FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

build(deps): bump twig/twig from 3.14.0 to 3.14.1 by dependabot[bot] · Pull Request #2304 · simplesamlphp/simplesamlphp · GitHub

/ simplesamlphp Public

build(deps): bump twig/twig from 3.14.0 to 3.14.1 - #2304

Merged
tvdijen merged 1 commit into
masterfrom
dependabot/composer/twig/twig-3.14.1
Nov 6, 2024
ConversationCommits (1)ChecksFiles changed
Merged

build(deps): bump twig/twig from 3.14.0 to 3.14.1#2304
tvdijen merged 1 commit into
masterfrom
dependabot/composer/twig/twig-3.14.1

Conversation

dependabot Bot commented on behalf of github Nov 6, 2024

Copy link
Copy Markdown
Contributor

Bumps twig/twig from 3.14.0 to 3.14.1.

Changelog

Sourced from twig/twig's changelog.

3.14.1 (2024-11-06)

  • [BC BREAK] Fix a security issue in the sandbox mode allowing an attacker to call attributes on Array-like objects They are now checked via the property policy
  • Fix a security issue in the sandbox mode allowing an attacker to be able to call toString() under some circumstances on an object even if the __toString() method is not allowed by the security policy
Commits
  • f405356 Prepare the 3.14.1 release
  • 793e835 Update CHANGELOG
  • 831c148 Sandbox ArrayAccess and do sandbox checks before isset() checks
  • 2bb8c24 Fix sandbox handling for __toString()
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

build(deps): bump twig/twig from 3.14.0 to 3.14.1
b92a2a9 
Bumps [twig/twig](https://github.com/twigphp/Twig) from 3.14.0 to 3.14.1.
- [Changelog](https://github.com/twigphp/Twig/blob/v3.14.1/CHANGELOG)
- [Commits](twigphp/Twig@v3.14.0...v3.14.1)

---
updated-dependencies:
- dependency-name: twig/twig
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update Php code labels Nov 6, 2024
tvdijen merged commit 2a48019 into master Nov 6, 2024
dependabot Bot deleted the dependabot/composer/twig/twig-3.14.1 branch November 6, 2024 20:45
github-actions Bot locked as resolved and limited conversation to collaborators Feb 5, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file php Pull requests that update Php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

Back | FazBrowse Home | New Git URL