dependabot[bot] opened a new pull request, #1602: URL: https://github.com/apache/tooling-trusted-releases/pull/1602
Bumps [djlint](https://github.com/djlint/djLint) from 1.45.0 to 1.46.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/djlint/djLint/releases";>djlint's releases</a>.</em></p> <blockquote> <h2>v1.46.1</h2> <h3>Fix</h3> <ul> <li>A second <code>{# #}</code> comment on a line no longer swallows everything back to the first one, so a tag written between two comments is formatted and linted like any other. Before, it kept lines past <code>--max-line-length</code> and hid findings from the rules. A comment now ends at its first <code>#}</code>, which is where django, jinja and nunjucks end it.</li> </ul> <h2>v1.46.0</h2> <h3>Feature</h3> <ul> <li>New rule <code>T041</code> reports an <code>{% extends %}</code> that is not the first tag in the template, which django refuses to compile and which leaks whatever text comes before it into the page. A <code>{# #}</code> comment before it is left alone, as is anything inside a <code>{% comment %}</code>, <code>{% raw %}</code> or <code>{% verbatim %}</code> block, named or not, a <code>{# djlint:off #}</code> region or yaml front matter. An html comment is reported, since it is written into the page ahead of the parent template's doctype, and so is a branch tag on the django profile, where <code>{% if x %}{% extends "a.html" %}{% endif %}</code> does not compile; jinja documents that form and keeps it.</li> <li>New rule <code>T042</code> reports text or html written after <code>{% extends %}</code> and outside every <code>{% block %}</code>, which the engine silently discards. A template tag there still runs and is left alone, as are comments and the body of a <code>{% macro %}</code>.</li> <li>New rule <code>T043</code> reports a block name used more than once in a template, which Django, Jinja and Nunjucks all refuse to parse, even where the two blocks sit in different branches of an <code>{% if %}</code>. A <code>{% blocktrans %}</code>, a named <code>{% endblock %}</code>, a block inside a template comment, a <code>{% comment %}</code> block or a <code>{% raw %}</code> or <code>{% verbatim %}</code> body, and the blocks an <code>{% embed %}</code> fills in another template are left alone; a block inside an html comment or a <code><script></code> counts, since the engine still parses it.</li> <li>New rule <code>T044</code> reports a statement keyword inside an output tag, such as <code>{{ if x }}</code>, <code>{{ url 'home' }}</code> or <code>{{ endif }}</code>, where a <code>{% %}</code> block tag was meant. A bare keyword such as <code>{{ url }}</code> is an ordinary variable and is left alone, as is an expression that merely starts with one of the names, such as <code>{{ url ~ "/x" }}</code>, <code>{{ url ? url : '#' }}</code> or <code>{{ block ('title') }}</code>, and so is the body of a <code>{% raw %}</code> or <code>{% verbatim %}</code> block, named or not.</li> <li>New rule <code>T045</code> reports a statement tag, such as <code>{% include %}</code> or <code>{% if %}</code>, written inside an html comment, where it still runs. A value printed into a comment, as in <code><!-- built {{ version }} --></code>, is left alone, and so is a bare Go keyword such as <code><!-- period {{ start }} to {{ end }} --></code>, which is an ordinary variable under every other profile, and a <code>{%</code> under handlebars and golang, which have no such syntax. A tag inside a template comment, a <code>{% comment %}</code> block or a raw block is left alone whether it is written with whitespace control, tabs or a named closing tag, as is one inside an Internet Explorer conditional comment, in any case and closed by its <code><![endif]--></code>; one left unclosed is the ordinary comment a browser reads it as and is reported.</li> <li>New rule <code>H053</code> reports an <code>id</code> used more than once in the file, which breaks <code>getElementById</code>, <code><label for></code> and fragment links. Two ids in exclusive branches of one <code>{% if %}</code> are never both rendered and are not reported, whichever language writes the branch, and neither are two ids in separate <code>\<template></code> fragments; a value written by a template tag is left alone.