Bump liquidjs from 10.16.1 to 10.27.2 by dependabot[bot] · Pull Request #24 · src-CHANGELOG-md/docs

dependabot · 2026-09-08T19:46:08Z

Bumps liquidjs from 10.16.1 to 10.27.2.

Release notes

v10.27.2

10.27.2 (2026-07-09)

Bug Fixes

charge join/json/inspect filters by produced output size (#925) (7ab49f9)

date: zero-pad milliseconds when formatting %N fractional seconds (#929) (2634f9d)

enforce ownPropertyOnly for inherited array indices (#924) (552819a)

filters: modulo should follow divisor sign for negative operands (#922) (568bd5f)

filters: return empty for out-of-range slice begin or negative length (#928) (f9a1316)

v10.27.1

10.27.1 (2026-06-23)

Bug Fixes

improve round function; improvement to #873 (#901) (956b51e)

security: charge pop filter allocation to memoryLimit (#907) (8a0c74a)

strip_html: infinite loop for strip_html (5c3522f)

Performance Improvements

parser: memoize createTrie to avoid rebuilding tries per Tokenizer (#911) (3a0d80d)

v10.27.0

10.27.0 (2026-05-15)

Features

context: null-prototype scope frames via createScope (#899) (47d3f1b)

v10.26.0

10.26.0 (2026-05-14)

Bug Fixes

date: cap strftime widths and account padding in memoryLimit (#895) (3129d46)

enforce renderLimit for empty renderTemplates calls (#894) (5b9c346)

propagate ownPropertyOnly into Context.spawn() for {% render %} (#893) (dbbf628)

security: block Object.prototype filter/tag lookups (RCE) (#897) (457fae0)

strip html newline tags (#892) (26ea285)

strip_html: rewrite as linear single-pass scan to avoid ReDoS (#896) (3616a74)

Features

... (truncated)

Changelog

Sourced from liquidjs's changelog.

10.27.2 (2026-07-09)

Bug Fixes

charge join/json/inspect filters by produced output size (#925) (7ab49f9)

date: zero-pad milliseconds when formatting %N fractional seconds (#929) (2634f9d)

enforce ownPropertyOnly for inherited array indices (#924) (552819a)

filters: modulo should follow divisor sign for negative operands (#922) (568bd5f)

filters: return empty for out-of-range slice begin or negative length (#928) (f9a1316)

10.27.1 (2026-06-23)

Bug Fixes

improve round function; improvement to #873 (#901) (956b51e)

security: charge pop filter allocation to memoryLimit (#907) (8a0c74a)

strip_html: infinite loop for strip_html (5c3522f)

Performance Improvements

parser: memoize createTrie to avoid rebuilding tries per Tokenizer (#911) (3a0d80d)

10.27.0 (2026-05-15)

Features

context: null-prototype scope frames via createScope (#899) (47d3f1b)

10.26.0 (2026-05-14)

Bug Fixes

date: cap strftime widths and account padding in memoryLimit (#895) (3129d46)

enforce renderLimit for empty renderTemplates calls (#894) (5b9c346)

propagate ownPropertyOnly into Context.spawn() for {% render %} (#893) (dbbf628)

security: block Object.prototype filter/tag lookups (RCE) (#897) (457fae0)

strip html newline tags (#892) (26ea285)

strip_html: rewrite as linear single-pass scan to avoid ReDoS (#896) (3616a74)

Features

add sha256 and hmac_sha256 filters for cryptographic operations (#889) (1c816d4)

10.25.7 (2026-04-23)

... (truncated)

Commits

050f161 chore(release): 10.27.2 [skip ci]
2634f9d fix(date): zero-pad milliseconds when formatting %N fractional seconds (#929)
f9a1316 fix(filters): return empty for out-of-range slice begin or negative length (#...
7ab49f9 fix: charge join/json/inspect filters by produced output size (#925)
552819a fix: enforce ownPropertyOnly for inherited array indices (#924)
8bfb642 docs: add spokodev as a contributor for code (#923)
568bd5f fix(filters): modulo should follow divisor sign for negative operands (#922)
ed48986 chore(release): 10.27.1 [skip ci]
afec88b docs(readme): README overhaul, used-by grid, and docs homepage (#914)
3a0d80d perf(parser): memoize createTrie to avoid rebuilding tries per Tokenizer (#911)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for liquidjs since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [liquidjs](https://github.com/harttle/liquidjs) from 10.16.1 to 10.27.2. - [Release notes](https://github.com/harttle/liquidjs/releases) - [Changelog](https://github.com/harttle/liquidjs/blob/master/CHANGELOG.md) - [Commits](harttle/liquidjs@v10.16.1...v10.27.2) --- updated-dependencies: - dependency-name: liquidjs dependency-version: 10.27.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

