# What changed in liquidjs

> 23 changes in liquidjs 10 from its official release notes, upgrade guides and advisories: 12 security, 2 new APIs and options. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/npm/liquidjs/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## liquidjs 10

### Security

- LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration (10.27.2) — [security advisory](https://github.com/advisories/GHSA-FWXR-J5W2-587M)
- LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process (10.27.2) — [security advisory](https://github.com/advisories/GHSA-4R6H-5V86-94P3)
- LiquidJS has an infinite loop vulnerability in its `strip_html` filter (10.27.1) — [security advisory](https://github.com/advisories/GHSA-M7FP-H3P4-HR49)
- LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce (10.27.1) — [security advisory](https://github.com/advisories/GHSA-G357-X5C3-C72P)
- LiquidJS is Vulnerable to Remote Code Execution (10.26.0) — [security advisory](https://github.com/advisories/GHSA-GF2Q-C269-PQGC)
- LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex (10.26.0) — [security advisory](https://github.com/advisories/GHSA-R7G9-XPMJ-5FCQ)
- liquidjs has a Denial of Service via circular block reference in layout (10.25.7) — [security advisory](https://github.com/advisories/GHSA-4RC3-7J7W-M548)
- LiquidJS: `renderFile()` / `parseFile()` bypass configured `root` and allow arbitrary file read (10.25.5) — [security advisory](https://github.com/advisories/GHSA-V273-448J-V4QJ)
- LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel (10.25.4) — [security advisory](https://github.com/advisories/GHSA-RV5G-F82M-QRVV)
- LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter (10.25.3) — [security advisory](https://github.com/advisories/GHSA-MMG9-6M6J-JQQX)
- LiquidJS: Root restriction bypass for partial and layout loading through symlinked templates (10.25.3) — [security advisory](https://github.com/advisories/GHSA-56P5-8MHR-2FPH)
- liquidjs has a path traversal fallback vulnerability (10.25.0) — [security advisory](https://github.com/advisories/GHSA-WMFP-5Q7X-987X)

### New APIs and options

- Adds the squish filter. (10.29.0) — [release notes](https://github.com/harttle/liquidjs/releases/tag/v10.29.0)
- Adds the unregisterFilter method for removing a filter. (10.29.0) — [release notes](https://github.com/harttle/liquidjs/releases/tag/v10.29.0)

### Behavior and default changes

- Expressions enclosed by parentheses are now supported. (10.28.0) — [release notes](https://github.com/harttle/liquidjs/releases/tag/v10.28.0)

### Fixes and other changes

- Encodes large input in browser builds. (10.30.0) — [release notes](https://github.com/harttle/liquidjs/releases/tag/v10.30.0)
- Computes %C and %y from the numeric year. (10.30.0) — [release notes](https://github.com/harttle/liquidjs/releases/tag/v10.30.0)
- Computes %U and %W week numbers like strftime. (10.30.0) — [release notes](https://github.com/harttle/liquidjs/releases/tag/v10.30.0)
- Awaits promises returned by Drop.valueOf(). (10.30.0) — [release notes](https://github.com/harttle/liquidjs/releases/tag/v10.30.0)
- Trims custom characters by Unicode code point. (10.30.0) — [release notes](https://github.com/harttle/liquidjs/releases/tag/v10.30.0)
- Ignores leading whitespace when counting words. (10.30.0) — [release notes](https://github.com/harttle/liquidjs/releases/tag/v10.30.0)
- Keeps %2B as a literal plus when decoding. (10.30.0) — [release notes](https://github.com/harttle/liquidjs/releases/tag/v10.30.0)
- The %s date format returns the Unix epoch regardless of display timezone. (10.28.0) — [release notes](https://github.com/harttle/liquidjs/releases/tag/v10.28.0)