</li> <li>New rule <code>H054</code> reports an interactive element nested inside another, such as a <code><button></code> inside an <code><a href></code> or a link inside a button. An <code><a></code> without an <code>href</code> is not interactive and is left alone, as is a hidden input or one whose type a template tag writes.</li> <li>New rule <code>H055</code> reports a <code>lang</code> on <code><html></code> that is not a language tag, such as <code>lang="english"</code>, <code>lang="en_US"</code> or a value that is only whitespace, which <code>H005</code> reads as present. An empty value is left to <code>H005</code>, and so is a value written by a template tag or by a php short echo, as in <code>lang="<?= $lang ?>"</code>, while a value that merely starts with <code>$</code> or <code>{</code>, such as <code>lang="$LANG"</code>, is read as written. A <code>></code> written inside a template tag ahead of the attribute, as in <code>{% if a > b %}</code>, does not hide it.</li> <li>New rule <code>H056</code> reports an empty <code>src</code> on an element that fetches what it names, such as <code><img src=""></code> or <code><script src=""></script></code>, which a browser resolves to the page itself. A <code>src</code> with no value at all counts too, while an unquoted value such as <code>src=/static/logo.png</code>, a value written by a template tag, a value that is only whitespace, and the separate <code>srcset</code> and <code>data-src</code> attributes are left alone.</li> <li>New rule <code>H057</code> reports a <code><video></code> with no captions track, which WCAG 1.2.2 requires for prerecorded video with sound. A <code><track></code> of kind <code>captions</code> or <code>subtitles</code> counts, as does one with no <code>kind</code>, since subtitles is the default, while a commented out track and one written inside an attribute value do not; a <code>muted</code> video is left alone, as is one whose tracks or attributes a template tag may write, meaning a real <code>{{</code>, <code>{%</code>, <code>{#</code> or <code>${</code> rather than the brace of a css value or the <code>$</code> of a jQuery handler or a price.</li> <li>New option <code>--sarif</code> writes the findings as a SARIF 2.1.0 document, which GitHub code scanning, Azure DevOps and most editors read, so a run can be uploaded and kept in the Security tab with history rather than shown only as annotations on one pull request. With <code>--check</code>, a file that would be reformatted is reported under a <code>formatting</code> rule.</li> </ul> <h3>Fix</h3> <ul> <li>A mako <code><% %></code> or <code><%! %></code> code block is left as written, since its body is python rather than markup. Formatting re-indented it, flattening a <code>return "unit"</code> inside an <code>if</code> to the start of the line and leaving python that no longer parses, and a tag written in a python string was read as markup, so <code>H025</code>, <code>H054</code> and <code>T001</code> reported findings inside these blocks. A <code><%def></code> body is markup and is still formatted and linted.</li> <li><code>H037</code> no longer reads an unquoted attribute value as an attribute name, so <code><img width=1 height=1></code> is not reported as a duplicate <code>1</code>. This started in 1.45.0, and a real duplicate whose values are unquoted and start with <code>/</code>, <code>.</code> or <code>#</code>, as in <code>href=/a href=/b</code>, is now caught too.</li> </ul> <h2>v1.45.2</h2> <h3>Fix</h3> <ul> <li>A space beside a template block is kept where the line break next to it is one a <code>{%-</code> or <code>-%}</code> marker strips. The break normally renders the space itself, so djLint drops the space as redundant, but a stripped break renders nothing: <code>{%- if args -%}, {% endif %}</code> followed by <code>{%- for %}</code> lost the space between a macro's arguments.</li> </ul> <h2>v1.45.1</h2> <ul> <li><code>H037</code> no longer reads a quoted string inside a template tag as an attribute name, so <code>href="{{ url "/a/b" "/a/c" }}"</code> is not reported as a duplicate <code>a</code>. This started in 1.45.0.</li> <li>A jinja call written over several lines keeps its closing bracket at the indent of the tag holding it, rather than pulling <code>) }}</code> to the start of the line.</li> <li>Arguments nested inside a jinja call written over several lines keep their depth, so the inner argument of <code>{{ function([nested(...)]) }}</code> is no longer dedented by one level.