fossabot · 2026-09-08T19:46:12Z

Needs Review

I recommend reviewing this upgrade before merging because, while it delivers significant security remediation by resolving 15 OSV-validated vulnerabilities across critical, high, medium, and low severity classifications, it also introduces several behavioral changes in a foundational dependency that powers the entire documentation engine. Notably, the blocking of Object.prototype filter/tag lookups (a security hardening change) and the introduction of null-prototype scope frames via createScope could subtly affect the project's custom Tag subclass in ifversion.js, which directly accesses ctx.environments.currentVersionObj in its render logic. Additionally, remove-liquid-statements.js relies on the hardcoded numeric value 4 to identify liquid tags via elem.kind === 4 rather than using the TokenKind.Tag named export — this is fragile across major enum refactors, though EdgeBit detected no symbol-level changes. The expanded memoryLimit enforcement (now covering pop, join, json, and inspect filters) is not currently a concern as no memoryLimit is configured in engine.js. The overall scope of the upgrade is large (38 new features, 39 bug fixes over 11 minor versions), making end-to-end testing of the rendering pipeline — particularly for versioned content, custom tags, and linting rules — strongly advisable before merging.

Tip: Comment @fossabot fix to attempt automatic fixes.

Fix Suggestions

We identified 3 fixable issues in this upgrade.

Replace hardcoded elem.kind === 4 with elem.kind === TokenKind.Tag to avoid silent breakage if the enum values shift in a future liquidjs release
Files: src/ghes-releases/scripts/remove-liquid-statements.js
Verify custom tag environment access patterns (ctx.environments.currentVersionObj and scope.environments.currentLanguage) work correctly under liquidjs 10.27.x null-prototype scope frames
Files: src/content-render/liquid/ifversion.js, src/content-render/liquid/data.js
Run end-to-end rendering tests for versioned content, custom tags (ifversion, data, octicon), and linting rules to validate liquidjs 10.27.2 compatibility
Files: src/content-render/liquid/engine.js and 4 other files

AI Assistant Prompt

Copy prompt for AI assistant

# Fix liquidjs Dependency Upgrade Issues

## Context
`liquidjs` has been upgraded spanning 11 minor versions (up to 10.27.2). This is a critical security update resolving 15 vulnerabilities, including path traversal and RCE flaws. Key behavioral changes include:
- **Object.prototype filter/tag lookup blocking** (10.26.0) — security hardening
- **Null-prototype scope frames** via `createScope` (10.27.0) — affects how `ctx.environments` works
- **Minimum Node.js 16** requirement (breaking change)

---

## Fix 1: Replace hardcoded enum value with `TokenKind.Tag` named export

**File:** `src/ghes-releases/scripts/remove-liquid-statements.js`

**Problem:** Line 216 uses `elem.kind === 4` (a hardcoded numeric value) to identify Liquid tags. This is fragile and will silently break if `TokenKind` enum values shift in a future release. The rest of the codebase already uses the named export.

**Current code (line 1):**
```js
import { Tokenizer } from 'liquidjs'
```

**Change to:**
```js
import { Tokenizer, TokenKind } from 'liquidjs'
```

**Current code (line 216):**
```js
.filter((elem) => elem.kind === 4)
```

**Change to:**
```js
.filter((elem) => elem.kind === TokenKind.Tag)
```

**Reference:** Five linting rule files already use this pattern correctly, e.g.:
- `src/content-linter/lib/linting-rules/liquid-versioning.js` (line 60): `token.kind === TokenKind.Tag`
- `src/content-linter/lib/linting-rules/liquid-tag-whitespace.js` (line 26): `token.kind === TokenKind.Tag`
- `src/content-linter/lib/linting-rules/liquid-data-tags.js` (line 25): `token.kind === TokenKind.Tag`

This is the only automated code fix needed. The changes below are verification steps.

