Skip to content

chore(deps): bump liquidjs from 9.6.2 to 10.25.5 in /packages/shopify #4507

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
+34 −9
Open

chore(deps): bump liquidjs from 9.6.2 to 10.25.5 in /packages/shopify #4507

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 33 additions & 8 deletions packages/shopify/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion packages/shopify/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,7 @@
"dedent": "^0.7.0",
"handlebars": "^4.7.7",
"json-stringify-safe": "^5.0.1",
"liquidjs": "9.6.2",
"liquidjs": "10.25.5",
Copy link
Copy Markdown

@cursor cursor bot Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Expression constructor and value API incompatible with v10

High Severity

The liquidjs major version upgrade (v9 to v10) introduced breaking API changes. The code in packages/shopify/js/index.ts (in condition() and assign()) still uses the old Expression and Context constructor signatures and the .value() method, which will cause runtime crashes.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit d70669d. Configure here.

Copy link
Copy Markdown

@cursor cursor bot Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ownPropertyOnly default change silently breaks template rendering

Medium Severity

Updating liquidjs to v10 changed the ownPropertyOnly default from false to true. The Liquid instance in packages/shopify/js/index.ts now inherits this new default, preventing templates from accessing prototype-inherited properties on Shopify data objects. This may silently break template rendering.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit d70669d. Configure here.

Copy link
Copy Markdown

@cursor cursor bot Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

evalValueSync no longer accepts Context in v10

High Severity

The liquidjs v10 update changed evalValueSync to expect a plain scope object, not a Context instance. The get() method in packages/shopify/js/index.ts still passes a Context, leading to incorrect variable resolution. This affects ForBlock, FormBlock, and PaginateBlock components that rely on get() for Liquid expression resolution.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit d70669d. Configure here.

Copy link
Copy Markdown

@cursor cursor bot Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rollup alias references non-existent dist path in v10

High Severity

This major version bump from liquidjs 9.6.2 to 10.25.5 breaks the build. The rollup.config.js hardcodes an alias to node_modules/liquidjs/dist/liquid.js and declares namedExports for that same path. In v10, this file no longer exists — the dist entry points were renamed to dist/liquid.node.js, dist/liquid.node.mjs, and dist/liquid.browser.mjs. The rollup build will fail because the aliased file cannot be resolved.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit d70669d. Configure here.

"lodash": "^4.17.15",
"node-fetch": "^2.6.0",
"tslib": "^1.10.0",
Expand Down
Loading