</li> <li>An element after a line that closes both a template block and an html tag, as in <code>{%- endif %}:</b></code>, keeps its own level instead of being indented one further.</li> <li>A template tag written over several lines inside an attribute keeps the indentation the author gave it, so the body of <code>data-x='{{ f({ ... }) }}'</code> no longer loses a space from every line.</li> <li><code>--single-attribute-per-line</code> reaches attributes guarded by a template tag, so <code>{% if x %} a="1" b="2" {% endif %}</code> inside a tag no longer keeps them on one line past <code>--max-line-length</code>.</li> <li>A tag whose attributes push its line past <code>--max-line-length</code> is spread over several lines, where before only <code>--max-attribute-length</code> decided. A line long because of its text is left alone, since breaking text would change what renders.</li> <li>A tag whose name a template writes, as in <code><{{ tag }}></code>, is read as a tag. It was not recognised at all, so a template block among its attributes was pulled out of the tag and re-indented to the start of the line, and its attributes went unformatted and unchecked.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/djlint/djLint/blob/master/CHANGELOG.md";>djlint's changelog</a>.</em></p> <blockquote> <h2>[1.46.1] - 2026-09-08</h2> <h3>Fix</h3> <ul> <li>A second <code>{# #}</code> comment on a line no longer swallows everything back to the first one, so a tag written between two comments is formatted and linted like any other. Before, it kept lines past <code>--max-line-length</code> and hid findings from the rules. A comment now ends at its first <code>#}</code>, which is where django, jinja and nunjucks end it.</li> </ul> <h2>[1.46.0] - 2026-09-07</h2> <h3>Feature</h3> <ul> <li>New rule <code>T041</code> reports an <code>{% extends %}</code> that is not the first tag in the template, which django refuses to compile and which leaks whatever text comes before it into the page. A <code>{# #}</code> comment before it is left alone, as is anything inside a <code>{% comment %}</code>, <code>{% raw %}</code> or <code>{% verbatim %}</code> block, named or not, a <code>{# djlint:off #}</code> region or yaml front matter. An html comment is reported, since it is written into the page ahead of the parent template's doctype, and so is a branch tag on the django profile, where <code>{% if x %}{% extends "a.html" %}{% endif %}</code> does not compile; jinja documents that form and keeps it.</li> <li>New rule <code>T042</code> reports text or html written after <code>{% extends %}</code> and outside every <code>{% block %}</code>, which the engine silently discards. A template tag there still runs and is left alone, as are comments and the body of a <code>{% macro %}</code>.</li> <li>New rule <code>T043</code> reports a block name used more than once in a template, which Django, Jinja and Nunjucks all refuse to parse, even where the two blocks sit in different branches of an <code>{% if %}</code>. A <code>{% blocktrans %}</code>, a named <code>{% endblock %}</code>, a block inside a template comment, a <code>{% comment %}</code> block or a <code>{% raw %}</code> or <code>{% verbatim %}</code> body, and the blocks an <code>{% embed %}</code> fills in another template are left alone; a block inside an html comment or a <code><script></code> counts, since the engine still parses it.</li> <li>New rule <code>T044</code> reports a statement keyword inside an output tag, such as <code>{{ if x }}</code>, <code>{{ url 'home' }}</code> or <code>{{ endif }}</code>, where a <code>{% %}</code> block tag was meant. A bare keyword such as <code>{{ url }}</code> is an ordinary variable and is left alone, as is an expression that merely starts with one of the names, such as <code>{{ url ~ "/x" }}</code>, <code>{{ url ? url : '#' }}</code> or <code>{{ block ('title') }}</code>, and so is the body of a <code>{% raw %}</code> or <code>{% verbatim %}</code> block, named or not.</li> <li>New rule <code>T045</code> reports a statement tag, such as <code>{% include %}</code> or <code>{% if %}</code>, written inside an html comment, where it still runs. A value printed into a comment, as in <code><!-- built {{ version }} --></code>, is left alone, and so is a bare Go keyword such as <code><!