This week, Symfony development activity focused on fixing bugs on existing branches: we provided a workaround for a parse_url() bug, updated the wcswidth data in the String component to Unicode 16, and updated ICU data to version 75.1.
AddToAny
Feed items
Twig security release: Possible sandbox bypass
Affected Versions
Twig >1.0.0,<=1.44.7 || >2.0.0,<=2.16.0 || >3.0.0,<=3.11.0 || >=3.12.0,<3.14.0 versions are affected by this security issue.
Even if twig 1.x and 2.x are not maintained anymore, we've released new versions with the security fix.
This issue has been fixed in Twig 1.44.8, 2.16.1, and 3.14.0.
Description
Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.
The security issue happens when all these conditions are met:
A Week of Symfony #923 (2-8 September 2024)
This week, the upcoming Symfony 7.2 version focused on adding compatibility with Twig 4 and updating tests to support PHPUnit 10 and later versions.
A Week of Symfony #922 (26 August - 1 September 2024)
This week, Symfony 5.4.43, 6.4.11, and 7.1.4 maintenance versions were released. Meanwhile, the upcoming Symfony 7.2 version continued tweaking and polishing some of its new features.
Symfony 7.1.4 released
Symfony 7.1.4 has just been released.
Here is the list of the most important changes since 7.1.3:
Symfony 6.4.11 released
Symfony 6.4.11 has just been released.
Here is the list of the most important changes since 6.4.10:
Symfony 5.4.43 released
Symfony 5.4.43 has just been released.
Here is the list of the most important changes since 5.4.42:
A Week of Symfony #921 (19-25 August 2024)
This week, the upcoming Symfony 7.2 version added a feature to render a Twig block with the Template attribute, improved the Serializer with a snake case to camel case name converter, and added support for new operators in the ExpressionLanguage component.
Symfony 7.1 curated new features
Like for 6.4/7.0, I forgot to post the curated list of features for Symfony 7.1. Let's fix this.
As for any other Symfony release, our backward compatibility promise applies and this means that you should be able to upgrade easily to 7.1 without changing anything in your code.
We blogged about the great 7.1 new features. I highly recommend you to read these articles about Symfony 7.1 as they contain the major changes for this new version:
Symfony 6.4/7.0 curated new features
It seems like I forgot to post the curated list of features for Symfony 6.4 and 7.0. Let's fix this.
As for any other Symfony release, our backward compatibility promise applies and this means that you should be able to upgrade easily to 6.4 without changing anything in your code.
We blogged about the great 6.4 new features. I highly recommend you to read these articles about Symfony 6.4 as they contain the major changes for this new version: