Twig 4.0 introduces a first-class `Sandbox` class that replaces the old extension-based sandbox approach. Previously, sandboxing untrusted templates required toggling sandbox mode on the shared application environment — a design that leaked globals, extensions, and loaders to untrusted code. The new model requires a dedicated `Environment` instance passed to a `Sandbox` object, which takes full ownership and renders all templates in isolation. The `SecurityPolicy` is now strict by default, denying anything not explicitly allow-listed. A new `SandboxBridgeExtension` and `render_sandboxed()` function handle the common CMS pattern of embedding user-authored blocks inside trusted pages. Twig 3.29 deprecates the legacy APIs, and the new `Sandbox` class works on 3.29, making migration straightforward before upgrading to 4.0.
