Bump smarty/smarty from 5.7.0 to 5.8.4

[dependabot]

Bumps smarty/smarty from 5.7.0 to 5.8.4.

Release notes

Sourced from smarty/smarty's releases.

v5.8.4

No release notes provided.

v5.8.3

What's Changed

• Fix regression caused in 5.8.1. by @​wisskid in smarty-php/smarty#1193

Full Changelog: smarty-php/smarty@v5.8.2...v5.8.3

v5.8.2

What's Changed

• Security: prevent symlinks inside a trusted secure_dir/template directory from being used to read files outside of it (CWE-22 path traversal), affecting {include} and {fetch} of local files
• Security: {html_image} now escapes the file, path_prefix, href/link, width and height attributes (it already escaped alt and pass-through attributes), and {html_select_date} casts day_size/month_size/year_size to int (matching {html_select_time}), preventing untrusted values passed into these attributes from breaking out of the generated HTML (CWE-79)
• Security: {fetch} no longer follows HTTP redirects for remote resources while a security policy is active, preventing an open redirect on a trusted host from bypassing trusted_uri (CWE-918 server-side request forgery)
• Fixed "Attempt to assign property step on null" error when using a {for} loop inside a block of an extended template #1036

New Contributors

• @​antman3351 made their first contribution in smarty-php/smarty#1071

Full Changelog: smarty-php/smarty@v5.8.1...v5.8.2

v5.8.1

What's Changed

• Bugfix/issue 1189 inheritance state leak by @​wisskid in smarty-php/smarty#1190

Internal changes

• Redirect test temp dirs to system temp directory. Fixes #1178 by @​wisskid in smarty-php/smarty#1179
• fix: correct return type in retrieveCachedContent docblock by @​zigzagdev in smarty-php/smarty#1180

New Contributors

• @​zigzagdev made their first contribution in smarty-php/smarty#1180

Full Changelog: smarty-php/smarty@v5.8.0...v5.8.1

v5.8.0

What's Changed

• Document missing inline implementation. Fixed #1152 by @​wisskid in smarty-php/smarty#1156
• Fix static analysis warnings for isDot() and remove deprecated APC support by @​h-marumoto in smarty-php/smarty#1164
• Support for Laravel Collections style object chaining by @​wisskid in smarty-php/smarty#1168
• Regex matches operator by @​wisskid in smarty-php/smarty#1169
• Add support for Backed Enums by @​wisskid in smarty-php/smarty#1171

Full Changelog: smarty-php/smarty@v5.7.0...v5.8.0

Changelog

Sourced from smarty/smarty's changelog.

[5.8.4] - 2026-06-29

• Fixed a TypeError on PHP 8 when Security::$static_classes was set to a non-array value (e.g. the string 'none') to disable static class access; any non-array value now cleanly denies access. Use Security::$static_classes = null to disable access to all static classes.
• Security: the built-in stream: resource type now validates the nested stream wrapper against the security policy, so a template such as stream:php://filter/... can no longer bypass Security::$streams (including Security::$streams = null) to read local files (CWE-22)

[5.8.3] - 2026-06-28

• fixed a regression from #1189 where a child template's block override no longer applied to a template {include}d by the parent #1192

[5.8.2] - 2026-06-24

• Security: prevent symlinks inside a trusted secure_dir/template directory from being used to read files outside of it (CWE-22 path traversal), affecting {include} and {fetch} of local files
• Security: {html_image} now escapes the file, path_prefix, href/link, width and height attributes (it already escaped alt and pass-through attributes), and {html_select_date} casts day_size/month_size/year_size to int (matching {html_select_time}), preventing untrusted values passed into these attributes from breaking out of the generated HTML (CWE-79)
• Security: {fetch} no longer follows HTTP redirects for remote resources while a security policy is active, preventing an open redirect on a trusted host from bypassing trusted_uri (CWE-918 server-side request forgery)
• Fixed "Attempt to assign property step on null" error when using a {for} loop inside a block of an extended template #1036

[5.8.1] - 2026-06-23

• Re-activated unit tests for user literals, which were previously disabled due to a bug in refactoring to v5.
• fixed a bug where child template's block content leaked into subsequent rendering of the parent template #1189
• Moved all unit test-generated output from inside the working tree to tmp files #1178

[5.8.0] - 2026-02-15

• Added support for Backed Enums for php versions >= 8.1 #1171
• Added support for new 'matches' operator doing regex matching #1169
• Update documentation to clarify that include inline is currently not implemented in Smarty v5 #1152
• Support for Laravel Collections style object chaining for objects return from function calls implemented as modifiers #1151

Commits

• 94a27cb Merge branch 'release/5.8.4'
• badc5ef version bump
• 2ae0f9a Fix TypeError for non-array static_classes in Security policy (#1198)
• b668745 drop unused version attribute from docker-compose.yml
• 3c9f77a Security: validate nested stream wrapper in stream: resource (CWE-22) (#1195)
• 042dff6 Merge branch 'release/5.8.3'
• 1830aa7 version bump
• b83ffdd requirements for building docs, switched test-runner from mutagen to basic do...
• ac27e1e fixed a regression from #1189 where a child template's block override no long...
• 17fae11 update documentation for building and previewing with mkdocs, fix unit tests ...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[civibot]

🤖 Thank you for contributing to CiviCRM! ❤️ We will need to test and review this PR. 👷

Introduction for new contributors...

• If this is your first PR, an admin will greenlight automated testing with the command ok to test or add to whitelist.
• A series of tests will automatically run. You can see the results at the bottom of this page (if there are any problems, it will include a link to see what went wrong).
• A demo site will be built where anyone can try out a version of CiviCRM that includes your changes.
• If this process needs to be repeated, an admin will issue the command test this please to rerun tests and build a new demo site.
• Before this PR can be merged, it needs to be reviewed. Please keep in mind that reviewers are volunteers, and their response time can vary from a few hours to a few weeks depending on their availability and their knowledge of this particular part of CiviCRM.
• A great way to speed up this process is to "trade reviews" with someone - find an open PR that you feel able to review, and leave a comment like "I'm reviewing this now, could you please review mine?" (include a link to yours). You don't have to wait for a response to get started (and you don't have to stop at one!) the more you review, the faster this process goes for everyone 😄
• To ensure that you are credited properly in the final release notes, please add yourself to contributor-key.yml
• For more information about contributing, see CONTRIBUTING.md.

PR commands & links...

• /rebase <branch-name> will rebase your branch and change the base of the PR.
• /squash will combine all commits (keeping only the first commit messsage).
• /port <branch-name> will create a copy of this PR against a different branch.
• /lintroll will automatically fix linting errors, amending commits as needed.
• retest this please will rerun the tests and rebuild the demo site.
• 📖 Review standards
• 🗒️ Review template (brief or verbose)

➡️ Online demo of this PR 🔗