Twig 3.27.1 is a patch release fixing two regressions from the sandbox hardening in 3.27.0. First, typed iterable arguments (like Symfony's FormView) were incorrectly being converted to plain arrays before being passed to host code, breaking type expectations. The fix now walks IteratorAggregate objects in place and passes the original object unchanged while still policy-checking yielded elements. Second, array access with a Stringable object key behaved inconsistently between the optimized and regular compiled paths. The optimized path now coerces the key to a string consistently, and in sandbox mode the coercion is subject to the __toString policy.
20.1K Impressions