Skip to content

chore(deps): bump liquidjs from 9.7.0 to 10.27.1 in /packages/webcomponents - #4732

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/packages/webcomponents/liquidjs-10.27.1
Open

chore(deps): bump liquidjs from 9.7.0 to 10.27.1 in /packages/webcomponents#4732
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/packages/webcomponents/liquidjs-10.27.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 26, 2026 •
edited by cursor Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps liquidjs from 9.7.0 to 10.27.1.

Release notes

Sourced from liquidjs's releases.

v10.27.1

10.27.1 (2026-06-23)

Bug Fixes

  • improve round function; improvement to #873 (#901) (956b51e)
  • security: charge pop filter allocation to memoryLimit (#907) (8a0c74a)
  • strip_html: infinite loop for strip_html (5c3522f)

Performance Improvements

  • parser: memoize createTrie to avoid rebuilding tries per Tokenizer (#911) (3a0d80d)

v10.27.0

10.27.0 (2026-05-15)

Features

  • context: null-prototype scope frames via createScope (#899) (47d3f1b)

v10.26.0

10.26.0 (2026-05-14)

Bug Fixes

  • date: cap strftime widths and account padding in memoryLimit (#895) (3129d46)
  • enforce renderLimit for empty renderTemplates calls (#894) (5b9c346)
  • propagate ownPropertyOnly into Context.spawn() for {% render %} (#893) (dbbf628)
  • security: block Object.prototype filter/tag lookups (RCE) (#897) (457fae0)
  • strip html newline tags (#892) (26ea285)
  • strip_html: rewrite as linear single-pass scan to avoid ReDoS (#896) (3616a74)

Features

  • add sha256 and hmac_sha256 filters for cryptographic operations (#889) (1c816d4)

v10.25.7

10.25.7 (2026-04-23)

Bug Fixes

  • filters: support Buffer input in base64_encode to prevent binary data corruption (#881) (0ee6dbb)

v10.25.6

... (truncated)

Changelog

Sourced from liquidjs's changelog.

10.27.1 (2026-06-23)

Bug Fixes

  • improve round function; improvement to #873 (#901) (956b51e)
  • security: charge pop filter allocation to memoryLimit (#907) (8a0c74a)
  • strip_html: infinite loop for strip_html (5c3522f)

Performance Improvements

  • parser: memoize createTrie to avoid rebuilding tries per Tokenizer (#911) (3a0d80d)

10.27.0 (2026-05-15)

Features

  • context: null-prototype scope frames via createScope (#899) (47d3f1b)

10.26.0 (2026-05-14)

Bug Fixes

  • date: cap strftime widths and account padding in memoryLimit (#895) (3129d46)
  • enforce renderLimit for empty renderTemplates calls (#894) (5b9c346)
  • propagate ownPropertyOnly into Context.spawn() for {% render %} (#893) (dbbf628)
  • security: block Object.prototype filter/tag lookups (RCE) (#897) (457fae0)
  • strip html newline tags (#892) (26ea285)
  • strip_html: rewrite as linear single-pass scan to avoid ReDoS (#896) (3616a74)

Features

  • add sha256 and hmac_sha256 filters for cryptographic operations (#889) (1c816d4)

10.25.7 (2026-04-23)

Bug Fixes

  • filters: support Buffer input in base64_encode to prevent binary data corruption (#881) (0ee6dbb)

10.25.6 (2026-04-19)

Bug Fixes

... (truncated)

Commits
  • ed48986 chore(release): 10.27.1 [skip ci]
  • afec88b docs(readme): README overhaul, used-by grid, and docs homepage (#914)
  • 3a0d80d perf(parser): memoize createTrie to avoid rebuilding tries per Tokenizer (#911)
  • 956b51e fix: improve round function; improvement to #873 (#901)
  • 5c3522f fix(strip_html): infinite loop for strip_html
  • 6d00257 docs: add AGENTS.md and llms.txt for AI agents (#919)
  • 03a30e6 docs: replace CookieHub with cookieconsent (#918)
  • 4775227 docs(security): route vulnerability reports to GitHub Advisories (#913)
  • 8a0c74a fix(security): charge pop filter allocation to memoryLimit (#907)
  • ed15a52 docs: revisit wording & style for liquidjs.com (#906)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for liquidjs since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note

Medium Risk
Major-version template engine upgrade can change Liquid rendering behavior; v10 also requires Node >=16 while the package still declares engines >=10.

Overview
Bumps the direct liquidjs dependency in @builder.io/webcomponents from 9.7.0 to 10.27.1, with matching package-lock.json updates. The resolved top-level package is now v10 (adds a commander dependency and raises the declared Node engine to >=16); @builder.io/shopify continues to install its own nested liquidjs 9.43.0 unchanged.

No application source changes—only manifest and lockfile.

Reviewed by Cursor Bugbot for commit 7dd71ca. Bugbot is set up for automated code reviews on this repo. Configure here.

@dependabot
chore(deps): bump liquidjs in /packages/webcomponents
7dd71ca 
Bumps [liquidjs](https://github.com/harttle/liquidjs) from 9.7.0 to 10.27.1.
- [Release notes](https://github.com/harttle/liquidjs/releases)
- [Changelog](https://github.com/harttle/liquidjs/blob/master/CHANGELOG.md)
- [Commits](harttle/liquidjs@v9.7.0...v10.27.1)

---
updated-dependencies:
- dependency-name: liquidjs
  dependency-version: 10.27.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 26, 2026
@changeset-bot

changeset-bot Bot commented Jul 26, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 7dd71ca

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@nx-cloud

nx-cloud Bot commented Jul 26, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Nx Cloud AI Fix Eligible

An automatically generated fix could have helped fix failing tasks for this run, but Self-healing CI is disabled for this workspace. Visit workspace settings to enable it and get automatic fixes in future runs.

To disable these notifications, a workspace admin can disable them in workspace settings.

View your CI Pipeline Execution ↗ for commit 7dd71ca

Command Status Duration Result
nx test @snippet/angular-17-ssr ❌ Failed 46s View ↗
nx test @e2e/qwik-city ✅ Succeeded 8m 4s View ↗
nx test @e2e/nextjs-sdk-next-app ✅ Succeeded 6m 59s View ↗
nx test @e2e/angular-17-ssr ✅ Succeeded 5m 39s View ↗
nx test @e2e/nuxt ✅ Succeeded 5m 51s View ↗
nx test @e2e/angular-17 ✅ Succeeded 5m 43s View ↗
nx test @e2e/react-sdk-next-15-app ✅ Succeeded 5m 19s View ↗
nx test @e2e/gen1-react ✅ Succeeded 4m 55s View ↗
Additional runs (38) ✅ Succeeded ... View ↗

💡 Dealing with memory or CPU issues? See memory and CPU details with the resource usage add-on ↗.

☁️ Nx Cloud last updated this comment at 2026-07-27 00:07:39 UTC

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants