Bump smarty/smarty from 5.6.0 to 5.8.4

[dependabot]

Bumps smarty/smarty from 5.6.0 to 5.8.4.

Release notes

Sourced from smarty/smarty's releases.

v5.8.4

No release notes provided.

v5.8.3

What's Changed

• Fix regression caused in 5.8.1. by @​wisskid in smarty-php/smarty#1193

Full Changelog: smarty-php/smarty@v5.8.2...v5.8.3

v5.8.2

What's Changed

• Security: prevent symlinks inside a trusted secure_dir/template directory from being used to read files outside of it (CWE-22 path traversal), affecting {include} and {fetch} of local files
• Security: {html_image} now escapes the file, path_prefix, href/link, width and height attributes (it already escaped alt and pass-through attributes), and {html_select_date} casts day_size/month_size/year_size to int (matching {html_select_time}), preventing untrusted values passed into these attributes from breaking out of the generated HTML (CWE-79)
• Security: {fetch} no longer follows HTTP redirects for remote resources while a security policy is active, preventing an open redirect on a trusted host from bypassing trusted_uri (CWE-918 server-side request forgery)
• Fixed "Attempt to assign property step on null" error when using a {for} loop inside a block of an extended template #1036

New Contributors

• @​antman3351 made their first contribution in smarty-php/smarty#1071

Full Changelog: smarty-php/smarty@v5.8.1...v5.8.2

v5.8.1

What's Changed

• Bugfix/issue 1189 inheritance state leak by @​wisskid in smarty-php/smarty#1190

Internal changes

• Redirect test temp dirs to system temp directory. Fixes #1178 by @​wisskid in smarty-php/smarty#1179
• fix: correct return type in retrieveCachedContent docblock by @​zigzagdev in smarty-php/smarty#1180

New Contributors

• @​zigzagdev made their first contribution in smarty-php/smarty#1180

Full Changelog: smarty-php/smarty@v5.8.0...v5.8.1

v5.8.0

What's Changed

• Document missing inline implementation. Fixed #1152 by @​wisskid in smarty-php/smarty#1156
• Fix static analysis warnings for isDot() and remove deprecated APC support by @​h-marumoto in smarty-php/smarty#1164
• Support for Laravel Collections style object chaining by @​wisskid in smarty-php/smarty#1168
• Regex matches operator by @​wisskid in smarty-php/smarty#1169
• Add support for Backed Enums by @​wisskid in smarty-php/smarty#1171

Full Changelog: smarty-php/smarty@v5.7.0...v5.8.0

v5.7.0

What's Changed

• Non-canonical cast (boolean) fix by @​Visualq in smarty-php/smarty#1145
• Php8.5 support by @​wisskid in smarty-php/smarty#1138

... (truncated)

Changelog

Sourced from smarty/smarty's changelog.

[5.8.4] - 2026-06-29

• Fixed a TypeError on PHP 8 when Security::$static_classes was set to a non-array value (e.g. the string 'none') to disable static class access; any non-array value now cleanly denies access. Use Security::$static_classes = null to disable access to all static classes.
• Security: the built-in stream: resource type now validates the nested stream wrapper against the security policy, so a template such as stream:php://filter/... can no longer bypass Security::$streams (including Security::$streams = null) to read local files (CWE-22)

[5.8.3] - 2026-06-28

• fixed a regression from #1189 where a child template's block override no longer applied to a template {include}d by the parent #1192

[5.8.2] - 2026-06-24

• Security: prevent symlinks inside a trusted secure_dir/template directory from being used to read files outside of it (CWE-22 path traversal), affecting {include} and {fetch} of local files
• Security: {html_image} now escapes the file, path_prefix, href/link, width and height attributes (it already escaped alt and pass-through attributes), and {html_select_date} casts day_size/month_size/year_size to int (matching {html_select_time}), preventing untrusted values passed into these attributes from breaking out of the generated HTML (CWE-79)
• Security: {fetch} no longer follows HTTP redirects for remote resources while a security policy is active, preventing an open redirect on a trusted host from bypassing trusted_uri (CWE-918 server-side request forgery)
• Fixed "Attempt to assign property step on null" error when using a {for} loop inside a block of an extended template #1036

[5.8.1] - 2026-06-23

• Re-activated unit tests for user literals, which were previously disabled due to a bug in refactoring to v5.
• fixed a bug where child template's block content leaked into subsequent rendering of the parent template #1189
• Moved all unit test-generated output from inside the working tree to tmp files #1178

[5.8.0] - 2026-02-15

• Added support for Backed Enums for php versions >= 8.1 #1171
• Added support for new 'matches' operator doing regex matching #1169
• Update documentation to clarify that include inline is currently not implemented in Smarty v5 #1152
• Support for Laravel Collections style object chaining for objects return from function calls implemented as modifiers #1151

[5.7.0] - 2025-11-19

• PHP 8.5 support

Commits

• 94a27cb Merge branch 'release/5.8.4'
• badc5ef version bump
• 2ae0f9a Fix TypeError for non-array static_classes in Security policy (#1198)
• b668745 drop unused version attribute from docker-compose.yml
• 3c9f77a Security: validate nested stream wrapper in stream: resource (CWE-22) (#1195)
• 042dff6 Merge branch 'release/5.8.3'
• 1830aa7 version bump
• b83ffdd requirements for building docs, switched test-runner from mutagen to basic do...
• ac27e1e fixed a regression from #1189 where a child template's block override no long...
• 17fae11 update documentation for building and previewing with mkdocs, fix unit tests ...
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[pylipp]

superceded by #842

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.