Bump liquidjs from 10.25.1 to 10.27.2 in the security group across 1 directory

[dependabot]

Bumps the security group with 1 update in the / directory: liquidjs.

Updates liquidjs from 10.25.1 to 10.27.2

Release notes

Sourced from liquidjs's releases.

v10.27.2

10.27.2 (2026-07-09)

Bug Fixes

• charge join/json/inspect filters by produced output size (#925) (7ab49f9)
• date: zero-pad milliseconds when formatting %N fractional seconds (#929) (2634f9d)
• enforce ownPropertyOnly for inherited array indices (#924) (552819a)
• filters: modulo should follow divisor sign for negative operands (#922) (568bd5f)
• filters: return empty for out-of-range slice begin or negative length (#928) (f9a1316)

v10.27.1

10.27.1 (2026-06-23)

Bug Fixes

• improve round function; improvement to #873 (#901) (956b51e)
• security: charge pop filter allocation to memoryLimit (#907) (8a0c74a)
• strip_html: infinite loop for strip_html (5c3522f)

Performance Improvements

• parser: memoize createTrie to avoid rebuilding tries per Tokenizer (#911) (3a0d80d)

v10.27.0

10.27.0 (2026-05-15)

Features

• context: null-prototype scope frames via createScope (#899) (47d3f1b)

v10.26.0

10.26.0 (2026-05-14)

Bug Fixes

• date: cap strftime widths and account padding in memoryLimit (#895) (3129d46)
• enforce renderLimit for empty renderTemplates calls (#894) (5b9c346)
• propagate ownPropertyOnly into Context.spawn() for {% render %} (#893) (dbbf628)
• security: block Object.prototype filter/tag lookups (RCE) (#897) (457fae0)
• strip html newline tags (#892) (26ea285)
• strip_html: rewrite as linear single-pass scan to avoid ReDoS (#896) (3616a74)

Features

... (truncated)

Changelog

Sourced from liquidjs's changelog.

10.27.2 (2026-07-09)

Bug Fixes

• charge join/json/inspect filters by produced output size (#925) (7ab49f9)
• date: zero-pad milliseconds when formatting %N fractional seconds (#929) (2634f9d)
• enforce ownPropertyOnly for inherited array indices (#924) (552819a)
• filters: modulo should follow divisor sign for negative operands (#922) (568bd5f)
• filters: return empty for out-of-range slice begin or negative length (#928) (f9a1316)

10.27.1 (2026-06-23)

Bug Fixes

• improve round function; improvement to #873 (#901) (956b51e)
• security: charge pop filter allocation to memoryLimit (#907) (8a0c74a)
• strip_html: infinite loop for strip_html (5c3522f)

Performance Improvements

• parser: memoize createTrie to avoid rebuilding tries per Tokenizer (#911) (3a0d80d)

10.27.0 (2026-05-15)

Features

• context: null-prototype scope frames via createScope (#899) (47d3f1b)

10.26.0 (2026-05-14)

Bug Fixes

• date: cap strftime widths and account padding in memoryLimit (#895) (3129d46)
• enforce renderLimit for empty renderTemplates calls (#894) (5b9c346)
• propagate ownPropertyOnly into Context.spawn() for {% render %} (#893) (dbbf628)
• security: block Object.prototype filter/tag lookups (RCE) (#897) (457fae0)
• strip html newline tags (#892) (26ea285)
• strip_html: rewrite as linear single-pass scan to avoid ReDoS (#896) (3616a74)

Features

• add sha256 and hmac_sha256 filters for cryptographic operations (#889) (1c816d4)

10.25.7 (2026-04-23)

... (truncated)

Commits

• 050f161 chore(release): 10.27.2 [skip ci]
• 2634f9d fix(date): zero-pad milliseconds when formatting %N fractional seconds (#929)
• f9a1316 fix(filters): return empty for out-of-range slice begin or negative length (#...
• 7ab49f9 fix: charge join/json/inspect filters by produced output size (#925)
• 552819a fix: enforce ownPropertyOnly for inherited array indices (#924)
• 8bfb642 docs: add spokodev as a contributor for code (#923)
• 568bd5f fix(filters): modulo should follow divisor sign for negative operands (#922)
• ed48986 chore(release): 10.27.1 [skip ci]
• afec88b docs(readme): README overhaul, used-by grid, and docs homepage (#914)
• 3a0d80d perf(parser): memoize createTrie to avoid rebuilding tries per Tokenizer (#911)
• Additional commits viewable in compare view

[netlify]

✅ Deploy Preview for fulldev-ui ready!

Name	Link
🔨 Latest commit	db28b27
🔍 Latest deploy log	https://app.netlify.com/projects/fulldev-ui/deploys/6ad4a572b56825e4edaae9a0
😎 Deploy Preview	https://deploy-preview-289--fulldev-ui.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[silveltman]

@dependabot rebase

[silveltman]

Kept as a draft: this is the smallest fix for the open LiquidJS alerts, and merging still needs a release decision.

Impact. LiquidJS is a dev dependency only. It renders our own liquid/ templates at build time (src/lib/liquid.ts, static getStaticPaths routes, no SSR adapter) and in the Liquid test fixture. It is not in the published fulldev-ui package or any registry item, and no visitor or customer input reaches it. The critical RCE (GHSA-gf2q-c269-pqgc) needs an attacker-written template, so it does not affect ui.full.dev or client sites. 10.27.2 is outside every known LiquidJS advisory range; 0.24.1 still ships 10.25.1.

Validation on current main (7a6bf5a) plus this bump, LiquidJS 10.25.1 vs 10.27.2:

• Same package.json and pnpm-lock.yaml changes as this PR.
• vp run test:unit: 31/31 pass. vp run check:source: pass.
• astro build: all 59 files in dist/preview/liquid byte-identical.
• Liquid test fixture rendered from a real shadcn install (renderFixture, default and legacy): byte-identical.

No changeset: dev-only, nothing user-facing.