@rhinostone/swig 2.8.3 → 2.9.0

package/HISTORY.md

@@ -1,3 +1,19 @@
+[2.9.0](https://github.com/gina-io/swig/tree/v2.9.0) / 2026-10-23
+-----------------------------------------------------------------
+
+* **Added** An OpenSSF Scorecard badge at the top of the README of each of the five packages. It shows the score that a Scorecard workflow publishes for the repository on every push to develop and every week, and links to the Scorecard report. Documentation only; no runtime or API change.
+
+* **Added** swig-twig, swig-jinja2 and swig-django: the `not in` operator, as Twig, Jinja2 and Django have it. `x not in y` negates `x in y` and binds at the same level; where Django cannot run the test it is false, as Django gives it, and where Jinja2 raises swig gives true. Until now `x not in y` failed to parse. Native swig still rejects `not in`.
+
+* **Fixed** swig-twig, swig-jinja2 and swig-django: the `in` operator tests membership as Twig, Jinja2 and Django do. In Jinja2 and Django a list holds an equal item, a string a substring and a mapping a key; in Twig a list or a mapping holds a value, compared loosely, and a string holds a string or number as a substring. Until now `in` was the JavaScript operator, which tests keys: `3 in [1, 2, 3]` was false, `0 in [5]` true, and `"b" in "abc"` threw. A test the reference engine cannot run (a number or null container, for instance) is false instead of an error. Native swig keeps the JavaScript `in`.
+
+[2.8.4](https://github.com/gina-io/swig/tree/v2.8.4) / 2026-10-21
+-----------------------------------------------------------------
+
+* **Fixed** A filename option that is not a string, such as a number, compiles again with import, from and extends on the async render path, as it did in 2.8.2, and include, which failed with a number in 2.8.2 as well, now compiles too. 2.8.3 escaped the filename as a string before writing it into the compiled template, so a number failed with value.replace is not a function; the filename is now converted to a string first. All four frontends.
+
+* **Fixed** The autoescape option of @rhinostone/swig now takes the name of an escape strategy, as documented: autoescape set to 'js' gives JavaScript escaping and 'html' HTML escaping. The option was written into the compiled template as code, so these values failed with ReferenceError: js is not defined, and an autoescape option built from untrusted input could run as code in the template. A value already wrapped in quotes keeps working, and a value holding a double quote or a line break is now rejected with an error. The Twig, Jinja2 and Django frontends already passed the option to the escape filter as a string.
+
 [2.8.3](https://github.com/gina-io/swig/tree/v2.8.3) / 2026-10-21
 -----------------------------------------------------------------
 

package/README.md

@@ -1,7 +1,7 @@
 Swig
 ====
 
-[![CI](https://github.com/gina-io/swig/actions/workflows/ci.yml/badge.svg?branch=develop)](https://github.com/gina-io/swig/actions/workflows/ci.yml) [![NPM version](https://img.shields.io/npm/v/@rhinostone/swig.svg?style=flat)](https://www.npmjs.com/package/@rhinostone/swig) [![NPM Downloads](https://img.shields.io/npm/dm/@rhinostone/swig.svg?style=flat)](https://www.npmjs.com/package/@rhinostone/swig) [![Socket Badge](https://socket.dev/api/badge/npm/package/@rhinostone/swig)](https://socket.dev/npm/package/@rhinostone/swig)
+[![CI](https://github.com/gina-io/swig/actions/workflows/ci.yml/badge.svg?branch=develop)](https://github.com/gina-io/swig/actions/workflows/ci.yml) [![NPM version](https://img.shields.io/npm/v/@rhinostone/swig.svg?style=flat)](https://www.npmjs.com/package/@rhinostone/swig) [![NPM Downloads](https://img.shields.io/npm/dm/@rhinostone/swig.svg?style=flat)](https://www.npmjs.com/package/@rhinostone/swig) [![Socket Badge](https://socket.dev/api/badge/npm/package/@rhinostone/swig)](https://socket.dev/npm/package/@rhinostone/swig) [![OpenSSF Scorecard](https://img.shields.io/ossf-scorecard/github.com/gina-io/swig?label=openssf%20scorecard&style=flat)](https://scorecard.dev/viewer/?uri=github.com/gina-io/swig)
 
