Skip to content

deps: bump - latte, playwright, coding-standard, php_codesniffer - #75

Merged
landsman merged 1 commit into
mainfrom
dependabot/composer/app/composer-2d4a730ea6
Aug 13, 2026
Merged

deps: bump - latte, playwright, coding-standard, php_codesniffer#75
landsman merged 1 commit into
mainfrom
dependabot/composer/app/composer-2d4a730ea6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 13, 2026

Copy link
Copy Markdown
Contributor

Bumps the composer group with 3 updates in the /app directory: latte/latte, playwright-php/playwright and slevomat/coding-standard.

Updates latte/latte from 3.1.4 to 3.1.6

Release notes

Sourced from latte/latte's releases.

Released version 3.1.6

A substantial correctness and security release born from a deep audit of the engine. It hardens context-sensitive escaping in two spots, fixes a long list of filter and compiler edge cases, adds the handy |map filter and an afterRender() extension hook, and brings back a performance regression fix. A recommended upgrade for everyone.

💥 Behavior Changes & Deprecations

  • {$interval|date} without an explicit format now throws instead of silently printing the literal format string j. n. Y. Pass a format for DateInterval, e.g. {$interval|date: '%d days'}.
  • {first}, {last}, {sep} used outside a {foreach} now emit a deprecation warning – they rely on an ambient $iterator that only a loop provides. This becomes a compile-time error in Latte 3.2.

✨ New Features

  • New |map filter – transform every item with a callback, the natural partner to |filter: {foreach ($items|map: fn($x) => $x->name) as $name}.
  • New Extension::afterRender() hook – called in a finally, so it runs even when rendering ends early via {exitIf} or is interrupted by an exception. Perfect for cleanup or measurement.
  • The Tracy panel now shows render time per template, both total and self (excluding nested templates), so you can finally see which template actually eats the time.
  • |last, |random, |implode/|join, |commas now accept any iterable, not just arrays – hand them a generator or iterator directly, just like |first, |slice and |filter already allowed.

🐛 Bug Fixes

  • Security: <script type=" text/javascript "> with surrounding whitespace was classified as raw text while browsers execute it as JavaScript. The type is now trimmed the way browsers do, so context-sensitive escaping kicks in correctly.
  • Security: a template compiled under a permissive sandbox policy could be silently reused from cache under a stricter one, because part of the sandbox is enforced at compile time. Policy rules are now part of the cache key.
  • Security: xlink:href in inline SVG is now treated as a URL attribute and sanitized like href.
  • {capture $x|filter} no longer double-escapes its content. Adding an innocent filter like |trim used to strip the "HTML-ness" of the captured markup, escaping it on output; captured HTML now stays intact (while a filter that changes the content type still yields a plain string).
  • {switch} with no expression used to compile to invalid PHP; it now works as a switch-true idiom ({case $cond}).
  • <script type="a{$dyn}"> with a partially dynamic type attribute no longer fails compilation with a cryptic "Unhandled match case" – it's treated as JavaScript.
  • The empty comment {**} no longer breaks compilation.
  • |reverse and |column no longer drop elements from generators or iterators that yield duplicate keys.
  • |indent no longer interprets $ or \ in the indentation string as regular-expression backreferences.
  • |explode/|split (and |random) now raise a clear RuntimeException on malformed UTF-8 instead of a confusing TypeError.
  • |padLeft/|padRight with an empty pad string, and the divisibleBy() function with a zero divisor, now throw a helpful message instead of a raw DivisionByZeroError.
  • Compiled template class names now use a 64-bit hash (up from 40-bit), removing a small but real risk of two templates colliding so that one silently renders the other.
  • Custom n:attributes whose name contains tag- or inner- (e.g. n:my-tag-attr) are no longer mangled by the prefix stripper.
  • Extensions that subclass core nodes no longer silently break {iterateWhile}, {rollback} and {include parent} – Tag::closestTag() now matches subclasses, as its documentation always promised.
  • A compile-time failure without a cache directory now surfaces as a proper CompileException pointing at the generated source, instead of a bare ParseError.

⚡ Performance

  • The engine no longer recomputes its entire configuration signature on every {include}, {extends} or {embed} – a memoization lost in the 3.1 cache refactor is restored (and properly invalidated whenever you reconfigure the engine). This also fixes a crash when createTemplate(clearCache: false) was the very first call.
  • Passing a parameters object to render() is roughly 2.6× faster – the reflection scan of the parameter class is memoized per class instead of being repeated on every render.

