deps: bump the composer group in /app with 2 updates

[dependabot]

Bumps the composer group in /app with 2 updates: latte/latte and playwright-php/playwright.

Updates latte/latte from 3.1.4 to 3.1.6

Release notes

Sourced from latte/latte's releases.

Released version 3.1.6

A substantial correctness and security release born from a deep audit of the engine. It hardens context-sensitive escaping in two spots, fixes a long list of filter and compiler edge cases, adds the handy |map filter and an afterRender() extension hook, and brings back a performance regression fix. A recommended upgrade for everyone.

💥 Behavior Changes & Deprecations

• {$interval|date} without an explicit format now throws instead of silently printing the literal format string j. n. Y. Pass a format for DateInterval, e.g. {$interval|date: '%d days'}.
• {first}, {last}, {sep} used outside a {foreach} now emit a deprecation warning – they rely on an ambient $iterator that only a loop provides. This becomes a compile-time error in Latte 3.2.

✨ New Features

• New |map filter – transform every item with a callback, the natural partner to |filter: {foreach ($items|map: fn($x) => $x->name) as $name}.
• New Extension::afterRender() hook – called in a finally, so it runs even when rendering ends early via {exitIf} or is interrupted by an exception. Perfect for cleanup or measurement.
• The Tracy panel now shows render time per template, both total and self (excluding nested templates), so you can finally see which template actually eats the time.
• |last, |random, |implode/|join, |commas now accept any iterable, not just arrays – hand them a generator or iterator directly, just like |first, |slice and |filter already allowed.

🐛 Bug Fixes

• Security: <script type=" text/javascript "> with surrounding whitespace was classified as raw text while browsers execute it as JavaScript. The type is now trimmed the way browsers do, so context-sensitive escaping kicks in correctly.
• Security: a template compiled under a permissive sandbox policy could be silently reused from cache under a stricter one, because part of the sandbox is enforced at compile time. Policy rules are now part of the cache key.
• Security: xlink:href in inline SVG is now treated as a URL attribute and sanitized like href.
• {capture $x|filter} no longer double-escapes its content. Adding an innocent filter like |trim used to strip the "HTML-ness" of the captured markup, escaping it on output; captured HTML now stays intact (while a filter that changes the content type still yields a plain string).
• {switch} with no expression used to compile to invalid PHP; it now works as a switch-true idiom ({case $cond}).
• <script type="a{$dyn}"> with a partially dynamic type attribute no longer fails compilation with a cryptic "Unhandled match case" – it's treated as JavaScript.
• The empty comment {**} no longer breaks compilation.
• |reverse and |column no longer drop elements from generators or iterators that yield duplicate keys.
• |indent no longer interprets $ or \ in the indentation string as regular-expression backreferences.
• |explode/|split (and |random) now raise a clear RuntimeException on malformed UTF-8 instead of a confusing TypeError.
• |padLeft/|padRight with an empty pad string, and the divisibleBy() function with a zero divisor, now throw a helpful message instead of a raw DivisionByZeroError.
• Compiled template class names now use a 64-bit hash (up from 40-bit), removing a small but real risk of two templates colliding so that one silently renders the other.
• Custom n:attributes whose name contains tag- or inner- (e.g. n:my-tag-attr) are no longer mangled by the prefix stripper.
• Extensions that subclass core nodes no longer silently break {iterateWhile}, {rollback} and {include parent} – Tag::closestTag() now matches subclasses, as its documentation always promised.
• A compile-time failure without a cache directory now surfaces as a proper CompileException pointing at the generated source, instead of a bare ParseError.

⚡ Performance

• The engine no longer recomputes its entire configuration signature on every {include}, {extends} or {embed} – a memoization lost in the 3.1 cache refactor is restored (and properly invalidated whenever you reconfigure the engine). This also fixes a crash when createTemplate(clearCache: false) was the very first call.
• Passing a parameters object to render() is roughly 2.6× faster – the reflection scan of the parameter class is memoized per class instead of being repeated on every render.

Released version 3.1.5

Template inheritance just got a lot more flexible: layouts can now receive explicit variables, {embed} supports an implicit default block, and blocks finally behave intuitively in places where they used to fail. On top of that, the whitespace minifier behind {spaceless} has been rewritten from scratch to actually understand HTML.

