Skip to content

Bump smarty/smarty from 4.5.6 to 4.5.7 - #11163

Merged
driusan merged 1 commit into
mainfrom
dependabot/composer/smarty/smarty-4.5.7
Sep 14, 2026
Merged

Bump smarty/smarty from 4.5.6 to 4.5.7#11163
driusan merged 1 commit into
mainfrom
dependabot/composer/smarty/smarty-4.5.7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps smarty/smarty from 4.5.6 to 4.5.7.

Release notes

Sourced from smarty/smarty's releases.

v4.5.7

What's Changed

Full Changelog: smarty-php/smarty@v4.5.6...v4.5.7

Changelog

Sourced from smarty/smarty's changelog.

[4.5.7] - 2026-06-29

  • Security: prevent symlinks inside a trusted secure_dir/template directory from being used to read files outside of it (CWE-22 path traversal), affecting {include} and {fetch} of local files
  • Security: {html_image} now escapes the file, path_prefix, href/link, width and height attributes (it already escaped alt and pass-through attributes), and {html_select_date} casts day_size/month_size/year_size to int (matching {html_select_time}), preventing untrusted values passed into these attributes from breaking out of the generated HTML (CWE-79)
  • Security: {fetch} no longer follows HTTP redirects for remote resources while a security policy is active, preventing an open redirect on a trusted host from bypassing trusted_uri (CWE-918 server-side request forgery)
Commits
  • 838d6ad Merge branch 'release/4.5.7' into support/4
  • 187f7b6 version bump
  • a1ccdb0 Port security fixes from v5.8.2 to Smarty v4. (#1194)
  • c285f84 Reproduce block override leakage in template inheritance
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update php code labels Aug 9, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@kongtiaowang kongtiaowang reopened this Sep 14, 2026
@driusan

driusan commented Sep 14, 2026

Copy link
Copy Markdown
Collaborator

@dependabot rebase

@dependabot
Bump smarty/smarty from 4.5.6 to 4.5.7
c171286 
Bumps [smarty/smarty](https://github.com/smarty-php/smarty) from 4.5.6 to 4.5.7.
- [Release notes](https://github.com/smarty-php/smarty/releases)
- [Changelog](https://github.com/smarty-php/smarty/blob/v4.5.7/CHANGELOG.md)
- [Commits](smarty-php/smarty@v4.5.6...v4.5.7)