Released version 3.1.5

Template inheritance just got a lot more flexible: layouts can now receive explicit variables, {embed} supports an implicit default block, and blocks finally behave intuitively in places where they used to fail. On top of that, the whitespace minifier behind {spaceless} has been rewritten from scratch to actually understand HTML.

✨ New Features

  • {spaceless} rewritten from the ground up – the minifier now truly understands HTML, so it squeezes out much more whitespace without ever breaking your page: it strips whitespace completely around block elements, keeps proper word spacing around inline tags like <i> or <a>, and leaves pre, textarea, script, style and attribute values untouched. And it streams, so even huge templates minify with no memory overhead.
  • Implicit default block for {embed} – content written directly inside {embed} without a {block} wrapper now overrides {block default} of the embedded template, while an empty {embed} keeps the fallback (#419)
  • {layout file, vars} – pass explicit variables straight to the parent template: {layout 'parent.latte', title: 'Hello'}. They reach the layout only (child blocks don't see them) and override same-named parameters. Works with {extends} too; note the comma before the arguments is required.
  • |json attribute modifier – JSON-encode a dynamic HTML attribute value with smart quoting: <div data-config={$config|json}>

🐛 Bug Fixes

  • {include parent} and {include this} now work inside dynamically named blocks – previously this was a compile error, or worse, silently bound to an outer static block
  • {contentType} inside <script> now really switches the escaping context – previously it was a silent no-op unless the script element had a matching type attribute

... (truncated)

Commits
  • adccfac Released version 3.1.6
  • f6a6b6a TemplateParserHtml: n:attribute checks the tag parser generator protocol like...
  • d9a0927 Tracy: panel shows render time per template, total and self
  • 2d0db7a Extension: added afterRender() hook, called in finally
  • 4f07dd0 Helpers: resolveParams() memoizes the reflection scan of the params class
  • 99a1b7a Engine: template hash extended from 40 to 64 bits
  • b596015 Tag::closestTag() matches subclasses, as its phpDoc promises
  • 2181bc9 HtmlHelpers: xlink:href in inline SVG is a URL attribute and gets sanitized
  • 37d88b6 HtmlHelpers: classifyScriptType() strips ASCII whitespace around MIME type li...
  • 707d23d FirstLastSepNode: {first}, {last}, {sep} outside {foreach} triggers a depreca...
  • Additional commits viewable in compare view

Updates playwright-php/playwright from 1.2.0 to 1.3.1

Release notes

Sourced from playwright-php/playwright's releases.

v1.3.1

What's Changed

Full Changelog: playwright-php/playwright@v1.3.0...v1.3.1

v1.3.0

What's Changed

New Contributors

Full Changelog: playwright-php/playwright@v1.2.0...v1.3.0

Changelog

Sourced from playwright-php/playwright's changelog.

[1.3.1] - 2026-08-04

Fixed

  • Locator::setInputFiles() and Page::setInputFiles() resolve relative paths before sending them to the Node bridge (#127)
  • Endpoint credentials are redacted from the connect() and connectOverCDP() logs (#128)

[1.3.0] - 2026-07-23

Added

  • Page::waitForFunction() (#87)
  • Clear cookies by name (#85)
  • BrowserContextInterface::tracing() exposing the Tracing API; expect() assertions are recorded as named trace groups (#114)
  • BrowserBuilder::withChannel(), withProxy() and withDownloadsPath() (#121)
  • PSR Log 2.0 support, alongside 3.0 (#93)
  • Interface @method annotations for methods already shipped by the concrete classes: BrowserContext::clock(), BrowserContext::setGeolocation(), BrowserContext::setOffline(), Dialog::page(), Keyboard::insertText(), Page::pause(), Response::headerValue(). They move to real interface declarations in the next major (#108)

Changed

  • PlaywrightConfig is now mandatory on the Browser, BrowserContext, Page and BrowserBuilder constructors (#72)
  • Page::getBy*() locators accept string|Regex, matching the Playwright JS API (#76)
  • PW_TRACE is the single tracing switch; contexts created from PlaywrightConfigBuilder::fromEnv() record a trace saved on close (#111)
  • PlaywrightConfig applies channel, proxy, downloadsDir, videosDir and minNodeVersion; videosDir also applies to the default context (#121)