---

## Verification 1: Custom tag environment access under null-prototype scopes

**Files to inspect (no code changes expected, just verify behavior):**
- `src/content-render/liquid/ifversion.js` — line 55: `ctx.environments.currentVersionObj`
- `src/content-render/liquid/data.js` — check for `scope.environments.currentLanguage` or similar

**What to check:** LiquidJS 10.27.0 introduced null-prototype scope frames via `createScope`. The `ifversion.js` custom `Tag` subclass accesses `ctx.environments.currentVersionObj` in its `render` method (line 55). Null-prototype objects still hold own properties, so direct property access should work. However, verify that:
1. No code uses `hasOwnProperty`, `toString`, or `in` checks on scope objects
2. No code relies on prototype chain lookups for environment values
3. The existing test suite for versioned content rendering passes without regressions

**Engine config** (`src/content-render/liquid/engine.js`): No `memoryLimit` is configured, so the expanded `memoryLimit` enforcement in new filters (`pop`, `join`, `json`, `inspect`) is not a concern.

---

## Verification 2: Run the full test suite

After making the Fix 1 code change, run the full test suite to validate compatibility:

1. **Versioned content rendering** — tests for `ifversion` tag behavior
2. **Custom tags** — `data`, `octicon`, `indented_data_reference`, `tool`, `spotlight`
3. **Content linting rules** — all five rules that use `TokenKind`:
   - `liquid-versioning.js`
   - `liquid-tag-whitespace.js`
   - `liquid-quoted-conditional-arg.js`
   - `liquid-data-tags.js`
   - `rai-reusable-usage.js`
4. **GHES release scripts** — `remove-liquid-statements.js` (the file we modified)

Pay particular attention to any rendering differences in version-gated content blocks.

What we checked

Dependency declared as "liquidjs": "^10.27.2" in dependencies, confirming the upgrade from 10.16.1 to 10.27.2. This is a pervasive foundational dependency used across rendering, linting, and release engineering pipelines. ^[1]
CVE-2026-45618 (Critical): Affected versions < 10.26.0. Fixed in 10.26.0, and thus remediated by upgrading to 10.27.2. This is the most severe of 15 validated CVEs resolved by this upgrade. ^[2]
CVE-2026-55575 (High): Affected versions < 10.27.1. Fixed in 10.27.1, and thus remediated by this upgrade to 10.27.2. ^[3]
CVE-2026-41311 (High): Affected versions < 10.25.7. Fixed in 10.25.7, and thus remediated by this upgrade. ^[4]
LiquidJS 10.26.0 introduced blocking of Object.prototype filter and tag lookups as a security hardening measure. While the project's custom filters (obj_size, version_num, slugify) and tags (ifversion, data, octicon, etc.) are explicitly registered via registerTag/registerFilter and are not prototype-chain-dependent, this behavioral change warrants verification that no template inadvertently relies on prototype resolution paths. ^[5]
LiquidJS 10.27.0 introduced null-prototype scope frames via createScope. This changes internal scope initialization and may affect custom tag or filter implementations that inspect scope objects. The project's ifversion.js directly accesses ctx.environments.currentVersionObj inside its render generator, and data.js accesses scope.environments.currentLanguage — these patterns should be verified against the new scope behavior. ^[6]
The custom ifversion tag (which extends Tag from liquidjs) accesses ctx.environments.currentVersionObj directly. The null-prototype scope frames introduced in 10.27.0 change how scope objects are internally initialized; this direct environment access pattern should be tested to ensure currentVersionObj is still accessible after the upgrade. ^[7]
The custom data tag accesses scope.environments.currentLanguage and scope.environments.currentLanguage directly in its render function. Like ifversion.js, this environment access pattern should be verified under the scope-frame changes in the new version. ^[8]
This file uses hardcoded numeric value elem.kind === 4 to detect liquid tags (comment on line 214 explains this is the enum value for a liquid tag). Other files in the codebase use TokenKind.Tag by name. If the TokenKind enum values shift in a future release, this will fail silently. EdgeBit reports no symbol changes, so this is low risk now, but the pattern is fragile and merits attention. ^[9]
Tokenizer is imported from liquidjs and used across five linting rules via tokenizer.readTopLevelTokens(). EdgeBit detected no API symbol changes, so this public API surface appears stable across the version range. ^[10]
new Liquid({ extname: '.html', dynamicPartials: false }) — no memoryLimit is configured, which means the extended memoryLimit enforcement added to pop, join, json, and inspect filters in 10.27.1–10.27.2 will not trigger in this deployment. ^[11]
A Dependabot bump of liquidjs 10.20.1 → 10.27.2 in the ceph.io project showed no reported breakage in PR comments, suggesting the upgrade is routine for typical usage patterns. However, this project's usage is more complex with custom Tag subclasses and direct scope access. ^[12]

