pongo2 changelog

Changelog History

• v7.0.0-alpha.1 Changes

  January 15, 2026

  🔋 Features

  • New filters: json_script, safeseq, escapeseq, dictsort, unordered_list, slugify, filesizeformat, timesince, timeuntil.
  • [Backwards-Incompatible] Improved escapejs filter to match Django behavior.
  • [Backwards-Incompatible] Improved striptags and removetags filters with better security (recursive stripping, iteration limits).
  • [Backwards-Incompatible] Use proper ellipsis character (…) in truncatechars, truncatechars_html, and urlizetrunc filters.
  • [Backwards-Incompatible] Empty {% filter %} tag now returns a parse error (Django compatibility).
  • [Backwards-Incompatible] Empty {% firstof %} tag now returns a parse error (Django compatibility).
  • 👌 Support for negative number literals in arguments.
  • 👌 Support for escape sequences in string literals (\n, \t, etc.).
  • 👌 Support for sorted and reversed iteration over strings.
  • Inline variable definitions ({% set foo = "bar" %}).
  • 👍 Expand urlize filter to support more TLDs.

  🐛 Bug Fixes

  • [Backwards-Incompatible] Fix and/or operators to return actual values instead of booleans (#362).
  • 🛠 Fix panic in cycle tag with no arguments.
  • 🛠 Fix integer overflow when converting uint64 to int.
  • 🛠 Fix panic on uncomparable types in comparisons.
  • 🛠 Fix nil subscript panic.
  • 🛠 Fix ifchanged tag to only evaluate else block if it exists.
  • 🛠 Fix in operator type compatibility for maps.
  • 🛠 Fix Contains method to support all map key types (float64, bool, etc.).
  • 🛠 Fix array parser panic introduced by subscript feature.
  • 👌 Support virtual filesystems in ssi tag plaintext mode and Error.RawLine().
  • Prevent memory exhaustion by limiting lorem tag generation.
  • Prevent infinite loop in unclosed parameterized tag situations.
  • Prevent stack overflow by limiting macro call depth.
  • Prevent DoS via huge parameters in certain filters.
  • Prevent panic from integer divide by zero.
  • 🛠 Fix string indexing to return character instead of byte (Django compatibility).
  • 🛠 Fix NewSet to validate that loaders are not nil.

  🐎 Performance

  • ⚡️ Optimize lexer with keyword map and pre-compiled string replacer.
  • 👉 Use pre-compiled strings.Replacer for HTML escaping filters.
  • Cache getResolvedValue() result in Value methods.
  • ⚡️ Optimize context valid identifier check (#340).
  • Speed optimizations for join filter on long strings.

  🗄 Deprecations

  • 🗄 ifequal and ifnotequal tags now emit deprecation warnings (use {% if %} instead).
  • 🗄 ssi tag is deprecated.

  💥 Breaking Changes

  • [Backwards-Incompatible] Remove HttpFilesystemLoader. Use FSLoader with NewFSLoader() instead, which supports Go's fs.FS interface including os.DirFS() and embed.FS.
  • [Backwards-Incompatible] Remove incomplete SandboxedFilesystemLoader. For sandboxing, use BanTag() to restrict include/import/ssi/extends tags.

  Other

  • Go 1.25 is now the minimum required Go version.
  • ➕ Added comprehensive fuzz testing infrastructure.
  • 📚 Comprehensive documentation overhaul with new guides for getting started, template syntax, security, and custom extensions.

  Thanks to all contributors.

• v6.1.0 Changes

  May 02, 2026

  🔄 Changelog

  All notable changes to this project will be documented in this file.

  [6.1.0] - 2026-05-02

  ⚡️ This release is primarily a security and bug-fix update. All users are
  ⚡️ encouraged to update.

  🛠 Fixed

  • 🚚 removetags filter : tag names containing regex metacharacters no longer
    panic the renderer.
  • {% cycle %} tag : cycle index is now tracked per template execution
    📜 instead of mutated on the parsed AST node. Concurrent renders of a cached
    template no longer race, and sequential renders no longer leak state from
    a previous execution.
  • {% ifchanged %} tag : lastValues/lastContent are now tracked per
    📜 template execution instead of mutated on the parsed AST node, fixing both
    a data race under concurrent renders and state leaking between sequential
    renders of a cached template.
  • {% ifchanged %} tag : rendering an {% ifchanged %} block without
    an {% else %} branch no longer crashes with a nil-pointer dereference
    when the watched value is unchanged. Matches Django's behavior of
    producing no output.
  • {% filter %} tag : BanFilter is now enforced inside {% filter %}
    blocks.

