[shopware-octo-sts-app]

Backport: #18027
Resolves: #18028

---

1. Why is this change necessary?

Twig 3.28.0 was released on 2026-07-03 and CI installs it fresh, so every PR pipeline is red since then.
CoreExtension::include() now returns Twig\Markup instead of string, and syntax error messages gained a column suffix.

⚠️ Notes:
The other Twig 3.28 changes were audited: getAttribute() only changed internals, the new TokenParserInterface::isAlwaysAllowedInSandbox() is inherited from AbstractTokenParser by all custom token parsers, and EmptyNode returned by sw_extends/sw_use still passes the new root node validation

The ATS update 6.7.11 initially could not pass, as all 3 conditions met: old released code with the typed wrapper, no conflicts protection yet, and sw_include sitting directly on the admin login render path.

✅ Update: the ATS update 6.7.11 job passes now. The conflicts protection is live: shopware/conflicts#36 (twig/twig >=3.28) is merged and served through the new GitHub Pages composer repository (Packagist versions are immutable, so the pinned 0.6.1 could not be updated there), with the repository entry rolled out via shopware/production#189, web-installer#24 and shopware-cli#1160. The old 6.7.11.1 instance therefore resolves twig 3.27.1 again and its admin login renders. #18029 adds the same repository entry to this repo's root composer.json.

2. What does this change do, exactly?

• Widens the sw_include return type to string|Markup. This is a production fix: rendering any non-empty template through sw_include throws a TypeError under Twig 3.28.
• Relaxes the syntax error regex in StringTemplateRendererTest to accept the optional column N suffix.

Both changes stay compatible with the full ^3.26.0 constraint range.

3. Describe each step to reproduce the issue or behaviour.

Update twig/twig to 3.28.0 and run the unit suite.

Without this change the two tests above fail (TypeError and regex mismatch).
With it the full unit suite (16,444 tests) and the Twig adapter integration tests (64 tests) pass under 3.28.

4. Please link to the relevant issues (if any).

• relates fix: add conflict repo #18029 (adds the conflicts composer repository to this repo's root composer.json, so CI resolves twig through the updated conflict rules)
• Fixes Administration crashes with 500 error on Twig 3.26+ due to TwigFeaturesWithInheritanceExtension::include() strict return type #18028

5. Checklist

• I have written tests and verified that they fail without my change
• I have updated developer-facing release notes if this change is relevant for external developers:
  • Add a short entry to RELEASE_INFO-6.<major>.md under “Upcoming” for informational changes, including the consequences of the change and how it affects external developers.
  • Add an UPGRADE section in UPGRADE-6.<next-major>.md for breaking changes (what/why/impact/how to adapt).
  • See the Documenting a Release Process for details.
• I have written or adjusted the documentation according to my changes
• This change has comments for package types, values, functions, and non-obvious lines of code
• I have read the contribution requirements and fulfilled them

[github-actions]

	Warnings
⚠️	The Pull Request doesn't contain any release info, if your changes are relevant for external developers please add an entry to the release info file, including the consequences of the change and how it affects external developers. For detailed infos please refer to the [release documentation guide](https://github.com/shopware/shopware/blob/trunk/delivery-process/documenting-a-release.md).

[explore-openapi]

OpenAPI Snapshot

ℹ️ shopware/store-api — schema identical to base 6.7.12.x

ℹ️ shopware/admin-api — schema identical to base 6.7.12.x

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 64.99%. Comparing base (21081b8) to head (1420bb5).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff            @@
##           6.7.12.x   #18053   +/-   ##
=========================================
  Coverage     64.99%   64.99%           
=========================================
  Files          5019     5019           
  Lines        182396   182396           
  Branches       9908     9908           
=========================================
+ Hits         118549   118552    +3     
+ Misses        60932    60929    -3     
  Partials       2915     2915           

Flag	Coverage Δ
phpunit-migration	95.56% <ø> (ø)
phpunit-unit	60.61% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.