---
updated-dependencies:
- dependency-name: smarty/smarty
  dependency-version: 4.5.7
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/composer/smarty/smarty-4.5.7 branch from b79cd62 to c171286 Compare September 14, 2026 19:45
@driusan
driusan merged commit 0d360ef into main Sep 14, 2026
43 checks passed
@dependabot
dependabot Bot deleted the dependabot/composer/smarty/smarty-4.5.7 branch September 14, 2026 20:36
HachemJ pushed a commit to HachemJ/Loris that referenced this pull request Sep 30, 2026
@dependabot @HachemJ
Bump smarty/smarty from 4.5.6 to 4.5.7 (aces#11163)
f402f84 
Bumps [smarty/smarty](https://github.com/smarty-php/smarty) from 4.5.6
to 4.5.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/smarty-php/smarty/releases">smarty/smarty's
releases</a>.</em></p>
<blockquote>
<h2>v4.5.7</h2>
<h2>What's Changed</h2>
<ul>
<li>Port security fixes from v5.8.2 to Smarty v4. by <a
href="https://github.com/wisskid"><code>@​wisskid</code></a> in <a
href="https://redirect.github.com/smarty-php/smarty/pull/1194">smarty-php/smarty#1194</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/smarty-php/smarty/compare/v4.5.6...v4.5.7">https://github.com/smarty-php/smarty/compare/v4.5.6...v4.5.7</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/smarty-php/smarty/blob/v4.5.7/CHANGELOG.md">smarty/smarty's
changelog</a>.</em></p>
<blockquote>
<h2>[4.5.7] - 2026-06-29</h2>
<ul>
<li>Security: prevent symlinks inside a trusted
<code>secure_dir</code>/template directory from being used to read files
outside of it (CWE-22 path traversal), affecting <code>{include}</code>
and <code>{fetch}</code> of local files</li>
<li>Security: <code>{html_image}</code> now escapes the
<code>file</code>, <code>path_prefix</code>,
<code>href</code>/<code>link</code>, <code>width</code> and
<code>height</code> attributes (it already escaped <code>alt</code> and
pass-through attributes), and <code>{html_select_date}</code> casts
<code>day_size</code>/<code>month_size</code>/<code>year_size</code> to
int (matching <code>{html_select_time}</code>), preventing untrusted
values passed into these attributes from breaking out of the generated
HTML (CWE-79)</li>
<li>Security: <code>{fetch}</code> no longer follows HTTP redirects for
remote resources while a security policy is active, preventing an open
redirect on a trusted host from bypassing <code>trusted_uri</code>
(CWE-918 server-side request forgery)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/smarty-php/smarty/commit/838d6ad1c635f8a6bafc08d791b8af18d8304b3a"><code>838d6ad</code></a>
Merge branch 'release/4.5.7' into support/4</li>
<li><a
href="https://github.com/smarty-php/smarty/commit/187f7b6246de8195398241332ce8fa69c719ff4e"><code>187f7b6</code></a>
version bump</li>
<li><a
href="https://github.com/smarty-php/smarty/commit/a1ccdb0518021a559b4066c37b76a42c86bbce90"><code>a1ccdb0</code></a>
Port security fixes from v5.8.2 to Smarty v4. (<a
href="https://redirect.github.com/smarty-php/smarty/issues/1194">#1194</a>)</li>
<li><a
href="https://github.com/smarty-php/smarty/commit/c285f84fc66212c0e1c73780bbebe07771e6e5bf"><code>c285f84</code></a>
Reproduce block override leakage in template inheritance</li>
<li>See full diff in <a
href="https://github.com/smarty-php/smarty/compare/v4.5.6...v4.5.7">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
HachemJ pushed a commit to HachemJ/Loris that referenced this pull request Oct 12, 2026
@dependabot @HachemJ
Bump smarty/smarty from 4.5.6 to 4.5.7 (aces#11163)
5b976a0 
Bumps [smarty/smarty](https://github.com/smarty-php/smarty) from 4.5.6
to 4.5.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/smarty-php/smarty/releases">smarty/smarty's
releases</a>.</em></p>
<blockquote>
<h2>v4.5.7</h2>
<h2>What's Changed</h2>
<ul>
<li>Port security fixes from v5.8.2 to Smarty v4. by <a
href="https://github.com/wisskid"><code>@​wisskid</code></a> in <a
href="https://redirect.github.com/smarty-php/smarty/pull/1194">smarty-php/smarty#1194</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/smarty-php/smarty/compare/v4.5.6...v4.5.7">https://github.com/smarty-php/smarty/compare/v4.5.6...v4.5.7</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/smarty-php/smarty/blob/v4.5.7/CHANGELOG.md">smarty/smarty's
changelog</a>.</em></p>
<blockquote>
<h2>[4.5.7] - 2026-06-29</h2>
<ul>
<li>Security: prevent symlinks inside a trusted
<code>secure_dir</code>/template directory from being used to read files
outside of it (CWE-22 path traversal), affecting <code>{include}</code>
and <code>{fetch}</code> of local files</li>
<li>Security: <code>{html_image}</code> now escapes the
<code>file</code>, <code>path_prefix</code>,
<code>href</code>/<code>link</code>, <code>width</code> and
<code>height</code> attributes (it already escaped <code>alt</code> and
pass-through attributes), and <code>{html_select_date}</code> casts
<code>day_size</code>/<code>month_size</code>/<code>year_size</code> to
int (matching <code>{html_select_time}</code>), preventing untrusted
values passed into these attributes from breaking out of the generated
HTML (CWE-79)</li>
<li>Security: <code>{fetch}</code> no longer follows HTTP redirects for
remote resources while a security policy is active, preventing an open
redirect on a trusted host from bypassing <code>trusted_uri</code>
(CWE-918 server-side request forgery)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/smarty-php/smarty/commit/838d6ad1c635f8a6bafc08d791b8af18d8304b3a"><code>838d6ad</code></a>
Merge branch 'release/4.5.7' into support/4</li>
<li><a
href="https://github.com/smarty-php/smarty/commit/187f7b6246de8195398241332ce8fa69c719ff4e"><code>187f7b6</code></a>
version bump</li>
<li><a
href="https://github.com/smarty-php/smarty/commit/a1ccdb0518021a559b4066c37b76a42c86bbce90"><code>a1ccdb0</code></a>
Port security fixes from v5.8.2 to Smarty v4. (<a
href="https://redirect.github.com/smarty-php/smarty/issues/1194">#1194</a>)</li>
<li><a
href="https://github.com/smarty-php/smarty/commit/c285f84fc66212c0e1c73780bbebe07771e6e5bf"><code>c285f84</code></a>
Reproduce block override leakage in template inheritance</li>
<li>See full diff in <a
href="https://github.com/smarty-php/smarty/compare/v4.5.6...v4.5.7">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file php Pull requests that update php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@driusan @kongtiaowang