  🔄 Changed

  • {% ssi %} plaintext mode now reads the included file through the
    🔧 configured TemplateLoader chain instead of ioutil.ReadFile, so
    non-filesystem loaders (FSLoader, HttpFilesystemLoader, custom)
    can serve SSI content.
  • Template error reporting (RawLine) now reads source lines through
    the template's loader chain instead of opening files directly with
    os.Open. Error line extraction now works for any TemplateLoader.

  ✂ Removed

  • SandboxedFilesystemLoader and NewSandboxedFilesystemLoader have
    🚧 been removed. They were marked WIP, never wired into any enforcement
    path, and behaved as a thin pass-through to LocalFilesystemLoader.
    Callers should use LocalFilesystemLoader directly; sandboxing should
    be implemented via a custom TemplateLoader.

  📚 Documentation

  • Clarified that pongo2 does not provide a true sandbox. BanTag and
    BanFilter only refuse to compile templates that reference banned
    names; they do not isolate Go execution, restrict filesystem access,
    or contain malicious templates. README, TemplateSet field comment,
    ⚡️ DefaultLoader comment, and parser error messages updated accordingly.
  • ➕ Added a Security section to the README documenting that template
    loaders (LocalFilesystemLoader, HttpFilesystemLoader, FSLoader)
    do not clamp paths to a base directory and that template filenames
    must be treated as trusted input.

  Full Changelog : v6.0.0...v6.1.0

• v6.0.0 Changes

  June 24, 2022

  v6.0.0

  • Go 1.18 is now the minimum required Go version.
  • 👌 Improved block performance (#293).
  • 👌 Support for variable subscript syntax (for maps/arrays/slices), such as mymap["foo"] or
    myarray[0] (#281).
  • 0️⃣ Backwards-incompatible change: block.Super won't be escaped anymore by default (#301).
  • 👍 nil is now supported in function calls (#277).

  Thanks to all contributors.

• v4.0.2

  December 16, 2020

• v4.0.1

  November 27, 2020

• v4.0.0 Changes

  September 13, 2020

  🚀 Changes in this long awaited release:

  Library

  • First semver version with Go modules compatibility
  • 🛠 Several bug fixes
  • 👌 Improved error handling
  • 🔨 Several refactorings to speed up execution and reduce allocations, including support for io.Writerin Execute() functions and short-circuit evaluations in expressions
  • ➕ Add TemplateSet.FromBytes
  • ➕ Add RenderTemplateBytes
  • ➕ Add Template.ExecuteWriterUnbuffered
  • ➕ Add TemplateLoader interface and according functions for virtual filesystem support (incl. support for multiple loaders)
  • ➕ Add pongo2.SetAutoescape for a global behavior change
  • ➕ Add whitespace control for tags and blocks, supporting {%- and -%} for tags and pongo2.Options for blocks
  • ➕ Add pongo2.CleanCache to remove files from the template cache
  • ➕ Add support for template functions that return an error as the second return value
  • ➕ Add Template.ExecuteBlocks to render supplied list of blocks only

  👀 See v3.0...v4.0.0 for a full list of changes.
  Thanks to all contributors!

  Template Language

  • ➕ Add support for single quotes in variables, functions and tags
  • ➕ Add support for if_exists-flag in include-tag
  • ➕ Add support for sorted-flag in for-tag with support for maps and arrays/slices
  • ➕ Add block.Super support
  • ➕ Add split filter

• v3.0 Changes

  October 28, 2014

  🚀 See this blog post for more about the pongo2 v3 release:

  https://www.florian-schlachter.de/post/pongo2-v3/

• v2.1 Changes

  October 28, 2014

  👀 See more in this blog post:

  https://www.florian-schlachter.de/post/pongo2-v3/

• v1.0 Changes

  August 08, 2014

  I'm happy to announce pongo2 v1.0 , the first stable release.

  📦 pongo2 aims to be compatible with Django 1.7 with regards to syntax, filters and tags. In combination with my official package pongo2-addons pongo2 offers even more filters/tags including humanization and markup features.

  🚀 All version 1.x releases will remain backwards compatible (only API improvements are possible, but no changes to any existing API functions/symbols). You can use the special import path

  gopkg.in/flosch/pongo2.v1

  🚀 to stick with version 1.x releases in your projects.

  List of TODOs which could effect users of version 1.0:

  • 🏷 tag verbatim does not take a parameter yet
  • 👍 block.super not supported yet
  • Value.Iterate() over strings is not utf-8 compatible yet (probably rarely used by users)

  Please also have a look on the caveats and on the development status hints when using pongo2.

  🆓 pongo2 got a playground; feel free to play with it and to try pongo2 out.

  🚀 I'm always glad about any feedback. I hope you enjoy this release!

• v1.0-rc1 Changes

  July 29, 2014

  🚀 I just finished the first release candidate for the first stable pongo2 version (1.0).