From 6e96fa17e6707be955c01b9c4c3b381fab14ed23 Mon Sep 17 00:00:00 2001 From: Yang Jun Date: Tue, 14 Jul 2026 21:47:21 +0800 Subject: [PATCH] docs: note maxDepth stack overflow applies to renderSync only Explain why async render does not need maxDepth for stack protection based on generator/toPromise driving. Co-authored-by: Cursor --- docs/source/tutorials/security-model.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/source/tutorials/security-model.md b/docs/source/tutorials/security-model.md index 87098b347..b0658b359 100644 --- a/docs/source/tutorials/security-model.md +++ b/docs/source/tutorials/security-model.md @@ -47,7 +47,7 @@ Each template node (the `for` tag, literal `order: `, output `{{i}}`, and so on) ### maxDepth -[maxDepth][maxDepth] limits how deeply `{% render %}`, `{% include %}`, and `{% layout %}` can nest. Defaults to `128`. +[maxDepth][maxDepth] limits how deeply `{% render %}`, `{% include %}`, and `{% layout %}` can nest. Defaults to `128`. In sync rendering (`renderSync`), nested tags are driven by `toValueSync`, which recursively resumes each yielded generator on the call stack—deep nesting can overflow it, and `maxDepth` caps that depth. Async `render()` resumes the same tag generators via `toPromise`/`yield` without a deep synchronous call chain, so stack overflow is not a concern there (the limit still applies as a DoS guard). The `memoryLimit` option was removed; memory usage is not capped in-engine.