npm / liquidjs

liquidjs

What changed in liquidjs 10, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-19.

12 security2 new APIs and options1 behavior and defaults8 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

liquidjs 1023 changes

LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, .first/.last, negative index, and for-loop iteration
10.27.2security advisory
LiquidJS: Uncontrolled Resource Consumption in join filter allows template authors to bypass memoryLimit and crash the process
10.27.2security advisory
LiquidJS has an infinite loop vulnerability in its strip_html filter
10.27.1security advisory
LiquidJS: pop filter bypasses memoryLimit accounting that its array-filter siblings enforce
10.27.1security advisory
LiquidJS is Vulnerable to Remote Code Execution
10.26.0security advisory
LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in strip_html Filter Regex
10.26.0security advisory
liquidjs has a Denial of Service via circular block reference in layout
10.25.7security advisory
LiquidJS: renderFile() / parseFile() bypass configured root and allow arbitrary file read
10.25.5security advisory
LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel
10.25.4security advisory
LiquidJS Has Memory Limit Bypass via Quadratic Amplification in replace Filter
10.25.3security advisory
LiquidJS: Root restriction bypass for partial and layout loading through symlinked templates
10.25.3security advisory
liquidjs has a path traversal fallback vulnerability
10.25.0security advisory

Encodes large input in browser builds.
10.30.0release notes
Computes %C and %y from the numeric year.
10.30.0release notes
Computes %U and %W week numbers like strftime.
10.30.0release notes
Awaits promises returned by Drop.valueOf().
10.30.0release notes
Trims custom characters by Unicode code point.
10.30.0release notes
Ignores leading whitespace when counting words.
10.30.0release notes
Keeps %2B as a literal plus when decoding.
10.30.0release notes
The %s date format returns the Unix epoch regardless of display timezone.
10.28.0release notes