Declaration of craft\web\twig\tokenparsers\CacheTokenParser::parse(Twig_Token $token) must be compatible with Twig\TokenParser\TokenParserInterface::parse(Twig\Token $token)
Is the error here.

Can confirm that Twig 2.7 that dropped today kills Craft. A temporary workaround is adding a requirement for 2.6.2 to your projects composer.json and running composer update again.

"twig/twig": "2.6.2"

See this issue on the twigphp/twig repo as well twigphp/Twig#2886

Can confirm this also happens on new Craft installs. Ran into this just now when doing a composer install on a local machine.

We need 2.7.0 as 2.6.2 is not secure anymore! See https://symfony.com/blog/twig-sandbox-information-disclosure

I've tried to force 2.6.2 but…

Problem 1
    - twig/twig v2.6.2 conflicts with roave/security-advisories[dev-master].
    - roave/security-advisories dev-master conflicts with twig/twig[v2.6.2].
    - twig/twig v2.6.2 conflicts with roave/security-advisories[dev-master].
    - Installation request for twig/twig 2.6.2 -> satisfiable by twig/twig[v2.6.2].
    - Installation request for roave/security-advisories dev-master -> satisfiable by roave/security-advisories[dev-master].

Any suggestions? This has not been a happy update!

Craft version 3.1.17.2 released -> https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#31172---2019-03-12

• Craft now requires Twig ~2.6.2

That is not a fix! Every sane person that uses a security vulnerability checker in CI will still fail on this as 2.6.2 has a vulnerability. cc @iparr

See https://symfony.com/blog/twig-sandbox-information-disclosure

@boboldehampsink 3.1.17.2 and 3.0.40.1 are just stop-gaps so people's sites will stop breaking. Working on updating our custom Twig stuff for the breaking changes and will cut more releases with Twig 2.7 "real soon now". Going to go ahead and close this in the meantime.

FWIW I’ve just tried the just-released Twig 2.7.1 with Craft 3.1.17.1 and I only had to change one line in Environment.php (\Twig_Source to \Twig\Source) to get Craft working again. It looks as though the larger number of breaking changes in the initial release were unintentional.

Twig ^2.7.2 is in place for the next release (2b06c7d).