 > **Multi-flavor template engine** for Node.js and browsers — native Swig syntax (Jinja2/Django-inspired), Twig syntax, Python Jinja2 syntax, and Django Template Language syntax via dedicated frontends sharing one IR backend. [gina-io/swig](https://github.com/gina-io/swig) started as a maintained continuation of the abandoned `paularmstrong/swig` (last released 2014) and is now a standalone project. Security and bug fixes ship here.
 
@@ -32,7 +32,7 @@ Features
 --------
 
 * Available for node.js **and** major web browsers.
-* **Strict-CSP browser runtime** — AOT-compile templates ahead of time (`swig compile --recursive --register`) and render them with the runtime-only bundle (`dist/swig.runtime.min.js`, ~22 KB) — no parser, no `new Function`, no `unsafe-eval` required.
+* **Strict-CSP browser runtime** — AOT-compile templates ahead of time (`swig compile --recursive --register`) and render them with the runtime-only bundle (`dist/swig.runtime.min.js`, ~24 KB) — no parser, no `new Function`, no `unsafe-eval` required.
 * [Express](https://expressjs.com/) compatible.
 * **Async template loading** — back the loader with S3 / Redis / HTTP / any callback API: set `loader.async = true` and pass a callback to `renderFile`, or to `compileFile` with `codegenMode: 'async'` in its options, whose compiled function returns a promise of `{ output, exports }`; `extends` / `include` / `import` resolve at render time, dynamic `{% extends %}` paths included.
 * Object-Oriented template inheritance.
@@ -43,12 +43,14 @@ Features
 * Robust without the bloat — a single runtime dependency ([`@rhinostone/swig-core`](https://www.npmjs.com/package/@rhinostone/swig-core)).
 * Extendable and customizable — register custom filters, tags, and loaders per-instance.
 
-What's new in v2.8.3
+What's new in v2.9.0
 --------------------
 
-> **Security.** If your application passes untrusted data as the `filename` option to `render`, `compile`, `precompile`, `renderFile` or `compileFile` (or a flavor equivalent), upgrade to `2.8.3`.
+> **Behaviour change in `@rhinostone/swig-twig`, `@rhinostone/swig-jinja2` and `@rhinostone/swig-django`.** `x in list` now tests the list's items, not its indices, and `x in "text"` a substring, as Twig, Jinja2 and Django do. In swig-twig, `x in mapping` now tests the mapping's values, as Twig does: write `x in mapping|keys` to test a key. Native `@rhinostone/swig` is unchanged.
 
-* **Security — the compiled template escapes the including filename (GHSA-q89c).** The code generator now escapes a template's filename (`resolveFrom`) before writing it into the compiled function body, so a double quote in a `filename` option can no longer break out of the generated string literal. The escape is centralized in the generator, which also fixes a latent broken-JS bug for backslash paths through `import`, `from` and `extends`.
+* **Fixed — `in` tests membership in the Twig, Jinja2 and Django frontends.** In swig-jinja2 and swig-django a list holds an equal item, a string a substring and a mapping a key; in swig-twig a list or a mapping holds a value, compared loosely, and a string holds a string or number as a substring. Until now `in` was the JavaScript operator, which tests keys: `3 in [1, 2, 3]` was false, `0 in [5]` true, and `"b" in "abc"` threw. A test the reference engine cannot run (a number or null container, for instance) is false instead of an error. Native `@rhinostone/swig` keeps the JavaScript `in`, which tests an object's keys or an array's indices.
+* **Added — `not in` in the Twig, Jinja2 and Django frontends.** `x not in y` negates `x in y` and binds at the same level. Where Django cannot run the test it is false, as in Django; where Jinja2 raises, swig gives true. Until now `x not in y` failed to parse. Native `@rhinostone/swig` still rejects `not in`.
+* **Added — an OpenSSF Scorecard badge** at the top of the README of each of the five packages. It shows the score that a Scorecard workflow publishes for the repository on every push to develop and every week, and links to the Scorecard report. Documentation only; no runtime or API change.
 
