chore(deps): bump liquidjs from 9.6.2 to 10.25.5 in /packages/shopify#4507
chore(deps): bump liquidjs from 9.6.2 to 10.25.5 in /packages/shopify#4507dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
Bumps [liquidjs](https://github.com/harttle/liquidjs) from 9.6.2 to 10.25.5. - [Release notes](https://github.com/harttle/liquidjs/releases) - [Changelog](https://github.com/harttle/liquidjs/blob/master/CHANGELOG.md) - [Commits](harttle/liquidjs@v9.6.2...v10.25.5) --- updated-dependencies: - dependency-name: liquidjs dependency-version: 10.25.5 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
|
|
View your CI Pipeline Execution ↗ for commit d70669d
☁️ Nx Cloud last updated this comment at |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 4 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit d70669d. Configure here.
| "handlebars": "^4.7.7", | ||
| "json-stringify-safe": "^5.0.1", | ||
| "liquidjs": "9.6.2", | ||
| "liquidjs": "10.25.5", |
There was a problem hiding this comment.
Expression constructor and value API incompatible with v10
High Severity
The liquidjs major version upgrade (v9 to v10) introduced breaking API changes. The code in packages/shopify/js/index.ts (in condition() and assign()) still uses the old Expression and Context constructor signatures and the .value() method, which will cause runtime crashes.
Reviewed by Cursor Bugbot for commit d70669d. Configure here.
| "handlebars": "^4.7.7", | ||
| "json-stringify-safe": "^5.0.1", | ||
| "liquidjs": "9.6.2", | ||
| "liquidjs": "10.25.5", |
There was a problem hiding this comment.
ownPropertyOnly default change silently breaks template rendering
Medium Severity
Updating liquidjs to v10 changed the ownPropertyOnly default from false to true. The Liquid instance in packages/shopify/js/index.ts now inherits this new default, preventing templates from accessing prototype-inherited properties on Shopify data objects. This may silently break template rendering.
Reviewed by Cursor Bugbot for commit d70669d. Configure here.
| "handlebars": "^4.7.7", | ||
| "json-stringify-safe": "^5.0.1", | ||
| "liquidjs": "9.6.2", | ||
| "liquidjs": "10.25.5", |
There was a problem hiding this comment.
evalValueSync no longer accepts Context in v10
High Severity
The liquidjs v10 update changed evalValueSync to expect a plain scope object, not a Context instance. The get() method in packages/shopify/js/index.ts still passes a Context, leading to incorrect variable resolution. This affects ForBlock, FormBlock, and PaginateBlock components that rely on get() for Liquid expression resolution.
Reviewed by Cursor Bugbot for commit d70669d. Configure here.
| "handlebars": "^4.7.7", | ||
| "json-stringify-safe": "^5.0.1", | ||
| "liquidjs": "9.6.2", | ||
| "liquidjs": "10.25.5", |
There was a problem hiding this comment.
Rollup alias references non-existent dist path in v10
High Severity
This major version bump from liquidjs 9.6.2 to 10.25.5 breaks the build. The rollup.config.js hardcodes an alias to node_modules/liquidjs/dist/liquid.js and declares namedExports for that same path. In v10, this file no longer exists — the dist entry points were renamed to dist/liquid.node.js, dist/liquid.node.mjs, and dist/liquid.browser.mjs. The rollup build will fail because the aliased file cannot be resolved.
Reviewed by Cursor Bugbot for commit d70669d. Configure here.
Bumps liquidjs from 9.6.2 to 10.25.5.
Release notes
Sourced from liquidjs's releases.
... (truncated)
Changelog
Sourced from liquidjs's changelog.
... (truncated)
Commits
4af7be6chore(release): 10.25.5 [skip ci]05c47darefactor: replace shell scripts with JS for cross-platform support (#875)66011d1docs: add timbze as a contributor for code (#874)1cdf10bfix: rounding negative away from zero when half (#873)4f9a499fix: null date should return empty (#868) (#872)f41c1fcfix: enforce root containment for renderFile/parseFile lookups (#870)db43485chore(release): 10.25.4 [skip ci]e743da0fix: sort and sort_natural filters bypass ownPropertyOnly (#869)8f69a08chore(release): 10.25.3 [skip ci]529dd67fix: use realpath for fs.contains (#867)Maintainer changes
This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for liquidjs since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Medium Risk
Major-version upgrade of
liquidjsand its transitive deps may introduce rendering/behavior changes and requires Node >=16, which can break builds or runtime in older environments.Overview
Updates
@builder.io/shopifyto useliquidjs10.25.5(from9.6.2) and refreshespackage-lock.jsonaccordingly.The lockfile changes introduce a new transitive dependency on
commanderand reflectliquidjs's updated engine requirement (Node >=16).Reviewed by Cursor Bugbot for commit d70669d. Bugbot is set up for automated code reviews on this repo. Configure here.