Yang JunandCursor 1318b3f3ed fix: propagate ownPropertyOnly into Context.spawn() for {% render %} ...

Child contexts from spawn() re-derived ownPropertyOnly from Liquid opts
only, dropping per-render RenderOptions overrides. That broke the contract
that parseAndRender(..., { ownPropertyOnly: true }) locks down a single
render, including partials loaded via {% render %}.

Add regression test matching prototype-chain leak PoC.

Co-authored-by: Cursor <[email protected]>

2026-05-03 21:58:55 +08:00

..

drop

fix: isComparable full interface check (#701)

2024-05-24 10:35:49 +08:00

filters

fix: strip html newline tags (#892)

2026-05-03 21:36:09 +08:00

liquid

fix: enforce root containment for renderFile/parseFile lookups (#870)

2026-04-07 23:18:53 +08:00

misc

fix: consistent range syntax parsing, #791

2025-01-19 17:58:00 +08:00

static_analysis

feat: static variable analysis (#770)

2024-12-28 21:35:28 +08:00

tags

fix: propagate ownPropertyOnly into Context.spawn() for {% render %}

2026-05-03 21:58:55 +08:00