Mustache.php v2.14.1 was released today. It contains a security improvement, and should be a straightforward update. https://github.com/bobthecow/mustache.php/releases/tag/v2.14.1 (You're receiving this issue because Packagist says you depend on Mustache.php)