✨ New Features

• {spaceless} rewritten from the ground up – the minifier now truly understands HTML, so it squeezes out much more whitespace without ever breaking your page: it strips whitespace completely around block elements, keeps proper word spacing around inline tags like <i> or <a>, and leaves pre, textarea, script, style and attribute values untouched. And it streams, so even huge templates minify with no memory overhead.
• Implicit default block for {embed} – content written directly inside {embed} without a {block} wrapper now overrides {block default} of the embedded template, while an empty {embed} keeps the fallback (#419)
• {layout file, vars} – pass explicit variables straight to the parent template: {layout 'parent.latte', title: 'Hello'}. They reach the layout only (child blocks don't see them) and override same-named parameters. Works with {extends} too; note the comma before the arguments is required.
• |json attribute modifier – JSON-encode a dynamic HTML attribute value with smart quoting: <div data-config={$config|json}>

🐛 Bug Fixes

• {include parent} and {include this} now work inside dynamically named blocks – previously this was a compile error, or worse, silently bound to an outer static block
• {contentType} inside <script> now really switches the escaping context – previously it was a silent no-op unless the script element had a matching type attribute

... (truncated)

Commits

• adccfac Released version 3.1.6
• f6a6b6a TemplateParserHtml: n:attribute checks the tag parser generator protocol like...
• d9a0927 Tracy: panel shows render time per template, total and self
• 2d0db7a Extension: added afterRender() hook, called in finally
• 4f07dd0 Helpers: resolveParams() memoizes the reflection scan of the params class
• 99a1b7a Engine: template hash extended from 40 to 64 bits
• b596015 Tag::closestTag() matches subclasses, as its phpDoc promises
• 2181bc9 HtmlHelpers: xlink:href in inline SVG is a URL attribute and gets sanitized
• 37d88b6 HtmlHelpers: classifyScriptType() strips ASCII whitespace around MIME type li...
• 707d23d FirstLastSepNode: {first}, {last}, {sep} outside {foreach} triggers a depreca...
• Additional commits viewable in compare view

Updates playwright-php/playwright from 1.2.0 to 1.3.0

Release notes

Sourced from playwright-php/playwright's releases.

v1.3.0

What's Changed

• Make PageInterface::waitForSelector match implementation by @​stloyd in playwright-php/playwright#74
• doc: fix example script location by @​gimler in playwright-php/playwright#77
• Make PlaywrightConfig mandatory by @​stloyd in playwright-php/playwright#72
• Align Page getBy* locators with Playwrights JS API by @​braydend in playwright-php/playwright#76
• Support PSR Log 2.0 in addition to 3.0 by @​jakubtobiasz in playwright-php/playwright#93
• ci: use playwright-install --with-deps to fix local execution by @​gimler in playwright-php/playwright#86
• bug: pass options to waitForActionable to override timeout by @​gimler in playwright-php/playwright#82
• feature: clear cookies by name by @​gimler in playwright-php/playwright#85
• bug: implement missing bringToFront function by @​gyaaniguy in playwright-php/playwright#89
• feature: add waitForFunction by @​gimler in playwright-php/playwright#87
• chore: update docs by @​raffaelecarelle in playwright-php/playwright#97
• Fix ProcessJsonRpcClient never clearing the Process output buffers by @​poman in playwright-php/playwright#103
• Fix LspFraming permanently poisoning the stream on stray non-LSP output by @​poman in playwright-php/playwright#106
• Fix passive popup/tab registration in the Node bridge server by @​poman in playwright-php/playwright#104
• Add issue templates and contact links by @​smnandre in playwright-php/playwright#115
• Align interfaces with the shipped public API by @​smnandre in playwright-php/playwright#108
• Register page default timeout actions server-side (fix #94) by @​smnandre in playwright-php/playwright#109
• Remove setAccessible calls, no-ops since PHP 8.1 by @​smnandre in playwright-php/playwright#117
• Shut down the Node bridge when its parent dies by @​smnandre in playwright-php/playwright#118
• Let operation timeouts extend the RPC deadline (fix #92) by @​smnandre in playwright-php/playwright#113
• Unify tracing on PW_TRACE and wire config tracing (fix #79) by @​smnandre in playwright-php/playwright#111
• Send unroute to the page instead of the context (fix #96) by @​smnandre in playwright-php/playwright#110
• Transport request bodies as base64 postDataBuffer by @​smnandre in playwright-php/playwright#116
• Register context.setStorageState on the server (fix #98) by @​smnandre in playwright-php/playwright#112
• Implement Tracing API & record expect assertions as trace groups by @​smnandre in playwright-php/playwright#114
• Add the missing v1.2.0 changelog entry by @​smnandre in playwright-php/playwright#119
• Keep node resolution out of the unit test suite by @​smnandre in playwright-php/playwright#120
• Wire config options into launch and context creation by @​smnandre in playwright-php/playwright#121
• Prepare release 1.3.0 by @​smnandre in playwright-php/playwright#122

