fix(deps): update dependency mustache/mustache to v3

[renovate-fastnorth]

This PR contains the following updates:

Package	Change	Age	Confidence
mustache/mustache	~2.0 → ~3.0

---

Release Notes

bobthecow/mustache.php (mustache/mustache)

v3.2.0: Mustache.php v3.2.0

Compare Source

This release fixes a longstanding inheritance spec compliance bug, adds opt-in strict handling for missing tags, hardens filesystem template loading, and improves rendering diagnostics.

New:

• Add debug_rendering, an engine option for capturing the active Mustache tag stack when rendering fails. Use DEBUG_RENDERING_ON_EXCEPTION to retry failed renders with debug traces, or DEBUG_RENDERING_ALWAYS to compile traces into every render.
• Add strict_tags, a bitmask-based engine option for treating missing interpolation values, sections, partials, parent templates, and extra block overrides as failures.

Improved:

• Fix a longstanding inheritance spec compliance bug with nested parent templates. Nested layouts can now safely reuse common block names like content; overrides stay scoped to the parent they belong to instead of leaking outward and causing surprising recursion.
• Harden FilesystemLoader against path traversal and null-byte template names, including dynamic partial and parent names.
• Non-stringable output failures now throw clear exceptions. Defaults match previous Mustache.php behavior, but strict_tags can now relax coercion to render these values as empty strings.
• Context lookup now respects method visibility. Private and protected methods are treated as missing values rather than throwing exceptions.
• README and repository metadata cleanup. Thanks @​michaelwood and @​reedy.

Heads up:

• DEBUG_RENDERING_ALWAYS adds trace collection to every render, with up to 25% overhead. It is useful in development, but probably not what you want all the time.
• DEBUG_RENDERING_ON_EXCEPTION keeps successful renders fast and only pays the tracing cost after a failure. Failed templates render twice, so watch out for side effects in lambdas, helpers, or custom escaping callbacks. You don't have those in your data model, right? Right?

[!NOTE]
FilesystemLoader now rejects template names that resolve outside the configured base directory. To preserve the old behavior, pass allow_unsafe_template_names => true. This is not recommended.

v3.1.0: Mustache.php v3.1.0

Compare Source

Mustache.php v3.1.0 is primarily a performance release:

Rendering performance is significantly improved since v3.0.0; render throughput is improved by 1.66x on average. Template inheritance and deep context lookup workloads see gains of up to 2.7x. Memory usage in general is fairly flat, but for more extreme cases, peak memory usage is reduced by up to 46%.

In addition to performance, this release includes:

• Template compilation itself is also faster: lambda compilation is ~30% faster and uses ~25% less memory on extremely complex templates.
• Improved spec compliance for inheritance whitespace, specifically cases where parent-template indentation was incorrectly compounded onto inherited blocks rendered through nested partials.
• The template_class_prefix engine option validates at configuration time, rejecting invalid class-name prefixes that would lead to broken compilation.

Heads up:

• Lambdas now correctly honor the enclosing section's delimiters when re-parsing their return value. Previously, lambda return values were always re-parsed with the default {{ }} delimiters, regardless of the surrounding section. Templates that use lambdas inside custom-delimiter sections may produce different output than under v3.0.0.

v3.0.0: Mustache.php v3.0.0

Compare Source

Mustache.php v3.x drops support for PHP 5.2–5.5, but is otherwise backwards compatible with v2.x.

To ease the transition, previous behavior can be preserved via configuration:

• The strict_callables config option now defaults to true. Lambda sections should use closures or callable objects. To continue supporting array-style callables for lambda sections (e.g. [$this, 'foo']), set strict_callables to false.
• A context shadowing bug from v2.x has been fixed, but if you depend on the previous buggy behavior you can preserve it via the buggy_property_shadowing config option.
• By default the return value of higher-order sections that are rendered via the lambda helper will no longer be double-rendered. To preserve the previous behavior, set double_render_lambdas to true. This is not recommended.

[!NOTE]
In order to maintain a wide PHP version support range, there are minor changes to a few interfaces, which you might need to handle if you extend Mustache (see c0453be).

New

• \Mustache_Engine and other prefixed classnames are all available as \Mustache\Engine, etc. You can keep using the old style for now, if you feel nostalgic for 2008, but you'll want to update eventually.
• Adds support for the Mustache dynamic tag names spec for partials and interpolation.

Improved

• The {{% BLOCKS }} pragma is now part of the Mustache spec, and is enabled by default.
• Optional Mustache specs (lambdas, inheritance, and dynamic_names) can now be disabled via config options.
• No more warnings or errors in PHP 8.x (thanks @​reedy, @​swissspidy, and everyone else who helped with this!).
• Improved resolution of complicated combinations of filters, dotted name lookups, and lambdas.
• Remove autoloader implementation. Just use Composer.

---

Configuration

📅 Schedule: (in timezone America/Toronto)

• Branch creation
  • "on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[carcunha]

Blocked — production dependency with breaking API change.

• Bumps mustache/mustache 2.x → 3.x in require (not dev).
• Formatter.php uses Mustache 2 API: new \Mustache_Engine — Mustache 3 uses namespaced Mustache\Engine.
• Merging without code changes would break address formatting at runtime.

Needs a code migration + manual test pass before merge; consider widening with || ~3.0 only after compatibility work.