Releases · mozilla/nunjucks

@fdintino

What's Changed

fix: html encode backslashes if used with escape filter or autoescape by @fdintino in #1437. Fixes CVE-2023-2142
(bugzilla #1825980)

Full Changelog: v3.2.3...v3.2.4

Add support for nested attributes on sort filter; respect throwOnUndefined if sort attribute is undefined.
Add base arg to int filter.
Move chokidar to peerDependencies and mark it optional in peerDependenciesMeta.
Fix prototype pollution issue for template variables. Merge of #1330; fixes #1331. Thanks ChenKS12138!

Add select and reject filters. Merge of #1278 and #1279; fixes #282. Thanks ogonkov!
Fix precompile binary script TypeError: name.replace is not a function. Fixes #1295.
Add support for nested attributes on groupby filter; respect throwOnUndefined option, if the groupby attribute is undefined. Merge of #1276; fixes #1198. Thanks ogonkov!
Fix bug that prevented errors in included templates from being raised when rendering templates synchronously. Fixes #1272.
The indent filter no longer appends an additional newline. Fixes #1231.

Replace yargs with commander to reduce number of dependencies. Merge of #1253. Thanks AlynxZhou.
Update optional dependency chokidar from ^2.0.0 to ^3.3.0. Merge of #1254. Thanks eklingen.
Prevent optional dependency Chokidar from loading when not watching. Merge of #1250. Thanks eklingen.

Adds NodeResolveLoader, a Loader that loads templates using node's require.resolve. Fixes #1175.
Emit 'load' events on Environment instances, to allow runtime dependency tracking. Fixes #1153.

Fix bug where exceptions were silently swallowed with synchronous render. Fixes #678, #1116, #1127, and #1164
Removes deprecated postinstall-build package in favor of npm prepare. Merge of #1172. Fixes #1167.
- Note: this means that npm@5 or later is required to install nunjucks directly from github.

No changes from 3.1.5; fixed packaging issue in npm

Add forceescape filter. Fixes #782
Fix regression that prevented template errors from reporting line and column number. Fixes #1087 and #1095.
Fix "Invalid type: Is" error for {% if value is defined %}. Fixes #1110
Formally drop support for node v4 (the upgrade to babel 7 in v3.1.0 made the build process incompatible with node < 6.9.0).