Update eftec/bladeone requirement from 3.52 to 5.0

[dependabot]

Updates the requirements on eftec/bladeone to permit the latest version.

Release notes

Sourced from eftec/bladeone's releases.

5.0.0 (2026-03)

Full list of changes applied to this working copy (baseline: upstream 4.19.1). All bug fixes were experimentally verified before and after the change, and the full test suite (84 tests / 189 assertions) passes on every step.

Breaking changes

• PHP >= 8.1 is now required (was >= 7.4). Enforced in composer.json.
• Removed ext-json from composer.json requirements (JSON is a core extension since PHP 8.0).
• Version constant bumped 4.19.1 → 5.0.0 (class VERSION + docblock @version).
• Typed signatures on the developer-facing API: code passing wrong types to typed methods now fails with TypeError instead of being silently coerced/misbehaving.

Bug fixes

• getInstance() no longer fatals on first call — $instance was a non-nullable typed static property without default, so self::$instance === null threw "Typed static property … must not be accessed before initialization". Now public static ?BladeOne $instance = null;.
• @prepend directive fixed (was doubly broken):
  • startPrepend() used array_unshift($this->pushStack[], $section) (passing a non-variable → TypeError: Argument [#1](https://github.com/EFTEC/BladeOne/issues/1) must be of type array, null given). Now array_unshift($this->pushStack, $section) — correct LIFO pairing with stopPrepend()'s array_shift (nested @prepend now works).
  • compilePrepend() generated $this->startPush(...) (copy-paste bug). Now generates $this->startPrepend(...).
• ipClient() regex fixed — pattern was /^(d{1,3}).(d{1,3}).(d{1,3}).(d{1,3})$/ (literal d, unescaped dots), so HTTP_X_FORWARDED_FOR was never validated/returned. Now /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.
• extract() collisions fixed — evaluateText() and evaluatePath() called extract($variables) without EXTR_SKIP; a view variable named content silently replaced the compiled code and compiledFile broke the include. Both now use extract($variables, EXTR_SKIP) (like runString() already did).
• compileForeach() validates its expression — a malformed @foreach($x) (no as) emitted PHP 8 warnings (Undefined array key) and silently generated broken code ($__currentLoopData = ;). Now it throws a clear RuntimeException via showError().
• Dead code removed — pointless static::last($this->componentStack); call in endSlot().
• Nullable properties now have explicit = null defaults — $currentUser, $currentRole, $baseDomain, $canonicalUrl, $currentUrl (prevents "uninitialized typed property" errors when read before being set, e.g. getCurrentUser() without setAuth()).
• isAbsolutePath() — added length guard for one-character paths on Windows (avoids Undefined offset warning reading $path[1]).

Performance optimizations (measured, php -n, min of 5 runs)

• Path memoization — getTemplateFile()/getCompiledFile() are called several times per render (compile, isExpired, evaluatePath), each doing an is_file() loop + hash. Results are now cached per view name in $templateFileCache/$compiledFileCache:
  • Only successful template lookups are cached (a template created later is still found).
  • Invalidation: setPath() and setFileExtension() clear both caches via clearPathCaches(); setCompiledExtension() and setCompileTypeFileName() clear the compiled cache.
  • Measured: run() with cached compiles ≈ 8-9 % faster (300 renders: ~24.5 ms vs ~26.8 ms).

... (truncated)

Changelog

Sourced from eftec/bladeone's changelog.

Changelog — BladeOne

5.0.0 (2026-03)

Full list of changes applied to this working copy (baseline: upstream 4.19.1). All bug fixes were experimentally verified before and after the change, and the full test suite (84 tests / 189 assertions) passes on every step.

Breaking changes

• PHP >= 8.1 is now required (was >= 7.4). Enforced in composer.json.
• Removed ext-json from composer.json requirements (JSON is a core extension since PHP 8.0).
• Version constant bumped 4.19.1 → 5.0.0 (class VERSION + docblock @version).
• Typed signatures on the developer-facing API: code passing wrong types to typed methods now fails with TypeError instead of being silently coerced/misbehaving.

Bug fixes

• getInstance() no longer fatals on first call — $instance was a non-nullable typed static property without default, so self::$instance === null threw "Typed static property … must not be accessed before initialization". Now public static ?BladeOne $instance = null;.
• @prepend directive fixed (was doubly broken):
  • startPrepend() used array_unshift($this->pushStack[], $section) (passing a non-variable → TypeError: Argument [#1](https://github.com/EFTEC/BladeOne/issues/1) must be of type array, null given). Now array_unshift($this->pushStack, $section) — correct LIFO pairing with stopPrepend()'s array_shift (nested @prepend now works).
  • compilePrepend() generated $this->startPush(...) (copy-paste bug). Now generates $this->startPrepend(...).
• ipClient() regex fixed — pattern was /^(d{1,3}).(d{1,3}).(d{1,3}).(d{1,3})$/ (literal d, unescaped dots), so HTTP_X_FORWARDED_FOR was never validated/returned. Now /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.
• extract() collisions fixed — evaluateText() and evaluatePath() called extract($variables) without EXTR_SKIP; a view variable named content silently replaced the compiled code and compiledFile broke the include. Both now use extract($variables, EXTR_SKIP) (like runString() already did).
• compileForeach() validates its expression — a malformed @foreach($x) (no as) emitted PHP 8 warnings (Undefined array key) and silently generated broken code ($__currentLoopData = ;). Now it throws a clear RuntimeException via showError().
• Dead code removed — pointless static::last($this->componentStack); call in endSlot().
• Nullable properties now have explicit = null defaults — $currentUser, $currentRole, $baseDomain, $canonicalUrl, $currentUrl (prevents "uninitialized typed property" errors when read before being set, e.g. getCurrentUser() without setAuth()).
• isAbsolutePath() — added length guard for one-character paths on Windows (avoids Undefined offset warning reading $path[1]).

Performance optimizations (measured, php -n, min of 5 runs)

• Path memoization — getTemplateFile()/getCompiledFile() are called several times per render (compile, isExpired, evaluatePath), each doing an is_file() loop + hash. Results are now cached per view name in $templateFileCache/$compiledFileCache:
  • Only successful template lookups are cached (a template created later is still found).
  • Invalidation: setPath() and setFileExtension() clear both caches via clearPathCaches();

... (truncated)

Commits

• f5fa190 5.0
• e6810d8 5.0
• a22f647 4.19.1
• 3332fab 4.19
• 55764d1 Merge pull request #203 from shokkaku-net/master
• 2addf9a uppercase + 4th match fix
• fb51dcd 4.18
• 75ce1c6 4.18
• 7f2bb41 4.17.1
• 6eaf11a 4.17.1
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
eftec/bladeone	[>= 4.a, < 5]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7b4fc833-9dc6-4040-b0a8-d27a5742b6c5

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.