Bump twig/twig from 1.37.1 to 1.38.0

[dependabot[bot]]

Bumps twig/twig from 1.37.1 to 1.38.0.

Changelog

Sourced from twig/twig's changelog.

• 1.38.0 (2019-03-12)

• fixed sandbox security issue (under some circumstances, calling the __toString() method on an object was possible even if not allowed by the security policy)

• fixed batch filter clobbers array keys when fill parameter is used

• added preserveKeys support for the batch filter

• fixed "embed" support when used from "template_from_string"

• added the possibility to pass a TemplateWrapper to Twig\Environment::load()

• improved the performance of the sandbox

• added a spaceless filter

• added max value to the "random" function

• made namespace classes the default classes (PSR-0 ones are aliases now)

• removed duplicated directory separator in FilesystemLoader

• added Twig\Loader\ChainLoader::getLoaders()

• changed internal code to use the namespaced classes as much as possible

Commits

• 754b8df prepared the 1.38.0 release
• 0f3af98 security #2885 Fix security issue in the sandbox (fabpot)
• 5e1a361 removed one usage of Template vs TemplateWrapper
• eac5422 fixed security issue in the sandbox
• 7e30569 bug #2884 Fix "batch filter clobbers array keys when fill parameter is used "...
• 750cb23 fixed batch filter clobbers array keys when fill parameter is used
• ede9a60 added preserveKeys support for the batch filter
• 4eeaf76 bug #2883 Fix "embed" support when used from "template_from_string" (fabpot)
• 9f23f7c removed dead code
• 92a63e0 fixed "embed" support when used from "template_from_string"
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/dshorthouse/SimpleMappr/network/alerts).