What's Changed

• Port security fixes from v5.8.2 to Smarty v4. by @wisskid in #1194

Full Changelog: v4.5.6...v4.5.7

What's Changed

• Fix regression caused in 5.8.1. by @wisskid in #1193

Full Changelog: v5.8.2...v5.8.3

What's Changed

• Security: prevent symlinks inside a trusted secure_dir/template directory from being used to read files outside of it (CWE-22 path traversal), affecting {include} and {fetch} of local files
• Security: {html_image} now escapes the file, path_prefix, href/link, width and height attributes (it already escaped alt and pass-through attributes), and {html_select_date} casts day_size/month_size/year_size to int (matching {html_select_time}), preventing untrusted values passed into these attributes from breaking out of the generated HTML (CWE-79)
• Security: {fetch} no longer follows HTTP redirects for remote resources while a security policy is active, preventing an open redirect on a trusted host from bypassing trusted_uri (CWE-918 server-side request forgery)
• Fixed "Attempt to assign property step on null" error when using a {for} loop inside a block of an extended template #1036

New Contributors

• @antman3351 made their first contribution in #1071

Full Changelog: v5.8.1...v5.8.2

What's Changed

• Bugfix/issue 1189 inheritance state leak by @wisskid in #1190

Internal changes

• Redirect test temp dirs to system temp directory. Fixes #1178 by @wisskid in #1179
• fix: correct return type in retrieveCachedContent docblock by @zigzagdev in #1180

New Contributors

• @zigzagdev made their first contribution in #1180

Full Changelog: v5.8.0...v5.8.1

What's Changed

• Document missing inline implementation. Fixed #1152 by @wisskid in #1156
• Fix static analysis warnings for isDot() and remove deprecated APC support by @h-marumoto in #1164
• Support for Laravel Collections style object chaining by @wisskid in #1168
• Regex matches operator by @wisskid in #1169
• Add support for Backed Enums by @wisskid in #1171

Full Changelog: v5.7.0...v5.8.0

What's Changed

• Non-canonical cast (boolean) fix by @Visualq in #1145
• Php8.5 support by @wisskid in #1138

Full Changelog: v5.6.0...v5.7.0

What's Changed

• Add support for shorttags in functions by @pharixces in #1142

Full Changelog: v5.5.2...v5.6.0

• Fixed escaping of array/object keys in debug_print_var

Full Changelog: v5.5.1...v5.5.2

What's Changed

• Bugfix/1100 modifier called like a function compiled to modifier name not callback by @wisskid in #1101
• add missing closing tr tag by @shadowwa in #1117
• add count and debug_print_var modifier doc by @shadowwa in #1116
• Replace SMARTY_VERSION constant with $smarty.version in debug.tpl #1073
• Fixed escaping of array/object keys in debug_print_var

Full Changelog: v4.5.5...v4.5.6