Dependency Usage

liquidjs is a foundational templating dependency used pervasively across four major subsystems: content rendering, content linting, GHES release management, and developer tooling scripts. It powers the core documentation engine in src/content-render/liquid/ — enabling dynamic page rendering, custom tags like ifversion for version-gated content, and octicon rendering — while its Tokenizer and TokenKind primitives drive five content linting rules in src/content-linter/ that enforce Liquid syntax quality and versioning correctness. Beyond runtime rendering, liquidjs also supports operational workflows such as stripping Liquid statements from GHES release artifacts, detecting orphaned feature flags, and generating enterprise release issues, making it a cross-cutting dependency critical to both the documentation publishing pipeline and the release engineering process.

The custom ifversion tag (which extends Tag from liquidjs) accesses ctx.environments.currentVersionObj directly. The null-prototype scope frames introduced in 10.27.0 change how scope objects are internally initialized; this direct environment access pattern should be tested to ensure currentVersionObj is still accessible after the upgrade.

docs/src/content-render/liquid/ifversion.js

Line 55 in 7ab22ec

this.currentVersionObj = ctx.environments.currentVersionObj
The custom data tag accesses scope.environments.currentLanguage and scope.environments.currentLanguage directly in its render function. Like ifversion.js, this environment access pattern should be verified under the scope-frame changes in the new version.

docs/src/content-render/liquid/data.js

Line 20 in 7ab22ec

let text = getDataByLanguage(this.path, scope.environments.currentLanguage)

View 3 more usages

This file uses hardcoded numeric value elem.kind === 4 to detect liquid tags (comment on line 214 explains this is the enum value for a liquid tag). Other files in the codebase use TokenKind.Tag by name. If the TokenKind enum values shift in a future release, this will fail silently. EdgeBit reports no symbol changes, so this is low risk now, but the pattern is fragile and merits attention.

docs/src/ghes-releases/scripts/remove-liquid-statements.js

Line 216 in 7ab22ec

.filter((elem) => elem.kind === 4)
Tokenizer is imported from liquidjs and used across five linting rules via tokenizer.readTopLevelTokens(). EdgeBit detected no API symbol changes, so this public API surface appears stable across the version range.

docs/src/content-linter/lib/helpers/liquid-utils.js

Line 1 in 7ab22ec

import { Tokenizer } from 'liquidjs'
new Liquid({ extname: '.html', dynamicPartials: false }) — no memoryLimit is configured, which means the extended memoryLimit enforcement added to pop, join, json, and inspect filters in 10.27.1–10.27.2 will not trigger in this deployment.

docs/src/content-render/liquid/engine.js

Line 10 in 7ab22ec

export const engine = new Liquid({

Less Important Usages (18)

These usages were analyzed but no breaking changes were detected:

liquidjs

docs/src/versions/scripts/use-short-versions.js

Line 6 in 7ab22ec

import { Tokenizer } from 'liquidjs'
docs/src/ghes-releases/scripts/remove-liquid-statements.js

Line 1 in 7ab22ec

import { Tokenizer } from 'liquidjs'
docs/src/ghes-releases/scripts/get-liquid-conditionals.js

Line 4 in 7ab22ec

import { Tokenizer } from 'liquidjs'
docs/src/ghes-releases/scripts/create-enterprise-issue.js

Line 5 in 7ab22ec

import { Liquid } from 'liquidjs'
docs/src/content-render/liquid/octicon.js

Line 1 in 7ab22ec

import { TokenizationError } from 'liquidjs'
...and 13 more

Changes

Critical security update: liquidjs was upgraded with 4 security fixes, including a path traversal vulnerability, a remote code execution flaw via Object.prototype filter/tag lookups, and a memoryLimit bypass in the pop filter. A breaking change increases the minimum Node.js requirement to v16, so any environments still on Node.js 14 or 15 must upgrade their runtime before deploying this change.

