Introduction

While running composer audit on a production EC-CUBE 4.3 site, I found a security advisory against twig/twig . "Just bump it to the patched version" — so I updated Twig from the 3.8 line to 3.30 and deployed to the dev environment. Every single page returned 500.

Why does a minor update within the same 3.x line break things this badly? The cause was the return types Twig added to its abstract methods in 3.12.0. This post is a record of the investigation, the 6-line fix, and the verification.

What happened — 500s everywhere and a Fatal error

Right after the deploy, every URL returned 500.…