 See the full [HISTORY.md](./HISTORY.md) and [ROADMAP.md](./ROADMAP.md).
 

package/ROADMAP.md

@@ -10,10 +10,11 @@ For bug reports and feature requests, file an issue at [gina-io/swig](https://gi
 
 | Status | Item |
 | --- | --- |
-| Planned | `in` tests membership in all four flavors: `x in list` tests the elements and `x in "text"` the substring. Today `in` tests an object's keys or an array's indices, so `3 in [1, 2, 3]` is false. |
 | Planned | swig-jinja2 parity: loop filters (`{% for x in xs if cond %}`), `not(x)` written without a space, the `none` / `True` / `False` constants, for-loops over a mapping and over a list of pairs as Jinja2 iterates them, and the builtin filters `attr`, `filesizeformat`, `forceescape`, `items`, `string` and `urlize`. |
 | Planned | swig-django: two-variable for-loops over a list of pairs unpack each pair, as Django does. |
 | Planned | Unknown filter and test names rejected when a Twig, Jinja2 or Django template compiles; today the error comes only at render, or never when the branch does not run. Native swig already rejects an unknown filter. |
+| Planned | swig-django: `not` binds below the comparisons and `in`, as in Django; today `not x == y` reads as `(not x) == y`. |
+| Planned | swig-jinja2 and swig-django: `==` and `!=` compare as Python does; today they are JavaScript's loose operators, so `1 == "1"` is true and `[1] == [1]` false. |
 
 ## Future (post-2.0)
 
@@ -27,6 +28,19 @@ For bug reports and feature requests, file an issue at [gina-io/swig](https://gi
 
 ## Completed
 
+### v2.9.0 (October 2026)
+
+- `in` tests membership in swig-twig, swig-jinja2 and swig-django, as Twig, Jinja2 and Django do: a list holds an item, a string a substring, and a mapping a key (Jinja2, Django) or a value (Twig). Native swig keeps the JavaScript `in`, which tests an object's keys or an array's indices.
+- `not in` in swig-twig, swig-jinja2 and swig-django.
+- An OpenSSF Scorecard badge on the README of each package.
+- All five packages released in lockstep at `2.9.0`.
+
+### v2.8.4 (October 2026)
+
+- Fixed the `autoescape` option of `@rhinostone/swig` set to an escape strategy name: `'js'` and `'html'` work as documented. The value was written into the compiled template as code, so these failed with a ReferenceError and an option built from untrusted input could run as code; a value holding a double quote or a line break is now rejected with an error.
+- Fixed a `filename` option that is not a string, such as a number, which 2.8.3 no longer compiled with `import`, `from` and `extends` on the async render path; `include` now compiles with a number too. All four frontends.
+- All five packages released in lockstep at `2.8.4`.
+
 ### v2.8.3 (October 2026)
 
 - Security: the template compiler escapes the including template's filename before writing it into the compiled function body, so a double quote in a `filename` option can no longer break out of the generated string literal (GHSA-q89c). Escaping is centralized in the code generator, which also fixes a latent broken-JS bug for backslash paths through `import`, `from` and `extends`.

