Update dependency twig/intl-extra to v3.26.0 [SECURITY]

[benjaminjonard]

This PR contains the following updates:

Package	Change	Age	Confidence
twig/intl-extra (source)	3.24.0 → 3.26.0

---

twig/intl-extra: Unbounded formatter memoisation in keyed on template-controlled arguments

CVE-2026-46629 / GHSA-35wc-cvqg-78fp

More information

Details

Description

IntlExtension memoises every \IntlDateFormatter and \NumberFormatter it creates in instance-level arrays keyed on a hash that includes locale, pattern, attrs and other values that are ordinary named arguments of the format_datetime / format_date / format_time / format_number / format_currency filters. There is no size limit and no eviction.

A template that iterates over many distinct pattern (or locale, or grouping_used, ...) values therefore allocates one ICU formatter object per distinct value and pins it for the entire lifetime of the Twig\Environment. Because ICU allocates its backing buffers outside the Zend memory manager, this growth is not bounded by memory_limit. On long-running runtimes (RoadRunner, Swoole, FrankenPHP worker mode, ReactPHP) where the Environment outlives a single request, the cache also accumulates across requests.

Resolution

The formatter caches are now bounded in size (100 entries each) and evict on a FIFO basis.

Credits

Twig would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.

Severity

• CVSS Score: 2.7 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

• https://github.com/twigphp/Twig/security/advisories/GHSA-35wc-cvqg-78fp
• https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/intl-extra/CVE-2026-46629.yaml
• https://symfony.com/cve-2026-46629
• https://github.com/advisories/GHSA-35wc-cvqg-78fp

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

twigphp/intl-extra (twig/intl-extra)

v3.26.0

Compare Source

Changelog (twigphp/intl-extra@v3.23.0...v3.26.0)

• security #cve-2026-46629 Fix unbounded memoisation of IntlDateFormatter / NumberFormatter (@​alexandre-daubois)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.