrayAccess objects using object keys (@​fabpot)
• bug #4853 Throw a SyntaxError instead of a PHP fatal error when a macro argument is defined twice (@​fabpot)

Changelog

Sourced from twig/twig's changelog.

3.29.0 (2026-09-18)

• Fix the PHP warning and cryptic error when a block or a macro rendered on its own uses macros imported in the template body
• Fix {% cache %} always missing in the Symfony bundle when framework.cache.app uses a natively tag aware adapter
• Fix the sandbox resolving use trait templates before checking that the use tag is allowed
• Fix html_attr dropping style declarations whose value is 0, 0.0 or '0'
• Fix the default filter fallback emitting an undefined variable warning when it uses the null-safe operator
• Fix the matches operator silently treating PCRE execution errors as non-matches; it now throws a RuntimeError
• Fix TemplateWrapper::streamBlock(), TemplateWrapper::hasBlock(), and TemplateWrapper::getBlockNames() omitting environment globals
• Fix exceptions from dynamic parent expressions escaping without template context
• Add the BlockChain class to compose blocks from multiple templates without using template internals
• Fix TemplateWrapper::hasBlock() and TemplateWrapper::getBlockNames() losing the extends line when the parent template does not exist
• Fix an output buffer leak when a parent block rendered in an expression throws in non-yield mode
• Add the HtmlExtension::htmlAttrValue() method to resolve a single HTML attribute value the way the html_attr function renders it
• Fix html_attr JSON encoding a Stringable value in a data-* attribute instead of using its string representation
• Add documentation comments to attach metadata to nodes (experimental)
• Fix destructuring patterns containing no variables (empty patterns or sequences with only empty slots) triggering a PHP fatal error instead of a SyntaxError
• Fix object and mapping destructuring evaluating the right-hand expression more than once
• Fix sequence destructuring of iterators throwing a TypeError
• Fix MissingExtensionSuggestor not suggesting the twig/*-extra package to install for some html-extra, intl-extra, and string-extra filters and functions
• Add TempestMarkdown to use tempest/markdown as the markdown_to_html converter
• Add the include_only function to render a template without giving it access to the current context
• Add the Twig\Sandbox\SandboxInterface interface and Twig\Sandbox\Sandbox class to render untrusted templates through a dedicated, always-sandboxed environment crafted for it
• Reject TemplateWrapper instances created by another Environment
• Add the Twig\Extension\SandboxBridgeExtension to render sandboxed templates from trusted templates with an explicit output escaping strategy
• Extract the sandbox runtime enforcement into a new internal Twig\Sandbox\SecurityChecker class used by compiled templates and CoreExtension
• Mark SandboxExtension as internal, use Twig\Sandbox\Sandbox instead
• Deprecate the sandboxed argument of the include function, use Twig\Sandbox\Sandbox instead
• Deprecate SandboxExtension::enableSandbox(), disableSandbox(), and isSandboxedGlobally()
• Normalize destructuring variable AST nodes as assignment targets
• Fix IntlExtension ignoring explicit date/time formats and configured calendars when using a date formatter prototype
• Add a format_list filter to IntlExtension to format a list of strings using PHP 8.5's IntlListFormatter
• Fix array access with a Stringable key for ArrayObject and ArrayIterator while preserving object keys for SplObjectStorage
• Fix duplicated macro argument names triggering a PHP fatal error instead of a SyntaxError
• Deprecate defining a macro more than once in the same template
• Deprecate TemplateVariable and AssignTemplateVariable; use MacroVariable and AssignMacroVariable instead
• Deprecate calling or testing a macro with a name whose case differs from its definition; macro names will be case-sensitive in 4.0
• Deprecate omitting parentheses when calling a macro; it will throw a SyntaxError in 4.0
• Deprecate using parentheses when testing a macro with the defined test; it will throw a SyntaxError in 4.0
• Deprecate calling a macro without a value for an argument that has no default value; the argument will be required in 4.0
• Deprecate passing extra or unknown arguments to a macro that does not declare a variadic argument; it will throw in 4.0
• Add support for declaring an explicit variadic macro argument ({% macro foo(a, ...rest) %})
• Compile macros as closures stored in a per-template registry instead of macro_-prefixed PHP methods
• Represent imported macro namespaces with a narrow capability object instead of template instances
• Mark Twig\Node\MacroNode as @final; it will be final in Twig 4.0
• Deprecate not passing a MacrosNode instance as the macros of a ModuleNode constructor
• Change MacroReferenceExpression to take the bare macro name instead of a macro_-prefixed method name
• Deprecate resolving a macro through a macro_-prefixed name; pass the bare macro name to MacroReferenceExpression

Commits

• 45a3c6e Prepare the 3.29.0 release
• 15207e0 Update CHANGELOG
• dea0483 feature #4910 Reject template wrappers from another environment (fabpot)
• 0f5c902 bug #4927 Report a clear error when using macros imported in a template body ...
• 56e5c07 Clarify the exception message for nested block chains from another environment
• 053200b feature #4926 Allow block chains to be composed of other block chains (fabpot)
• d6b81f9 Allow block chains to be composed of other block chains
• 72c2f66 Report a clear error when using macros imported in a template body that was n...
• 83e8f7e Reject cross-environment template wrappers in block chains
• c1fc112 Reject cross-environment template wrappers
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)