Minimum Node.js version requirement increased from >=14 to >=16 - users running Node.js 14 or 15 must upgrade their runtime environment (v10.22.0, package source)
path traversal vulnerability, #851 (#855) (3cd024d) (v10.24.0-10.25.0, changelog)
security: block Object.prototype filter/tag lookups (RCE) (#897) (457fae0) (v10.25.7-10.26.0, changelog)

View 248 more changes

security: charge pop filter allocation to memoryLimit (#907) (8a0c74a) (v10.27.0-10.27.1, changelog)
support for NodeJS 15, fixes #732 (4548c11) (v10.16.2-10.16.3, changelog)
memory limit issue for join filter, fix #737 (2d59cff) (v10.16.3-10.16.4, changelog)
use cwd to resolve npm partials for Node.JS (e5fbdfe) (v10.16.6-10.16.7, changelog)
inconsistent continue behaviour, fixes #779 (e3ef574) (v10.19.0-10.19.1, changelog)
empty tagToken.args since 10.20.0, fixes #796 (38a0f51) (v10.20.2-10.20.3, changelog)
add sideEffects=false to package.json (734eb52) (v10.19.0-10.19.1, changelog)
add find_index, has, and reject filters (#799) (0deb93e) (v10.20.3-10.21.0, changelog)
filters: Add base64_encode and base64_decode filters for Shopify compatibility (#828) (86fc135) (v10.23.0-10.24.0, changelog)
date: cap strftime widths and account padding in memoryLimit (#895) (3129d46) (v10.25.7-10.26.0, changelog)
strip html newline tags (#892) (26ea285) (v10.25.7-10.26.0, changelog)
add sha256 and hmac_sha256 filters for cryptographic operations (#889) (1c816d4) (v10.25.7-10.26.0, changelog)
support for NodeJS 14 (85bd0d3) (v10.16.1-10.16.2, changelog)
"filter is not a function" for uniq (68387c3) (v10.16.3-10.16.4, changelog)
ESM bundle for Node.js, #739 (ce84cd6) (v10.16.4-10.16.5, changelog)
expose originalError from LiquidError, #742 (86f6bf0) (v10.16.5-10.16.6, changelog)
use CommonJS bundle to support default export (2543461) (v10.16.6-10.16.7, changelog)
support custom key-value separator, #752 (6aeed25) (v10.16.7-10.17.0, changelog)
expose FilterToken to filter this, #762 (d705888) (v10.17.0-10.18.0, changelog)
allow drops in property access (#769) (11f013b) (v10.18.0-10.19.0, changelog)
support Jekyll style where, #768 (9107eb1) (v10.18.0-10.19.0, changelog)
memoryLimit doesn't work in for tag, #776 (2af297f) (v10.19.0-10.19.1, changelog)
size, first, last support arraylike objects, #781 (35a8442) (v10.19.1-10.20.0, changelog)
static variable analysis (#770) (3492ff6) (v10.19.1-10.20.0, changelog)
break/continue stops whole template, #783 (5f1a4cf) (v10.20.0-10.20.1, changelog)
enumerate plain objects in where/where_exp, #785 (#788) (25ef104) (v10.20.0-10.20.1, changelog)
preserveTimezones support for RFC2822 date, #784 (59cf3c0) (v10.20.0-10.20.1, changelog)
consistent range syntax parsing, #791 (a490a70) (v10.20.1-10.20.2, changelog)
context for group_by_exp/where_exp/find_exp, #790 (a5070af) (v10.20.1-10.20.2, changelog)
block.super with strictVariables, #806 (#807) (025c40f) (v10.21.0-10.21.1, changelog)
math filters coerce invalid string to 0, #813 (#819) (e8e502c) (v10.21.1-10.22.0, changelog)
allow context access in liquidMethodMissing, #808 (#820) (e551288) (v10.21.1-10.22.0, changelog)
Export specific tokens as types (#824) (4f7d2fd) (v10.22.0-10.23.0, changelog)
export error types, resolving #837 (#840) (71aa1b1) (v10.24.0-10.25.0, changelog)
mem limiter for invalid ranges (95ddefc) (v10.25.0-10.25.1, changelog)
treat args for replace_first as literal (35d5230) (v10.25.0-10.25.1, changelog)
handle undefined replacement argument in replace filter (#864) (0ad2b11) (v10.25.1-10.25.2, changelog)
precise memoryLimit for string replace (abc058b) (v10.25.2-10.25.3, changelog)
use realpath for fs.contains (#867) (529dd67) (v10.25.2-10.25.3, changelog)
sort and sort_natural filters bypass ownPropertyOnly (#869) (e743da0) (v10.25.3-10.25.4, changelog)
enforce root containment for renderFile/parseFile lookups (#870) (f41c1fc) (v10.25.4-10.25.5, changelog)
null date should return empty (#868) (#872) (4f9a499) (v10.25.4-10.25.5, changelog)
rounding negative away from zero when half (#873) (1cdf10b) (v10.25.4-10.25.5, changelog)
nested block for layout (#883) (e2311df) (v10.25.5-10.25.6, changelog)
filters: support Buffer input in base64_encode to prevent binary data corruption (#881) (0ee6dbb) (v10.25.6-10.25.7, changelog)
enforce renderLimit for empty renderTemplates calls (#894) (5b9c346) (v10.25.7-10.26.0, changelog)
propagate ownPropertyOnly into Context.spawn() for {% render %} (#893) (dbbf628) (v10.25.7-10.26.0, changelog)
strip_html: rewrite as linear single-pass scan to avoid ReDoS (#896) (3616a74) (v10.25.7-10.26.0, changelog)
context: null-prototype scope frames via createScope (#899) (47d3f1b) (v10.26.0-10.27.0, changelog)
