search

TechWilk / rota

Web-based rota management with email reminders.
7 stars 2 forks source link

[Security] Bump twig/twig from 2.6.2 to 2.9.0 #178

Closed dependabot-preview[bot] closed 5 years ago

dependabot-preview[bot] commented 5 years ago

Bumps twig/twig from 2.6.2 to 2.9.0. This update includes security fixes.

Vulnerabilities fixed *Sourced from [The PHP Security Advisories Database](https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/2019-03-12.yaml).* > **Sandbox Information Disclosure** > > Affected versions: <1.38.0; >=2.0.0, <2.7.0
Changelog *Sourced from [twig/twig's changelog](https://github.com/twigphp/Twig/blob/2.x/CHANGELOG).* > * 2.9.0 (2019-04-28) > > * deprecated returning "false" to remove a Node from NodeVisitorInterface::leaveNode() > * allowed Twig\NodeVisitor\NodeVisitorInterface::leaveNode() to return "null" instead of "false" (same meaning) > * deprecated the "filter" tag (use the "apply" tag instead) > * added the "apply" tag as a replacement for the "filter" tag > * allowed Twig\Loader\FilesystemLoader::findTemplate() to return "null" instead of "false" (same meaning) > * added support for "Twig\Markup" instances in the "in" test > * fixed "import" when macros are stored in a template string > * fixed Lexer when using custom options containing the # char > * added template line number to twig_get_attribute() > > * 2.8.1 (2019-04-16) > > * fixed EscaperNodeVisitor > * deprecated passing a 3rd, 4th, and 5th arguments to the Sandbox exception classes > * deprecated Node::setTemplateName() in favor of Node::setSourceContext() > > * 2.8.0 (2019-04-16) > > * added Traversable support for the length filter > * fixed some wrong location in error messages > * made exception creation faster > * made escaping on ternary expressions (?: and ??) more fine-grained > * added the possibility to give a nice name to string templates (template_from_string function) > * fixed the "with" behavior to always include the globals (for consistency with the "include" and "embed" tags) > * fixed "include" with "ignore missing" when an error loading occurs in the included template > * added support for a new whitespace trimming option ({%~ ~%}, {{~ ~}}, {#~ ~#}) > * added the "column" filter > > * 2.7.4 (2019-03-23) > > * fixed variadic support > * fixed CheckToStringNode implementation (broken when a function/filter is variadic) > > * 2.7.3 (2019-03-21) > > * fixed the spaceless filter so that it behaves like the spaceless tag > * fixed BC break on Environment::resolveTemplate() > * allowed Traversable objects to be used in the "with" tag > * allowed Traversable objects to be used in the "with" tag > * allowed Traversable objects to be used in the "with" argument of the "include" and "embed" tags > > * 2.7.2 (2019-03-12) > > * added TemplateWrapper::getTemplateName() > > * 2.7.1 (2019-03-12) > > * fixed class aliases > ... (truncated)
Commits - [`82a1c05`](https://github.com/twigphp/Twig/commit/82a1c055c8ed4c4705023bfd0405f3c74db6e3ae) prepared the 2.9.0 release - [`27a9a4d`](https://github.com/twigphp/Twig/commit/27a9a4d91dfd66875ae1e17296aed5b295f9b639) Merge branch '1.x' into 2.x - [`c35f48f`](https://github.com/twigphp/Twig/commit/c35f48fdc0e1789a452edb71c129032af4fa08d5) minor [#2986](https://github-redirect.dependabot.com/twigphp/Twig/issues/2986) Tweak the docs (fabpot) - [`5ac239c`](https://github.com/twigphp/Twig/commit/5ac239ca4ffdf91a4da2e59c705a5060b3dcdc24) tweaked the doc - [`2e68b5f`](https://github.com/twigphp/Twig/commit/2e68b5fdc4b57860241528b4961cbbb5d3c7a917) feature [#2984](https://github-redirect.dependabot.com/twigphp/Twig/issues/2984) Deprecate returning "false" to remove a Node from NodeVisitorIn... - [`8faef93`](https://github.com/twigphp/Twig/commit/8faef9331b26b68f63eee2503cb6270db7f7869e) deprecated returning "false" to remove a Node from NodeVisitorInterface::leav... - [`11cc08a`](https://github.com/twigphp/Twig/commit/11cc08aa2f7850509530dc667e120239a5b14efc) added missing items in the CHANGELOG - [`aada683`](https://github.com/twigphp/Twig/commit/aada6833ca441b8cc2ae9bf25ecfd5595d9a30c3) Merge branch '1.x' into 2.x - [`bf3781c`](https://github.com/twigphp/Twig/commit/bf3781c9c1fc678110d5f4e5659d0d70c88ee774) feature [#2981](https://github-redirect.dependabot.com/twigphp/Twig/issues/2981) Allow Twig\NodeVisitor\NodeVisitorInterface::leaveNode() to ret... - [`08f57ca`](https://github.com/twigphp/Twig/commit/08f57ca7a863f16118c87040594eb657c006f0a5) minor [#2983](https://github-redirect.dependabot.com/twigphp/Twig/issues/2983) Add Parser typehint (ruudk) - Additional commits viewable in [compare view](https://github.com/twigphp/Twig/compare/v2.6.2...v2.9.0)


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Automerge options (never/patch/minor, and dev/runtime dependencies) - Pull request limits (per update run and/or open at any time) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired) Finally, you can contact us by mentioning @dependabot.
dependabot-preview[bot] commented 5 years ago

Looks like twig/twig is up-to-date now, so this is no longer needed.