Merge branch '4.x' of https://github.com/craftcms/cms into 5.x

# Conflicts: # CHANGELOG.md # composer.lock
craftcms · Sep 11, 2024 · d775097 · d775097
2 parents 5e56c6d + 123e48a
commit d775097
Show file tree

Hide file tree

Showing 4 changed files with 14 additions and 9 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,10 @@
 # Release Notes for Craft CMS 5
 
+## Unreleased
+
+- Updated Twig to 3.14. ([#15704](https://github.com/craftcms/cms/issues/15704))
+- Fixed an RCE vulnerability.
+
 ## 5.4.2 - 2024-09-06
 
 - Added `craft\services\Security::isSystemDir()`.

diff --git a/composer.json b/composer.json
@@ -61,7 +61,7 @@
     "symfony/var-dumper": "^5.0|^6.0",
     "symfony/yaml": "^5.2.3",
     "theiconic/name-parser": "^1.2",
-    "twig/twig": "~3.12.0",
+    "twig/twig": "~3.14.0",
     "voku/stringy": "^6.4.0",
     "web-auth/webauthn-lib": "~4.9.0",
     "webonyx/graphql-php": "~14.11.5",

diff --git a/composer.lock b/composer.lock
diff --git a/src/helpers/FileHelper.php b/src/helpers/FileHelper.php
@@ -133,7 +133,7 @@ public static function absolutePath(
             $from = static::absolutePath($from, ds: $ds);
         }
 
-        return $from . $ds . $to;
+        return static::normalizePath($from . $ds . $to, $ds);
     }
 
     /**