package/dist/swig.js

@@ -1,4 +1,4 @@
-/*! Swig v2.8.3 | https://github.com/gina-io/swig | @license https://github.com/gina-io/swig/blob/master/LICENSE */
+/*! Swig v2.9.0 | https://github.com/gina-io/swig | @license https://github.com/gina-io/swig/blob/master/LICENSE */
 /*! DateZ (c) 2011 Tomo Universalis | @license https://github.com/tn0ms/DateZ/blob/master/LISENCE */
 (() => {
   var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -250,6 +250,58 @@
         }
         return cur;
       };
+      function sameItem(a, b, twig) {
+        if (a === b) {
+          return true;
+        }
+        if (!twig) {
+          return (a === null || a === void 0) && (b === null || b === void 0);
+        }
+        if (a !== null && typeof a === "object" || b !== null && typeof b === "object" || typeof a === "function" || typeof b === "function") {
+          return false;
+        }
+        return a == b;
+      }
+      function membership(needle, haystack, twig) {
+        var keys, i;
+        if (typeof haystack === "string") {
+          if (typeof needle === "string" || twig && typeof needle === "number") {
+            return haystack.indexOf(String(needle)) !== -1;
+          }
+          return twig ? false : null;
+        }
+        if (haystack === null || typeof haystack !== "object") {
+          return twig ? false : null;
+        }
+        if (exports.isArray(haystack)) {
+          for (i = 0; i < haystack.length; i += 1) {
+            if (sameItem(needle, haystack[i], twig)) {
+              return true;
+            }
+          }
+          return false;
+        }
+        if (twig) {
+          keys = Object.keys(haystack);
+          for (i = 0; i < keys.length; i += 1) {
+            if (sameItem(needle, haystack[keys[i]], true)) {
+              return true;
+            }
+          }
+          return false;
+        }
+        if (typeof needle === "string" || typeof needle === "number") {
+          return Object.prototype.hasOwnProperty.call(haystack, String(needle));
+        }
+        return needle !== null && typeof needle === "object" ? null : false;
+      }
+      exports.isIn = function(needle, haystack, mode, negate) {
+        var found = membership(needle, haystack, mode === "twig");
+        if (found === null) {
+          return negate === true && mode !== "django";
+        }
+        return negate === true ? !found : found;
+      };
     }
   });
 
