You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
New rule T041 reports an {% extends %} that is not the first tag in the template, which django refuses to compile and which leaks whatever text comes before it into the page. A {# #} comment before it is left alone, as is anything inside a {% comment %}, {% raw %} or {% verbatim %} block, named or not, a {# djlint:off #} region or yaml front matter. An html comment is reported, since it is written into the page ahead of the parent template's doctype, and so is a branch tag on the django profile, where {% if x %}{% extends "a.html" %}{% endif %} does not compile; jinja documents that form and keeps it.
New rule T042 reports text or html written after {% extends %} and outside every {% block %}, which the engine silently discards. A template tag there still runs and is left alone, as are comments and the body of a {% macro %}.
New rule T043 reports a block name used more than once in a template, which Django, Jinja and Nunjucks all refuse to parse, even where the two blocks sit in different branches of an {% if %}. A {% blocktrans %}, a named {% endblock %}, a block inside a template comment, a {% comment %} block or a {% raw %} or {% verbatim %} body, and the blocks an {% embed %} fills in another template are left alone; a block inside an html comment or a <script> counts, since the engine still parses it.
New rule T044 reports a statement keyword inside an output tag, such as {{ if x }}, {{ url 'home' }} or {{ endif }}, where a {% %} block tag was meant. A bare keyword such as {{ url }} is an ordinary variable and is left alone, as is an expression that merely starts with one of the names, such as {{ url ~ "/x" }}, {{ url ? url : '#' }} or {{ block ('title') }}, and so is the body of a {% raw %} or {% verbatim %} block, named or not.
New rule T045 reports a statement tag, such as {% include %} or {% if %}, written inside an html comment, where it still runs. A value printed into a comment, as in <!-- built {{ version }} -->, is left alone, and so is a bare Go keyword such as <!-- period {{ start }} to {{ end }} -->, which is an ordinary variable under every other profile, and a {% under handlebars and golang, which have no such syntax. A tag inside a template comment, a {% comment %} block or a raw block is left alone whether it is written with whitespace control, tabs or a named closing tag, as is one inside an Internet Explorer conditional comment, in any case and closed by its <![endif]-->; one left unclosed is the ordinary comment a browser reads it as and is reported.
New rule H053 reports an id used more than once in the file, which breaks getElementById, <label for> and fragment links. Two ids in exclusive branches of one {% if %} are never both rendered and are not reported, whichever language writes the branch, and neither are two ids in separate <template> fragments; a value written by a template tag is left alone.
New rule H054 reports an interactive element nested inside another, such as a <button> inside an <a href> or a link inside a button. An <a> without an href is not interactive and is left alone, as is a hidden input or one whose type a template tag writes.
New rule H055 reports a lang on <html> that is not a language tag, such as lang="english", lang="en_US" or a value that is only whitespace, which H005 reads as present. An empty value is left to H005, and so is a value written by a template tag or by a php short echo, as in lang="<?= $lang ?>", while a value that merely starts with $ or {, such as lang="$LANG", is read as written. A > written inside a template tag ahead of the attribute, as in {% if a > b %}, does not hide it.
New rule H056 reports an empty src on an element that fetches what it names, such as <img src=""> or <script src=""></script>, which a browser resolves to the page itself. A src with no value at all counts too, while an unquoted value such as src=/static/logo.png, a value written by a template tag, a value that is only whitespace, and the separate srcset and data-src attributes are left alone.
New rule H057 reports a <video> with no captions track, which WCAG 1.2.2 requires for prerecorded video with sound. A <track> of kind captions or subtitles counts, as does one with no kind, since subtitles is the default, while a commented out track and one written inside an attribute value do not; a muted video is left alone, as is one whose tracks or attributes a template tag may write, meaning a real {{, {%, {# or ${ rather than the brace of a css value or the $ of a jQuery handler or a price.
New option --sarif writes the findings as a SARIF 2.1.0 document, which GitHub code scanning, Azure DevOps and most editors read, so a run can be uploaded and kept in the Security tab with history rather than shown only as annotations on one pull request. With --check, a file that would be reformatted is reported under a formatting rule.
Fix
A mako <% %> or <%! %> code block is left as written, since its body is python rather than markup. Formatting re-indented it, flattening a return "unit" inside an if to the start of the line and leaving python that no longer parses, and a tag written in a python string was read as markup, so H025, H054 and T001 reported findings inside these blocks. A <%def> body is markup and is still formatted and linted.
H037 no longer reads an unquoted attribute value as an attribute name, so <img width=1 height=1> is not reported as a duplicate 1. This started in 1.45.0, and a real duplicate whose values are unquoted and start with /, . or #, as in href=/a href=/b, is now caught too.
