-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 26 May 2026 13:43:06 +0200
Source: php-twig
Architecture: source
Version: 3.26.0-0+deb13u1
Distribution: trixie-security
Urgency: medium
Maintainer: Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>
Changed-By: David Prévot <taffit@debian.org>
Changes:
 php-twig (3.26.0-0+deb13u1) trixie-security; urgency=medium
 .
   [ Fabien Potencier ]
   * Fix sandbox bypass: propagate sandbox state to checkArrow for source-policy
     sandboxing [CVE-2026-24425]
   * Fix sandbox `__toString` bypasses [CVE-2026-47732]
   * Pre-escape HTML input on the `spaceless` filter [CVE-2026-46628]
   * Document template_from_string caveats when used in a sandboxed env
     [CVE-2026-46634]
   * Document that the sandbox doesn't protect against resource exhaustion
     [CVE-2026-46627]
   * Update CHANGELOG
   * Prepare the 3.26.0 release
 .
   [ Alexandre Daubois ]
   * Fix sandbox bypass in object destructuring assignment [CVE-2026-46639]
   * Fix unbounded memoisation of `IntlDateFormatter` / `NumberFormatter`
     [CVE-2026-46629]
   * Fix sandbox bypass: PHP code injection via {% use %} template name
     [CVE-2026-46633]
   * Fix sandbox bypass in the `{% sandbox %}` tag when including a preloaded
     template [CVE-2026-46638]
   * Fix sandbox bypass: PHP code injection via _self / import macro reference
     [CVE-2026-46640]
   * Fix sandbox bypass in the "column" filter [CVE-2026-46635]
 .
   [ Nicolas Grekas ]
   * Fix XSS by adjusting `is_safe` annotation on HTML-emitting filters
     [CVE-2026-46637]
   * Pre-escape HTML input on `inline_css` and `inky_to_html` filters
   * [Profiler] Escape template and profile names in HtmlDumper [CVE-2026-47730]
 .
   [ David Prévot ]
   * Track debian/trixie branch
   * Refresh patches
   * Make phpab tolerant
   * Update build for related path
Checksums-Sha1:
 d52b98609c77ecf69345026e0909c36322755c46 2943 php-twig_3.26.0-0+deb13u1.dsc
 6cd8f89400cde9ed7cc3f81117268ae34fada278 288376 php-twig_3.26.0.orig.tar.xz
 894ab5abd008c96ce1c6fd12a66779fefd11c7cc 32084 php-twig_3.26.0-0+deb13u1.debian.tar.xz
 dacb83629892cdb0b97588f440e852b9b1491c9e 13673 php-twig_3.26.0-0+deb13u1_amd64.buildinfo
Checksums-Sha256:
 47d313ffea0b06a07cca4a8295d4be5b2b95f19a884a08a228c542a3abe5325f 2943 php-twig_3.26.0-0+deb13u1.dsc
 27ebc728697a9dced0566d9a48241925f162c363ae53b0403834501eeab89022 288376 php-twig_3.26.0.orig.tar.xz
 360b00cc90235d14300fee9ff4f5ce430c5562bcaa0105f6a19354e2175b0135 32084 php-twig_3.26.0-0+deb13u1.debian.tar.xz
 5ff91c29033cd74c655a62f956046b4546383c3d5b5ae441bd01669464406e95 13673 php-twig_3.26.0-0+deb13u1_amd64.buildinfo
Files:
 d2140137cd5eb6e1a2214b406db55e04 2943 php optional php-twig_3.26.0-0+deb13u1.dsc
 7abc94787ed54cc96c3f91ece4b7a473 288376 php optional php-twig_3.26.0.orig.tar.xz
 cf30df8d941e0b78a2c5230fd74955e1 32084 php optional php-twig_3.26.0-0+deb13u1.debian.tar.xz
 71122998fac9086dc840be3fc675410d 13673 php optional php-twig_3.26.0-0+deb13u1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQFGBAEBCgAwFiEEeHVNB7wJXHRI941mBYwc+UT2vTwFAmoWw2ISHHRhZmZpdEBk
ZWJpYW4ub3JnAAoJEAWMHPlE9r08wDkH/A/R+57zn9HpYd2L3aNuHURlPEZMC4bg
Nv8NH3bzbcsROCvdHDwFwEovv+HKcY8LBxKLQ+nt3ocnjkAFYEa5Zu+ZFHljMPWg
YtI9iHbcCwC3IdQDFhfpnZQP8B9HjcTyAi/zsHbJIO3l+MASiXvjQoijJwDheX33
r4+YTSm/BuCD6DftSTikcRlfBSPrBORmYyJDsPmvixaVj+0cfgxZ3080BoRd/8ln
8y6yvdRGSIgZgTpdOiDq6COquO8daCQzaWYoV2VKMhlQuMsp8Pe4DIniR+CoHfYk
L6bs1N2r12ivma9NlSoogiyZnsuYao3FlWRquCwuQ3TAqlMTZvkA3WU=
=L/+J
-----END PGP SIGNATURE-----