-- period {{ start }} to {{ end }} --></code>, which is an ordinary variable under every other profile, and a <code>{%</code> under handlebars and golang, which have no such syntax. A tag inside a template comment, a <code>{% comment %}</code> block or a raw block is left alone whether it is written with whitespace control, tabs or a named closing tag, as is one inside an Internet Explorer conditional comment, in any case and closed by its <code><![endif]--></code>; one left unclosed is the ordinary comment a browser reads it as and is reported.</li> <li>New rule <code>H053</code> reports an <code>id</code> used more than once in the file, which breaks <code>getElementById</code>, <code><label for></code> and fragment links. Two ids in exclusive branches of one <code>{% if %}</code> are never both rendered and are not reported, whichever language writes the branch, and neither are two ids in separate <code>\<template></code> fragments; a value written by a template tag is left alone.</li> <li>New rule <code>H054</code> reports an interactive element nested inside another, such as a <code><button></code> inside an <code><a href></code> or a link inside a button. An <code><a></code> without an <code>href</code> is not interactive and is left alone, as is a hidden input or one whose type a template tag writes.</li> <li>New rule <code>H055</code> reports a <code>lang</code> on <code><html></code> that is not a language tag, such as <code>lang="english"</code>, <code>lang="en_US"</code> or a value that is only whitespace, which <code>H005</code> reads as present. An empty value is left to <code>H005</code>, and so is a value written by a template tag or by a php short echo, as in <code>lang="<?= $lang ?>"</code>, while a value that merely starts with <code>$</code> or <code>{</code>, such as <code>lang="$LANG"</code>, is read as written. A <code>></code> written inside a template tag ahead of the attribute, as in <code>{% if a > b %}</code>, does not hide it.</li> <li>New rule <code>H056</code> reports an empty <code>src</code> on an element that fetches what it names, such as <code><img src=""></code> or <code><script src=""></script></code>, which a browser resolves to the page itself. A <code>src</code> with no value at all counts too, while an unquoted value such as <code>src=/static/logo.png</code>, a value written by a template tag, a value that is only whitespace, and the separate <code>srcset</code> and <code>data-src</code> attributes are left alone.</li> <li>New rule <code>H057</code> reports a <code><video></code> with no captions track, which WCAG 1.2.2 requires for prerecorded video with sound. A <code><track></code> of kind <code>captions</code> or <code>subtitles</code> counts, as does one with no <code>kind</code>, since subtitles is the default, while a commented out track and one written inside an attribute value do not; a <code>muted</code> video is left alone, as is one whose tracks or attributes a template tag may write, meaning a real <code>{{</code>, <code>{%</code>, <code>{#</code> or <code>${</code> rather than the brace of a css value or the <code>$</code> of a jQuery handler or a price.</li> <li>New option <code>--sarif</code> writes the findings as a SARIF 2.1.0 document, which GitHub code scanning, Azure DevOps and most editors read, so a run can be uploaded and kept in the Security tab with history rather than shown only as annotations on one pull request. With <code>--check</code>, a file that would be reformatted is reported under a <code>formatting</code> rule.</li> </ul> <h3>Fix</h3> <ul> <li>A mako <code><% %></code> or <code><%! %></code> code block is left as written, since its body is python rather than markup. Formatting re-indented it, flattening a <code>return "unit"</code> inside an <code>if</code> to the start of the line and leaving python that no longer parses, and a tag written in a python string was read as markup, so <code>H025</code>, <code>H054</code> and <code>T001</code> reported findings inside these blocks. A <code><%def></code> body is markup and is still formatted and linted.</li> <li><code>H037</code> no longer reads an unquoted attribute value as an attribute name, so <code><img width=1 height=1></code> is not reported as a duplicate <code>1</code>. This started in 1.45.0, and a real duplicate whose values are unquoted and start with <code>/</code>, <code>.