Python-liquid

Latest version: v1.13.0

Safety actively analyzes 707299 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 11 of 23

1.5.0

**Fixes**

- Fixed `case`/`when` tag expression parsing. `when` expressions no longer fail when presented with a string containing a comma. Handling of comma and `or` separated "sub-expressions" is now consistent with the reference implementation.

**Compatibility**

- `for` tag arguments can now be separated by commas as well as whitespace. See [Shopify/liquid1658](https://github.com/Shopify/liquid/pull/1658).

1.4.7

**Hot fix**

- Fixed a bug where use of a [local namespace limit](https://jg-rp.github.io/liquid/guides/resource-limits#local-namespace-limit) would raise a `TypeError` when unhashable types were found in a render context's local namespace. See [79](https://github.com/jg-rp/liquid/issues/79).

1.4.6

**Fixes**

- The `tablerowloop` drop now exposes its `row` property. See [77](https://github.com/jg-rp/liquid/issues/77).
- `for` and `tablerow` tag arguments can now be string representations of integers as well as integer literals and variables that resolve to integers. See [78](https://github.com/jg-rp/liquid/issues/78).

**Compatibility**

- The `truncatewords` filter no longer raises a `FilterArgumentError` if its argument is greater than `2147483648` and the number of words in the input string is less than the target number of words. This is inline with recent changes committed to the reference implementation of Liquid.
- The `slice` filter now clamps its arguments to between `-9223372036854775808` and `9223372036854775807`, as does the reference implementation of Liquid.

1.4.5

**Hot fix**

- Fixed a bug where boolean expressions and the default filter would treat `0.0` and `decimal.Decimal("0")` as `False`. Python considers these values to be falsy, Liquid does not. See [74](https://github.com/jg-rp/liquid/issues/74).
- Future-proof str to int conversion limit. We will now use `sys.get_int_max_str_digits` if it is available and `LIQUIDINTMAXSTRDIGITS` is not set. Note that `sys.get_int_max_str_digits` is called once at startup, so Liquid's limit will change with `sys.set_int_max_str_digits`.

1.4.4

**Fixes**

- Keep comment text for later static analysis when parsing `{% comment %}` block tags. See [70](https://github.com/jg-rp/liquid/issues/70).
- Guard against DoS by very large str to int conversion. See https://github.com/python/cpython/issues/95778. ([docs](https://jg-rp.github.io/liquid/guides/resource-limits#string-to-integer-limit))

1.4.3

**Fixes**

- Updated the built-in `date` filter to support parsing UNIX timestamps from integers and string representations of integers. For consistency with the reference implementation of Liquid, `date` now returns the input string unchanged if it can not be parsed. See [67](https://github.com/jg-rp/liquid/issues/67).
- Fixed an issue with the "loop iteration" resource limit. It was failing to carry an existing loop counter more than one level deep when using `Context.copy()`. See [68](https://github.com/jg-rp/liquid/issues/68).

Page 11 of 23

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.