improve round function; improvement to #873 (#901) (956b51e) (v10.27.0-10.27.1, changelog)
strip_html: infinite loop for strip_html (5c3522f) (v10.27.0-10.27.1, changelog)
parser: memoize createTrie to avoid rebuilding tries per Tokenizer (#911) (3a0d80d) (v10.27.0-10.27.1, changelog)
charge join/json/inspect filters by produced output size (#925) (7ab49f9) (v10.27.1-10.27.2, changelog)
date: zero-pad milliseconds when formatting %N fractional seconds (#929) (2634f9d) (v10.27.1-10.27.2, changelog)
enforce ownPropertyOnly for inherited array indices (#924) (552819a) (v10.27.1-10.27.2, changelog)
filters: modulo should follow divisor sign for negative operands (#922) (568bd5f) (v10.27.1-10.27.2, changelog)
filters: return empty for out-of-range slice begin or negative length (#928) (f9a1316) (v10.27.1-10.27.2, changelog)
Fixed path traversal vulnerability (Update creating-a-personal-access-token.md with correct screenshot for Step 6 (lines 28 - 29) github/docs#851) (v10.24.0-10.25.0, commit)
fix: support for NodeJS 14 (v10.16.1-10.16.2, commit)
fix: import performance object from perf_hooks (v10.16.1-10.16.2, commit)
Fix support for NodeJS 15 (v10.16.2-10.16.3, commit)
Fix "filter is not a function" error for uniq filter (v10.16.3-10.16.4, commit)
Fix memory limit issue for join filter (fix endpoints-available-for-github-apps page github/docs#737) (v10.16.3-10.16.4, commit)
Fix liquid snippet highlight in documentation (v10.16.3-10.16.4, commit)
Fix styles and escape in documentation (v10.16.3-10.16.4, commit)
Fix ESM bundle for Node.js (Update configuring-autolinks-to-reference-external-resources.md github/docs#739) (v10.16.4-10.16.5, commit)
Fix: expose originalError from LiquidError (Update configuring-protected-branches.md github/docs#742) (v10.16.5-10.16.6, commit)
Use cwd to resolve npm partials for Node.js (v10.16.6-10.16.7, commit)
Fix inconsistent continue behaviour (@LibraryDubai github/docs#779) (v10.19.0-10.19.1, commit)
Fix memoryLimit not working in for tag (Ma rooster 🐔 github/docs#776) (v10.19.0-10.19.1, commit)
Fix: enumerate plain objects in where/where_exp filters (Fix tags of "Publishing Node.js packages" github/docs#785) (v10.20.0-10.20.1, commit)
Fix: add preserveTimezones support for RFC2822 date parsing (Update verifying-your-email-address.md github/docs#784) (v10.20.0-10.20.1, commit)
Fix: break/continue statements now stop entire template execution (.> github/docs#783) (v10.20.0-10.20.1, commit)
Fix consistent range syntax parsing (https://opensource.org/licenses/MIT github/docs#791) (v10.20.1-10.20.2, commit)
Fix context for group_by_exp/where_exp/find_exp (https://opensource.org/licenses/MIT github/docs#790) (v10.20.1-10.20.2, commit)
Fix empty tagToken.args issue that occurred since version 10.20.0 (fixes Enterprise Administrators.md github/docs#796) (v10.20.2-10.20.3, commit)
Fix block.super with strictVariables (Update docs around what image formats are supported by GHCR github/docs#806, repo sync github/docs#807) (v10.21.0-10.21.1, commit)
Fix formatting bug in echo.md (Discussion beta docs github/docs#805) (v10.21.0-10.21.1, commit)
Fix typo in options.md (yes github/docs#802) (v10.21.0-10.21.1, commit)
Fix Markdown formatting in documentation (Update about-billing-for-github-actions.md github/docs#803) (v10.21.0-10.21.1, commit)
Fix math filters to coerce invalid strings to 0 (Search Docs don't specify HTML-encoding query strings github/docs#819) (v10.21.1-10.22.0, commit)
Fix Github artifact name in release workflow (repo sync github/docs#821) (v10.21.1-10.22.0, commit)
Fix: treat args for replace_first as literal (v10.25.0-10.25.1, commit)
Fix: mem limiter for invalid ranges (v10.25.0-10.25.1, commit)
Fix: handle undefined replacement argument in replace filter (fix: Use pull_request_target for SECRET access github/docs#864) (v10.25.1-10.25.2, commit)
Fix use of realpath for fs.contains (Update creating-a-personal-access-token.md github/docs#867) (v10.25.2-10.25.3, commit)
Fix precise memoryLimit for string replace (v10.25.2-10.25.3, commit)
Fix sort and sort_natural filters to bypass ownPropertyOnly (v10.25.3-10.25.4, commit)
Fix rounding of negative numbers away from zero when half (v10.25.4-10.25.5, commit)
Fix null date to return empty (v10.25.4-10.25.5, commit)
Fix nested block for layout (v10.25.5-10.25.6, commit)
Fix base64_encode filter to support Buffer input and prevent binary data issues (v10.25.6-10.25.7, commit)
chore: add Node 14 to CI pipeline (v10.16.1-10.16.2, commit)
docs: add vrugtehagel as a contributor for code (v10.16.1-10.16.2, commit)
Add internal types in apidoc (v10.16.2-10.16.3, commit)
Add WISMOlabs use case to README (v10.16.3-10.16.4, commit)
Add CI test for demos (v10.16.4-10.16.5, commit)