Fixed

  • PageInterface::waitForSelector() returns LocatorInterface instead of ?LocatorInterface, matching the implementation (#74)
  • Page::bringToFront() is implemented (#89)
  • Page::unroute() reaches the page instead of the context (#110)
  • Page::setDefaultTimeout() and setDefaultNavigationTimeout() are registered server-side (#109)
  • BrowserContext::setStorageState() is registered server-side (#112)
  • Operation timeouts extend the RPC deadline (#113)
  • Request bodies survive non-UTF8 content, carried as base64 postDataBuffer (#116)
  • The Node bridge and its browser shut down when the PHP process dies (#118)
  • LspFraming recovers from stray non-LSP output on the stream (#106)
  • ProcessJsonRpcClient clears the Process output buffers (#103)
  • Passive popup and tab registration in the Node bridge (#104)
  • waitForActionable honours the options passed to override the timeout (#82)
  • Proxy credentials are redacted from the "Launching browser" log (#121)
Commits

Updates slevomat/coding-standard from 8.31.0 to 8.31.1

Release notes

Sourced from slevomat/coding-standard's releases.

8.31.1

🐛 Fixes

  • SlevomatCodingStandard.Classes.ParentCall: Fixed false positive for parent calls after =>
  • SlevomatCodingStandard.Classes.ParentCall: Fixed false positive for @parent::
  • SlevomatCodingStandard.Classes.ReadonlyClass: Do not mark abstract class as readonly despite all promoted and body-property are mark as readonly (thanks to @​kamil-zacek)
Commits
  • 0a40807 Updated dependencies
  • 0d18071 SlevomatCodingStandard.Classes.ParentCall: Fixed false positive for parent ca...
  • c3eac35 SlevomatCodingStandard.Classes.ParentCall: Fixed false positive for @​parent::
  • 1f3de31 ReadonlyClassSniff - do not mark abstract class as readonly despite all promo...
  • See full diff in compare view

Updates squizlabs/php_codesniffer from 4.0.1 to 4.0.4

Release notes

Sourced from squizlabs/php_codesniffer's releases.

4.0.4 - 2026-08-06

The 4.0.2 release, the 4.0.3 and the 4.0.4 release are 100% the same (aside from the version number), there was just a slight snafu in the release publication on GitHub (missing PHAR assets). Sorry for the confusion.

4.0.2 - 2026-08-06

This is a security release and all users are advised to update their install(s) as soon as possible. The security issue only affects users of the Gitblame, Hgblame or Svnblame report(s).

Added

  • Tokenizer support for the PHP 8.5 (void) cast. #1325 The T_VOID_CAST token has been added to the Tokens::CAST_TOKENS array.
  • suggest section to the composer.json file to inform users about the recommended iconv and pcntl PHP extensions. #1388