New Contributors

• @​gimler made their first contribution in playwright-php/playwright#77
• @​braydend made their first contribution in playwright-php/playwright#76
• @​jakubtobiasz made their first contribution in playwright-php/playwright#93
• @​gyaaniguy made their first contribution in playwright-php/playwright#89
• @​raffaelecarelle made their first contribution in playwright-php/playwright#97
• @​poman made their first contribution in playwright-php/playwright#103

Full Changelog: playwright-php/playwright@v1.2.0...v1.3.0

Changelog

Sourced from playwright-php/playwright's changelog.

[1.3.0] - 2026-07-23

Added

• Page::waitForFunction() (#87)
• Clear cookies by name (#85)
• BrowserContextInterface::tracing() exposing the Tracing API; expect() assertions are recorded as named trace groups (#114)
• BrowserBuilder::withChannel(), withProxy() and withDownloadsPath() (#121)
• PSR Log 2.0 support, alongside 3.0 (#93)
• Interface @method annotations for methods already shipped by the concrete classes: BrowserContext::clock(), BrowserContext::setGeolocation(), BrowserContext::setOffline(), Dialog::page(), Keyboard::insertText(), Page::pause(), Response::headerValue(). They move to real interface declarations in the next major (#108)

Changed

• PlaywrightConfig is now mandatory on the Browser, BrowserContext, Page and BrowserBuilder constructors (#72)
• Page::getBy*() locators accept string|Regex, matching the Playwright JS API (#76)
• PW_TRACE is the single tracing switch; contexts created from PlaywrightConfigBuilder::fromEnv() record a trace saved on close (#111)
• PlaywrightConfig applies channel, proxy, downloadsDir, videosDir and minNodeVersion; videosDir also applies to the default context (#121)

Fixed

• PageInterface::waitForSelector() returns LocatorInterface instead of ?LocatorInterface, matching the implementation (#74)
• Page::bringToFront() is implemented (#89)
• Page::unroute() reaches the page instead of the context (#110)
• Page::setDefaultTimeout() and setDefaultNavigationTimeout() are registered server-side (#109)
• BrowserContext::setStorageState() is registered server-side (#112)
• Operation timeouts extend the RPC deadline (#113)
• Request bodies survive non-UTF8 content, carried as base64 postDataBuffer (#116)
• The Node bridge and its browser shut down when the PHP process dies (#118)
• LspFraming recovers from stray non-LSP output on the stream (#106)
• ProcessJsonRpcClient clears the Process output buffers (#103)
• Passive popup and tab registration in the Node bridge (#104)
• waitForActionable honours the options passed to override the timeout (#82)
• Proxy credentials are redacted from the "Launching browser" log (#121)

Commits

• 87c39c4 Prepare release 1.3.0 (#122)
• 8257548 Wire config options into launch and context creation (#121)
• 684d7cd Keep node resolution out of the unit test suite (#120)
• d684197 Add the missing v1.2.0 changelog entry (#119)
• de4e429 Implement Tracing API & record expect assertions as trace groups (#114)
• e051840 Register context.setStorageState on the server (fix #98) (#112)
• fece8b5 Transport request bodies as base64 postDataBuffer (#116)
• 83e1255 Send unroute to the page instead of the context (fix #96) (#110)
• b452e7a Unify tracing on PW_TRACE and wire config tracing (fix #79) (#111)
• 528f145 Let operation timeouts extend the RPC deadline (fix #92) (#113)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.