View 151 more changes in the full analysis

References (12)

[1]: Dependency declared as "liquidjs": "^10.27.2" in dependencies, confirming the upgrade from 10.16.1 to 10.27.2. This is a pervasive foundational dependency used across rendering, linting, and release engineering pipelines.

docs/package.json

Line 293 in 7ab22ec

"liquidjs": "^10.27.2",

[2]: CVE-2026-45618 (Critical): Affected versions < 10.26.0. Fixed in 10.26.0, and thus remediated by upgrading to 10.27.2. This is the most severe of 15 validated CVEs resolved by this upgrade. (source link)

[3]: CVE-2026-55575 (High): Affected versions < 10.27.1. Fixed in 10.27.1, and thus remediated by this upgrade to 10.27.2. (source link)

[4]: CVE-2026-41311 (High): Affected versions < 10.25.7. Fixed in 10.25.7, and thus remediated by this upgrade. (source link)

[5]: LiquidJS 10.26.0 introduced blocking of Object.prototype filter and tag lookups as a security hardening measure. While the project's custom filters (obj_size, version_num, slugify) and tags (ifversion, data, octicon, etc.) are explicitly registered via registerTag/registerFilter and are not prototype-chain-dependent, this behavioral change warrants verification that no template inadvertently relies on prototype resolution paths. (source link)

[6]: LiquidJS 10.27.0 introduced null-prototype scope frames via createScope. This changes internal scope initialization and may affect custom tag or filter implementations that inspect scope objects. The project's ifversion.js directly accesses ctx.environments.currentVersionObj inside its render generator, and data.js accesses scope.environments.currentLanguage — these patterns should be verified against the new scope behavior. (source link)

[7]: The custom ifversion tag (which extends Tag from liquidjs) accesses ctx.environments.currentVersionObj directly. The null-prototype scope frames introduced in 10.27.0 change how scope objects are internally initialized; this direct environment access pattern should be tested to ensure currentVersionObj is still accessible after the upgrade.