Changed

  • Clarified that libxml is a required PHP extension. #1409
  • Squiz.Scope.StaticThisUsage: the sniff will now also search for the use of $this in static closures. #1377
  • The Generic.PHP.LowerCaseKeyword, Generic.WhiteSpace.LanguageConstructSpacing and Squiz.Functions.FunctionDeclarationArgumentSpacing sniffs no longer embed UTF-8 middot characters for spaces in error messages. #1379, #1389 Fixes [Squiz/#2652](squizlabs/PHP_CodeSniffer#2652).
  • PSR2.ControlStructures.SwitchDeclaration: the error message for the use of colon + curly braces (WrongOpener*) has been made more informative. #1358. Fixes #1322.
  • The error messages for the following sniffs have been improved by exposing more data placeholders:
    • PEAR.Functions.FunctionDeclaration #1445
      • The CloseBracketLine error message now exposes 1 data value (previously 0).
      • The EmptyLine error message now exposes 1 data value (previously 0).
      • The Indent error message now exposes 3 data values (previously 2).
      • These changes also affect the same error codes for the PSR12.Classes.AnonClassDeclaration and Squiz.Functions.MultiLineFunctionDeclaration sniffs.
    • PSR2.Classes.ClassDeclaration #1446
      • The ExtendsLine and ImplementsLine error messages now expose 3 data values (previously 1).
      • The SpaceBeforeExtends and SpaceBeforeImplements error messages now expose 2 data values (previously 1).
      • These changes also affect the same error codes for the PSR12.Classes.AnonClassDeclaration and Squiz.Classes.ClassDeclaration sniffs.
    • PSR2.ControlStructures.SwitchDeclaration #1447
      • The defaultNotLower and caseNotLower error messages now expose 3 data values (previously 2).
      • The SpaceBeforeColonDEFAULT and SpaceBeforeColonCASE error messages now expose 1 data value (previously 0).
      • The BodyOnNextLineDEFAULT and BodyOnNextLineCASE error messages now expose 1 data value (previously 0).
      • The WrongOpenerdefault and WrongOpenercase error messages now expose 1 data value (previously 0).
    • Squiz.ControlStructures.SwitchDeclaration #1449
      • The CaseNotLower and DefaultNotLower error messages now expose 3 data values (previously 2).
      • The CaseIndent and DefaultIndent error messages now expose 2 data values (previously 0).
      • The SpaceBeforeColonCase and SpaceBeforeColonDefault error messages now expose 1 data value (previously 0).
      • The BreakIndent error message now exposes 1 data value (previously 0).
      • The SpacingAfterCase and SpacingAfterDefault error messages now expose 1 data value (previously 0).
    • Squiz.Functions.FunctionDeclarationArgumentSpacing #1452
      • The SpaceBeforeEquals error message now exposes 3 data values (previously 2).
      • The SpaceAfterEquals error message now exposes 3 data values (previously 2).
    • Squiz.Functions.MultiLineFunctionDeclaration #1453
      • The FirstParamSpacing and UseFirstParamSpacing error messages now expose 1 data value (previously 0).
      • The OneParamPerLine and UseOneParamPerLine error messages now expose 1 data value (previously 0).
      • These changes also affect the same error codes for the PSR12.Classes.AnonClassDeclaration sniff.
    • If you have customised the error messages of these sniffs, please review your ruleset after upgrading.
    • Thanks to Zhang WenTao for these patches.

... (truncated)

Changelog

Sourced from squizlabs/php_codesniffer's changelog.

[4.0.4] - 2026-08-06

The 4.0.2 release, the 4.0.3 and the 4.0.4 release are 100% the same, there was just a slight snafu in the release publication on GitHub. Sorry for the confusion.

[4.0.3] - 2026-08-06

WITHDRAWN

[4.0.2] - 2026-08-06

This is a security release and all users are advised to update their install(s) as soon as possible. The security issue only affects users of the Gitblame, Hgblame or Svnblame report(s).

Added

  • Tokenizer support for the PHP 8.5 (void) cast. #1325 The T_VOID_CAST token has been added to the Tokens::CAST_TOKENS array.
  • suggest section to the composer.json file to inform users about the recommended iconv and pcntl PHP extensions. #1388

Changed

  • Clarified that libxml is a required PHP extension. #1409
  • Squiz.Scope.StaticThisUsage: the sniff will now also search for the use of $this in static closures. #1377
  • The Generic.PHP.LowerCaseKeyword, Generic.WhiteSpace.LanguageConstructSpacing and Squiz.Functions.FunctionDeclarationArgumentSpacing sniffs no longer embed UTF-8 middot characters for spaces in error messages. #1379, #1389 Fixes [Squiz/#2652][sq-2652].
  • PSR2.ControlStructures.SwitchDeclaration: the error message for the use of colon + curly braces (WrongOpener*) has been made more informative. #1358. Fixes #1322.
  • The error messages for the following sniffs have been improved by exposing more data placeholders:
    • PEAR.Functions.FunctionDeclaration #1445
      • The CloseBracketLine error message now exposes 1 data value (previously 0).
      • The EmptyLine error message now exposes 1 data value (previously 0).
      • The Indent error message now exposes 3 data values (previously 2).
      • These changes also affect the same error codes for the PSR12.Classes.AnonClassDeclaration and Squiz.Functions.MultiLineFunctionDeclaration sniffs.
    • PSR2.Classes.ClassDeclaration #1446
      • The ExtendsLine and ImplementsLine error messages now expose 3 data values (previously 1).
      • The SpaceBeforeExtends and SpaceBeforeImplements error messages now expose 2 data values (previously 1).
      • These changes also affect the same error codes for the PSR12.Classes.AnonClassDeclaration and Squiz.Classes.ClassDeclaration sniffs.
    • PSR2.ControlStructures.SwitchDeclaration #1447
      • The defaultNotLower and caseNotLower error messages now expose 3 data values (previously 2).
      • The SpaceBeforeColonDEFAULT and SpaceBeforeColonCASE error messages now expose 1 data value (previously 0).
      • The BodyOnNextLineDEFAULT and BodyOnNextLineCASE error messages now expose 1 data value (previously 0).
      • The WrongOpenerdefault and WrongOpenercase error messages now expose 1 data value (previously 0).
    • Squiz.ControlStructures.SwitchDeclaration #1449
      • The CaseNotLower and DefaultNotLower error messages now expose 3 data values (previously 2).
      • The CaseIndent and DefaultIndent error messages now expose 2 data values (previously 0).
      • The SpaceBeforeColonCase and SpaceBeforeColonDefault error messages now expose 1 data value (previously 0).
      • The BreakIndent error message now exposes 1 data value (previously 0).
      • The SpacingAfterCase and SpacingAfterDefault error messages now expose 1 data value (previously 0).
    • Squiz.Functions.FunctionDeclarationArgumentSpacing #1452
      • The SpaceBeforeEquals error message now exposes 3 data values (previously 2).
      • The SpaceAfterEquals error message now exposes 3 data values (previously 2).