</code> or <code>#</code>, as in <code>href=/a href=/b</code>, is now caught too.</li> </ul> <h2>[1.45.2] - 2026-09-04</h2> <h3>Fix</h3> <ul> <li>A space beside a template block is kept where the line break next to it is one a <code>{%-</code> or <code>-%}</code> marker strips. The break normally renders the space itself, so djLint drops the space as redundant, but a stripped break renders nothing: <code>{%- if args -%}, {% endif %}</code> followed by <code>{%- for %}</code> lost the space between a macro's arguments.</li> </ul> <h2>[1.45.1] - 2026-09-04</h2> <h3>Fix</h3> <ul> <li><code>H037</code> no longer reads a quoted string inside a template tag as an attribute name, so <code>href="{{ url "/a/b" "/a/c" }}"</code> is not reported as a duplicate <code>a</code>. This started in 1.45.0.</li> <li>A jinja call written over several lines keeps its closing bracket at the indent of the tag holding it, rather than pulling <code>) }}</code> to the start of the line.</li> <li>Arguments nested inside a jinja call written over several lines keep their depth, so the inner argument of <code>{{ function([nested(...)]) }}</code> is no longer dedented by one level.</li> <li>An element after a line that closes both a template block and an html tag, as in <code>{%- endif %}:</b></code>, keeps its own level instead of being indented one further.</li> <li>A template tag written over several lines inside an attribute keeps the indentation the author gave it, so the body of <code>data-x='{{ f({ ... }) }}'</code> no longer loses a space from every line.</li> <li><code>--single-attribute-per-line</code> reaches attributes guarded by a template tag, so <code>{% if x %} a="1" b="2" {% endif %}</code> inside a tag no longer keeps them on one line past <code>--max-line-length</code>.</li> <li>A tag whose attributes push its line past <code>--max-line-length</code> is spread over several lines, where before only <code>--max-attribute-length</code> decided. A line long because of its text is left alone, since breaking text would change what renders.</li> <li>A tag whose name a template writes, as in <code><{{ tag }}></code>, is read as a tag. It was not recognised at all, so a template block among its attributes was pulled out of the tag and re-indented to the start of the line, and its attributes went unformatted and unchecked.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/djlint/djLint/commit/152599a9c13abe14c25b8bdf023c8306975ddc3f";><code>152599a</code></a> v1.46.1</li> <li><a href="https://github.com/djlint/djLint/commit/1cef4d074d78b931f0b44643a49d56300fed4c3f";><code>1cef4d0</code></a> fix ci</li> <li><a href="https://github.com/djlint/djLint/commit/3931027c0343536147bf102540eff3cf3d16eee3";><code>3931027</code></a> fix changelog</li> <li><a href="https://github.com/djlint/djLint/commit/8a5f5b3930668b839b2f6deeaed7108ff7ee8256";><code>8a5f5b3</code></a> fix: end a template comment at its first close, not the last one on the line</li> <li><a href="https://github.com/djlint/djLint/commit/4fcf1e595b401de170064a973da7cfd66924f468";><code>4fcf1e5</code></a> remove unneeded files</li> <li><a href="https://github.com/djlint/djLint/commit/4ad849ae01d333d686d2d783922b17116a251c0a";><code>4ad849a</code></a> v1.46.0</li> <li><a href="https://github.com/djlint/djLint/commit/54fea2e7cea6f4e577e63b84d3f42d6a462cc535";><code>54fea2e</code></a> chore(deps): lock file maintenance (<a href="https://redirect.github.com/djlint/djLint/issues/2489";>#2489</a>)</li> <li><a href="https://github.com/djlint/djLint/commit/58247d77a816c7c3f157acbe608a46294569f3e7";><code>58247d7</code></a> chore(deps): update dependency autoprefixer to v10.5.5 (<a href="https://redirect.github.com/djlint/djLint/issues/2488";>#2488</a>)</li> <li><a href="https://github.com/djlint/djLint/commit/9ebc8aaf4a51a3f0f01967d837190120222ad1c7";><code>9ebc8aa</code></a> chore(deps): update dependency <code>@​codemirror/state</code> to v6.7.4 (<a href="https://redirect.github.com/djlint/djLint/issues/2487";>#2487</a>)</li> <li><a href="https://github.com/djlint/djLint/commit/ced0cbf4e1a3a01fd20dd2fd321167ede59f9338";><code>ced0cbf</code></a> perf: anchor H022 and H036 on their candidates instead of scanning from every...</li> <li>Additional commits viewable in <a href="https://github.com/djlint/djLint/compare/v1.45.0...v1.46.1";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