@@ -1618,7 +1670,7 @@
             } else {
               incSelector = "_utils.extend({}, _ctx, " + incCtxJS + ")";
             }
-            out += (node.ignoreMissing ? "  try {\n" : "") + "_output += _swig.compileFile(" + incPathJS + ', {resolveFrom: "' + escapeTextValue(node.resolveFrom || "") + '"})(' + incSelector + ");\n" + (node.ignoreMissing ? "} catch (e) {}\n" : "");
+            out += (node.ignoreMissing ? "  try {\n" : "") + "_output += _swig.compileFile(" + incPathJS + ', {resolveFrom: "' + escapeTextValue(String(node.resolveFrom || "")) + '"})(' + incSelector + ");\n" + (node.ignoreMissing ? "} catch (e) {}\n" : "");
             return;
           }
           if (node.type === "IncludeDeferred") {
@@ -1643,7 +1695,7 @@
             } else {
               incdSelector = "_utils.extend({}, _ctx, " + incdCtxJS + ")";
             }
-            var incdOpts = '{resolveFrom: "' + escapeTextValue(node.resolveFrom || "") + '"}';
+            var incdOpts = '{resolveFrom: "' + escapeTextValue(String(node.resolveFrom || "")) + '"}';
             out += (node.ignoreMissing ? "  try {\n" : "") + "_output += (await (await _swig.getTemplate(" + incdPathJS + ", " + incdOpts + "))(" + incdSelector + ")).output;\n" + (node.ignoreMissing ? "} catch (e) {}\n" : "");
             return;
           }
@@ -1657,7 +1709,7 @@
             } else {
               impdPathJS = node.path;
             }
-            var impdOpts = '{resolveFrom: "' + escapeTextValue(node.resolveFrom || "") + '"}';
+            var impdOpts = '{resolveFrom: "' + escapeTextValue(String(node.resolveFrom || "")) + '"}';
             out += "_ctx." + node.alias + " = (await (await _swig.getTemplate(" + impdPathJS + ", " + impdOpts + "))(_ctx)).exports;\n";
             return;
           }
@@ -1678,7 +1730,7 @@
             } else {
               fromdPathJS = node.path;
             }
-            var fromdOpts = '{resolveFrom: "' + escapeTextValue(node.resolveFrom || "") + '"}';
+            var fromdOpts = '{resolveFrom: "' + escapeTextValue(String(node.resolveFrom || "")) + '"}';
             var fromdBindings = "";
             utils.each(fromdImports, function(entry) {
               var bindName = entry.alias || entry.name;
@@ -1715,7 +1767,7 @@
             } else {
               extPathJS = node.path;
             }
-            var extOpts = '{resolveFrom: "' + escapeTextValue(node.resolveFrom || "") + '"}';
+            var extOpts = '{resolveFrom: "' + escapeTextValue(String(node.resolveFrom || "")) + '"}';
             out += "var _parentTpl = await _swig.getTemplate(" + extPathJS + ", " + extOpts + ");\n";
             out += "var _parentResult = await _parentTpl(_ctx, _mergedBlocks);\n";
             out += "_output = _parentResult.output;\n";
@@ -1923,12 +1975,18 @@
         }
         return js;
       }
+      function membershipMode(flag) {
+        return flag === "twig" || flag === "django" ? flag : "jinja2";
+      }
       function emitBinaryOp(node, d) {
         var left = groupOperand(node.left, emitExpr(node.left, d)), right = groupOperand(node.right, emitExpr(node.right, d));
         if (isArithmeticOp(node.op)) {
           return left + " " + node.op + " " + right;
         }
         if (node.op === "in") {
+          if (node.membership) {
+            return "_utils.isIn(" + left + ", " + right + ', "' + membershipMode(node.membership) + '"' + (node.negate ? ", true" : "") + ")";
+          }
           return left + " in " + right;
         }
         if (node.op === "~") {
@@ -3058,9 +3116,23 @@
       function escapeRegExp(str) {
         return str.replace(/[\-\/\\\^$*+?.()|\[\]{}]/g, "\\$&");
       }
+      function quoteEscapeOption(value) {
+        var quote;
+        if (typeof value !== "string" || value === "") {
+          return value;
+        }
+        quote = value.charAt(0);
+        if (value.length > 1 && (quote === '"' || quote === "'") && value.charAt(value.length - 1) === quote) {
+          value = value.slice(1, -1);
+        }
+        if (/["\n\r\u2028\u2029]/.test(value)) {
+          throw new Error('Option "autoescape" must be true, false or an escape strategy name without double quotes or line breaks.');
+        }
+        return '"' + value + '"';
+      }
       exports.parse = function(swig2, source, opts, tags, filters) {
         source = source.replace(/\r\n/g, "\n");