docs/src/content-render/liquid/ifversion.js

Line 55 in 7ab22ec

this.currentVersionObj = ctx.environments.currentVersionObj

[8]: The custom data tag accesses scope.environments.currentLanguage and scope.environments.currentLanguage directly in its render function. Like ifversion.js, this environment access pattern should be verified under the scope-frame changes in the new version.

docs/src/content-render/liquid/data.js

Line 20 in 7ab22ec

let text = getDataByLanguage(this.path, scope.environments.currentLanguage)

[9]: This file uses hardcoded numeric value elem.kind === 4 to detect liquid tags (comment on line 214 explains this is the enum value for a liquid tag). Other files in the codebase use TokenKind.Tag by name. If the TokenKind enum values shift in a future release, this will fail silently. EdgeBit reports no symbol changes, so this is low risk now, but the pattern is fragile and merits attention.

docs/src/ghes-releases/scripts/remove-liquid-statements.js

Line 216 in 7ab22ec

.filter((elem) => elem.kind === 4)

[10]: Tokenizer is imported from liquidjs and used across five linting rules via tokenizer.readTopLevelTokens(). EdgeBit detected no API symbol changes, so this public API surface appears stable across the version range.

docs/src/content-linter/lib/helpers/liquid-utils.js

Line 1 in 7ab22ec

import { Tokenizer } from 'liquidjs'

[11]: new Liquid({ extname: '.html', dynamicPartials: false }) — no memoryLimit is configured, which means the extended memoryLimit enforcement added to pop, join, json, and inspect filters in 10.27.1–10.27.2 will not trigger in this deployment.

docs/src/content-render/liquid/engine.js

Line 10 in 7ab22ec

export const engine = new Liquid({

[12]: A Dependabot bump of liquidjs 10.20.1 → 10.27.2 in the ceph.io project showed no reported breakage in PR comments, suggesting the upgrade is routine for typical usage patterns. However, this project's usage is more complex with custom Tag subclasses and direct scope access. (source link)

fossabot analyzed this PR using static analysis, dependency research and AI. View this analysis on the web

fossabot · 2026-09-08T19:46:13Z

fossabot · 2026-09-08T19:46:14Z

fossabot · 2026-09-08T19:46:37Z

No Issues

No application code changes were detected to scan. The PR contains only configuration files, documentation, or other non-code files.

fossabot analyzed this PR using SAST security analysis and AI (changed files only).

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 8, 2026

dependabot Bot mentioned this pull request Sep 8, 2026

Bump liquidjs from 10.16.1 to 10.27.1 #12

Closed

Navigation Menu

Bump liquidjs from 10.16.1 to 10.27.2 - #24

Bump liquidjs from 10.16.1 to 10.27.2#24
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/liquidjs-10.27.2

dependabot Bot commented on behalf of github Sep 8, 2026

Uh oh!

fossabot Bot commented Sep 8, 2026 •

edited

Loading

Uh oh!

fossabot Bot commented Sep 8, 2026 •

edited

Loading

Uh oh!

fossabot Bot commented Sep 8, 2026 •

edited

Loading

Uh oh!

fossabot Bot commented Sep 8, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 8, 2026

v10.27.2

10.27.2 (2026-07-09)

Bug Fixes

v10.27.1

10.27.1 (2026-06-23)

Bug Fixes

Performance Improvements

v10.27.0

10.27.0 (2026-05-15)

Features

v10.26.0

10.26.0 (2026-05-14)

Bug Fixes

Features

10.27.2 (2026-07-09)

Bug Fixes

10.27.1 (2026-06-23)

Bug Fixes

Performance Improvements

10.27.0 (2026-05-15)

Features

10.26.0 (2026-05-14)

Bug Fixes

Features

10.25.7 (2026-04-23)

Uh oh!

fossabot Bot commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Needs Review

Fix Suggestions

AI Assistant Prompt

What we checked

Dependency Usage

Changes

Uh oh!

fossabot Bot commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fossabot Bot commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fossabot Bot commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

No Issues

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

fossabot Bot commented Sep 8, 2026 •

edited

Loading

fossabot Bot commented Sep 8, 2026 •

edited

Loading

fossabot Bot commented Sep 8, 2026 •

edited

Loading

fossabot Bot commented Sep 8, 2026 •

edited

Loading