vault / twigphp-twig / v3.26.0

twigphp-twig @ v3.26.0

integrity

size: 274.5 KiB
downloaded: 2026-07-04 06:59 UTC
last checked: 2026-07-18 21:05 UTC
overlays: composer
detected: composer twig/twig

source https://github.com/twigphp/Twig · available · github

release notes

Changelog (https://github.com/twigphp/Twig/compare/v3.25.0...v3.26.0)

security #cve-2026-46627 Document that the sandbox doesn't protect against resource exhaustion (@fabpot)
security #cve-2026-46628 Pre-escape HTML input on the spaceless filter (@fabpot)
security #cve-2026-46634 Document template_from_string caveats when used in a sandboxed env (@fabpot)
security #cve-2026-46635 Fix sandbox bypass in the "column" filter (@alexandre-daubois)
security #cve-2026-47732 [Sandbox] Fix __toString() support (@fabpot)
security #cve-2026-47730 [Profiler] Escape template and profile names in HtmlDumper (@nicolas-grekas)
security #cve-2026-46640 Fix sandbox bypass: PHP code injection via _self / import macro reference (@alexandre-daubois, @fabpot)
security #cve-2026-46638 Fix sandbox bypass in the { sandbox } tag when including a preloaded template (@alexandre-daubois)
security #cve-2026-46633 Fix sandbox bypass: PHP code injection via { use } template name (@alexandre-daubois, @fabpot)
security #cve-2026-46629 Fix unbounded memoisation of IntlDateFormatter / NumberFormatter (@alexandre-daubois)
security #cve-2026-46637 Fix XSS and pre-escape input on HTML-emitting filters in the extras (@nicolas-grekas)
security #cve-2026-46639 Fix sandbox bypass in object destructuring assignment (@alexandre-daubois)
security #cve-2026-24425 Fix sandbox bypass: propagate Source to checkArrow for source-policy sandboxing (@fabpot)

download

unix · zip

curl -fL -o v3.26.0.zip https://ratatoskr.space/pkg/twigphp-twig/v3.26.0.zip
                    printf '%s  %s\n' '41922156c4369b26d110e40dfafa70eeae8cb9ad5bbfaa9dc0663177abdb7d13' 'v3.26.0.zip' | sha256sum -c -

windows · zip

$url = "https://ratatoskr.space/pkg/twigphp-twig/v3.26.0.zip"
$out = "v3.26.0.zip"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "41922156c4369b26d110e40dfafa70eeae8cb9ad5bbfaa9dc0663177abdb7d13") { throw "sha256 mismatch" }

unix · tar.gz

curl -fL -o v3.26.0.tar.gz https://ratatoskr.space/pkg/twigphp-twig/v3.26.0.tar.gz
                    printf '%s  %s\n' 'fa99f01521df2e2e12f8e72aa337e9dc0c47620d9dba8dd9972e0a2db4124272' 'v3.26.0.tar.gz' | sha256sum -c -

windows · tar.gz

$url = "https://ratatoskr.space/pkg/twigphp-twig/v3.26.0.tar.gz"
$out = "v3.26.0.tar.gz"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "fa99f01521df2e2e12f8e72aa337e9dc0c47620d9dba8dd9972e0a2db4124272") { throw "sha256 mismatch" }

download via yggdrasil mesh

unix · zip

curl -fL -o v3.26.0.zip http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/twigphp-twig/v3.26.0.zip
                    printf '%s  %s\n' '41922156c4369b26d110e40dfafa70eeae8cb9ad5bbfaa9dc0663177abdb7d13' 'v3.26.0.zip' | sha256sum -c -

windows · zip

$url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/twigphp-twig/v3.26.0.zip"
$out = "v3.26.0.zip"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "41922156c4369b26d110e40dfafa70eeae8cb9ad5bbfaa9dc0663177abdb7d13") { throw "sha256 mismatch" }

unix · tar.gz

curl -fL -o v3.26.0.tar.gz http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/twigphp-twig/v3.26.0.tar.gz
                    printf '%s  %s\n' 'fa99f01521df2e2e12f8e72aa337e9dc0c47620d9dba8dd9972e0a2db4124272' 'v3.26.0.tar.gz' | sha256sum -c -

windows · tar.gz

$url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/twigphp-twig/v3.26.0.tar.gz"
$out = "v3.26.0.tar.gz"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "fa99f01521df2e2e12f8e72aa337e9dc0c47620d9dba8dd9972e0a2db4124272") { throw "sha256 mismatch" }

artifact	format	size	hashes
v3.26.0.zip	zip	279.6 KiB	blake3-24 a7bd5d29b1eedbe918802659e9e6a8b47af8a2354f4c83b9 sha256 41922156c4369b26d110e40dfafa70eeae8cb9ad5bbfaa9dc0663177abdb7d13 sha1 6422c77b43e81f80a1970efe8fa5478ccbe940e8
v3.26.0.tar.gz	tar.gz	126.4 KiB	blake3-24 823a5b59c7fb9394b9e901d12054b90f077a90a3aab0e4f9 sha256 fa99f01521df2e2e12f8e72aa337e9dc0c47620d9dba8dd9972e0a2db4124272 sha1 a7a270dd4e4a01dc8a23cfb659a15ce6f447b65c

install

bazel

http_archive(
    name = "twigphp-twig",
    urls = ["https://ratatoskr.space/pkg/twigphp-twig/v3.26.0.tar.gz"],
    integrity = "sha256-+pnwFSHfLi4S+Ocqozfp3AxHYg2duo3Zly4KLbQSQnI=",
    strip_prefix = "twigphp-twig-v3.26.0",
)

zig

.url = "https://ratatoskr.space/pkg/twigphp-twig/v3.26.0.tar.gz",

composer

composer config repositories.yggvault composer https://ratatoskr.space/pkg
composer require twig/twig:v3.26.0

install via yggdrasil mesh

bazel

http_archive(
    name = "twigphp-twig",
    urls = ["http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/twigphp-twig/v3.26.0.tar.gz"],
    integrity = "sha256-+pnwFSHfLi4S+Ocqozfp3AxHYg2duo3Zly4KLbQSQnI=",
    strip_prefix = "twigphp-twig-v3.26.0",
)

zig

.url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/twigphp-twig/v3.26.0.tar.gz",

composer

composer config secure-http false
composer config repositories.yggvault composer http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg
composer require twig/twig:v3.26.0

← v3.27.0 v4.0.0-alpha1 →