-        var escape = opts.autoescape, tagOpen = opts.tagControls[0], tagClose = opts.tagControls[1], varOpen = opts.varControls[0], varClose = opts.varControls[1], escapedTagOpen = escapeRegExp(tagOpen), escapedTagClose = escapeRegExp(tagClose), escapedVarOpen = escapeRegExp(varOpen), escapedVarClose = escapeRegExp(varClose), tagStrip = new RegExp("^" + escapedTagOpen + "-?\\s*|\\s*-?" + escapedTagClose + "$", "g"), tagStripBefore = new RegExp("^" + escapedTagOpen + "-"), tagStripAfter = new RegExp("-" + escapedTagClose + "$"), varStrip = new RegExp("^" + escapedVarOpen + "-?\\s*|\\s*-?" + escapedVarClose + "$", "g"), varStripBefore = new RegExp("^" + escapedVarOpen + "-"), varStripAfter = new RegExp("-" + escapedVarClose + "$"), cmtOpen = opts.cmtControls[0], cmtClose = opts.cmtControls[1], anyChar = "[\\s\\S]*?", splitter = new RegExp(
+        var escape = quoteEscapeOption(opts.autoescape), tagOpen = opts.tagControls[0], tagClose = opts.tagControls[1], varOpen = opts.varControls[0], varClose = opts.varControls[1], escapedTagOpen = escapeRegExp(tagOpen), escapedTagClose = escapeRegExp(tagClose), escapedVarOpen = escapeRegExp(varOpen), escapedVarClose = escapeRegExp(varClose), tagStrip = new RegExp("^" + escapedTagOpen + "-?\\s*|\\s*-?" + escapedTagClose + "$", "g"), tagStripBefore = new RegExp("^" + escapedTagOpen + "-"), tagStripAfter = new RegExp("-" + escapedTagClose + "$"), varStrip = new RegExp("^" + escapedVarOpen + "-?\\s*|\\s*-?" + escapedVarClose + "$", "g"), varStripBefore = new RegExp("^" + escapedVarOpen + "-"), varStripAfter = new RegExp("-" + escapedVarClose + "$"), cmtOpen = opts.cmtControls[0], cmtClose = opts.cmtControls[1], anyChar = "[\\s\\S]*?", splitter = new RegExp(
           "(" + escapedTagOpen + anyChar + escapedTagClose + "|" + escapedVarOpen + anyChar + escapedVarClose + "|" + escapeRegExp(cmtOpen) + anyChar + escapeRegExp(cmtClose) + ")"
         ), line = 1, stack = [], parent = null, parentExpr = null, tokens = [], blocks = {}, inRaw = false, stripNext;
         function parseVariable(str, line2) {
@@ -3080,7 +3152,7 @@
             if (last && last.name === str.split(/\s+/)[0].replace(/^end/, "") && last.ends) {
               switch (last.name) {
                 case "autoescape":
-                  escape = opts.autoescape;
+                  escape = quoteEscapeOption(opts.autoescape);
                   break;
                 case "raw":
                   inRaw = false;
@@ -4822,7 +4894,7 @@
       var loaders = require_loaders2();
       var preWalker = require_pre_walker();
       var engine = require_engine();
-      exports.version = "2.8.3";
+      exports.version = "2.9.0";
       var defaultOptions = {
         autoescape: true,
         varControls: ["{{", "}}"],
@@ -5062,6 +5134,19 @@
  * `_dangerousProps` segments are rejected at runtime as defense-in-depth.
  * @private
  */
+/*!
+ * Item equality for `isIn`. Jinja2 and Django compare with `===` and treat
+ * null and a missing value as equal (Django reads both as None). Twig
+ * compares two scalars with `==`, as swig-twig's `==` does, and anything
+ * else by identity. @private
+ */
+/*!
+ * The membership test of `isIn`: true or false, or null when Jinja2 and
+ * Django cannot run it, where Python raises a TypeError: a container that is
+ * not a list, a string or a mapping, a needle that is not a string tested
+ * against a string, or a list or an object tested against a mapping's keys.
+ * Twig runs every test. @private
+ */
 /*!
  * Attach `loc` to the node if provided, skipping the assignment otherwise
  * so consumers can tell "no source location available" from
@@ -5163,6 +5248,10 @@
  * wraps a unary operand, for the positions where its prefix would bind
  * differently (`-(-x)`, `(-x)[0]`). @private
  */
+/*!
+ * The flavor name `emitBinaryOp` writes into an `_utils.isIn` call: one of
+ * the three names `isIn` knows, never the flag's own text. @private
+ */
 /*!
  * Emit a function / method invocation. Three callee shapes:
  *   1. Single-segment VarRef (`foo(...)`) — FUNCTION-token pattern with
@@ -5185,6 +5274,19 @@
  * @return {string}
  * @private
  */
+/*!
+ * Turn a string autoescape option into the string literal that the
+ * autoescape tail writes into the compiled template as the e filter's
+ * strategy argument; the bare option used to be written there as code.
+ * The tail doubles every backslash, so the value is wrapped in double
+ * quotes without escaping it, and a value holding a double quote or a line
+ * break is rejected. One pair of matching outer quotes is removed first,
+ * so a value that was already quoted keeps working. A value that is not a
+ * non-empty string is returned unchanged.
+ * @param  {*} value The autoescape option.
+ * @return {*}
+ * @private
+ */
 /*!
  * Loop over the source, split via the tag/var/comment regular expression splitter.
  * Send each chunk to the appropriate parser.