... (truncated)

Commits
  • bbdc3d0 Merge branch '3.x' into 4.x
  • 3d9e4c6 Merge pull request #1471 from PHPCSStandards/feature/update-gpg-key-info
  • 0c3dc35 Changelog: add release links
  • ddc0bf9 Changelog update for 4.0.3 + 4.0.4
  • 09a2847 Config: update version nr to next
  • aa43975 Merge branch '3.x' into 4.x
  • 29a0859 Config: update version nr to next
  • 305aebb Update for new GPG keys
  • 74ee2d4 Merge pull request #1475 from PHPCSStandards/feature/changelog-4.0.2
  • 2f4a106 Changelog for the 4.0.2 release
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps: bump the composer group across 1 directory with 4 updates
9acde9e 
Bumps the composer group with 3 updates in the /app directory: [latte/latte](https://github.com/nette/latte), [playwright-php/playwright](https://github.com/playwright-php/playwright) and [slevomat/coding-standard](https://github.com/slevomat/coding-standard).


Updates `latte/latte` from 3.1.4 to 3.1.6
- [Release notes](https://github.com/nette/latte/releases)
- [Commits](nette/latte@3.1.4...v3.1.6)

Updates `playwright-php/playwright` from 1.2.0 to 1.3.1
- [Release notes](https://github.com/playwright-php/playwright/releases)
- [Changelog](https://github.com/playwright-php/playwright/blob/main/CHANGELOG.md)
- [Commits](playwright-php/playwright@v1.2.0...v1.3.1)

Updates `slevomat/coding-standard` from 8.31.0 to 8.31.1
- [Release notes](https://github.com/slevomat/coding-standard/releases)
- [Commits](slevomat/coding-standard@8.31.0...8.31.1)

Updates `squizlabs/php_codesniffer` from 4.0.1 to 4.0.4
- [Release notes](https://github.com/PHPCSStandards/PHP_CodeSniffer/releases)
- [Changelog](https://github.com/PHPCSStandards/PHP_CodeSniffer/blob/4.x/CHANGELOG-4.x.md)
- [Commits](PHPCSStandards/PHP_CodeSniffer@4.0.1...4.0.4)

---
updated-dependencies:
- dependency-name: latte/latte
  dependency-version: 3.1.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: composer
- dependency-name: playwright-php/playwright
  dependency-version: 1.3.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: composer
- dependency-name: slevomat/coding-standard
  dependency-version: 8.31.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: composer
- dependency-name: squizlabs/php_codesniffer
  dependency-version: 4.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: composer
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update php code labels Aug 13, 2026
@landsman landsman changed the title deps: bump the composer group across 1 directory with 4 updates deps: latte, playwright, coding-standard, php_codesniffer Aug 13, 2026
@landsman landsman changed the title deps: latte, playwright, coding-standard, php_codesniffer deps: bump - latte, playwright, coding-standard, php_codesniffer Aug 13, 2026
@landsman
landsman merged commit e8543b8 into main Aug 13, 2026
@landsman
landsman deleted the dependabot/composer/app/composer-2d4a730ea6 branch August 13, 2026 17:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file php Pull requests that update php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@landsman