1.4.3

Released: Tue Sep 22 2026

bug

• [bug] [tests] Fixed regression caused in 1.4.2 where tests added to the suite were
  unable to run directly on Windows, due to posix mechanics: the tests force
  os.path to posixpath, whereas
  TemplateLookup.get_template() converts the configured directory
  using os.path.sep. These tests are now skipped on that platform,
  where the traversal check is instead exercised against ntpath
  natively.

  References: #441

1.4.2

Released: Tue Sep 22 2026

bug

• [bug] [tests] Adjusted the test suite to accommodate for a change in Pygments 2.21.0
  where the HtmlFormatter now renders " and ' characters
  literally rather than as HTML entities, which caused failures in tests
  that assert against the rendered output of
  html_error_template().

  References: #440

• [bug] [template] Fixed issue in TemplateLookup where a URI beginning with a drive
  designator (e.g. C:/../../secret.txt) could bypass the directory
  traversal check on Windows, allowing reads of arbitrary files outside of
  the template directory. The check in Template normalized the URI
  using os.path, which on Windows is ntpath; as ntpath splits the
  drive designator off and treats the remainder as rooted, the ..
  segments were absorbed before the check could inspect them. Normalization
  is now performed with posixpath, which is the same module used by
  TemplateLookup.get_template() to resolve the URI to a file.

  References: #441

1.4.1

Released: Wed Aug 5 2026

bug

• [bug] [installation] Fixed issue in the 1.4.0 packaging where the repository's internal
  tools/ directory was detected by setuptools package discovery and
  installed as a top-level tools package into site-packages, shadowing
  unrelated tools packages belonging to other applications. Package
  discovery is now limited to the mako package explicitly.

  References: #438

1.4.0

Released: Tue Aug 4 2026

changed

• [changed] [examples] The examples/bench folder has been removed as it used mostly
  long-obsolete template engines. The examples/wsgi/run_wsgi.py example
  has been updated to remove the use of the removed-in-Python-3.13 cgi
  module, and to be runnable as a module from the project root.

• [changed] [installation] Minimum MarkupSafe dependency version bumped from 0.9.2 to 2.0.

• [changed] [tests] The test suite now runs via nox. The old tox.ini remains however nox will
  be the only system that's maintained.

• [changed] [installation] Project metadata has been migrated to PEP 621 pyproject.toml-based
  configuration. setup.cfg remains only for the [mako_testing]
  section used by Mako's own test suite. The build requirements
  now set the minimum setuptools version at 77.0.0 in order to build Mako
  from source.

• [changed] [installation] Minimum Python version is now 3.10. Mako 1.4.0 has been tested up through
  Python 3.15.0b4.

bug

• [bug] [ext] The minimum Lingua version supported by LinguaMakoExtractor is
  now 4.16. The test suite had continued to pin Lingua below 4 long after
  the extractor itself was repaired to work with Lingua 4 in version 1.2.0,
  with the result that the plugin was no longer covered by tests at all; the
  pinned version additionally imports pkg_resources at startup, which is
  not present in current setuptools releases and left the package
  unimportable. Lingua 4.16 resolves entry points using
  importlib.metadata, so no deprecated pkg_resources usage remains.

  References: #393

• [bug] [exceptions] Fixed issue where formatting a traceback for an exception raised inside a
  template compiled from a string would emit DeprecationWarning: Module globals is missing a __spec__.loader on Python 3.15. Modules for such
  templates were created without a module spec, which Python's
  linecache module consults for every frame while a traceback is
  being built; the warning was raised from within traceback formatting
  itself, disrupting the error report for applications that configure
  warnings as errors. These modules are now given a spec with a loader that
  provides the generated module source, which additionally allows the
  generated source lines to be displayed in tracebacks produced by the
  standard library where previously no source was available.

  References: #437

• [bug] [exceptions] A series of fixes involving syntax warnings and exceptions found
  during template lexing / compilation:

  -   Warnings raised while a template is compiled, which in practice means
      `SyntaxWarning`, now report the filename and line number of the
      template rather than a line within the generated module, and are no
      longer reported twice.  This applies equally to templates compiled from a
      string, from a file, and to a module file in a
      `Template.module_directory`, as does a warning raised while
      the module level code of a `<%! %>` block runs.  Warnings raised while
      a template renders continue to report the location within the generated
      module.
      
      To do this, Mako replaces `warnings.showwarning` while a template is
      compiled.  As that name is global to the process, an unrelated warning
      displayed by another thread during that window may also be passed through
      Mako's hook, which shows any warning it does not recognize unchanged.
      ([#430](https://github.com/sqlalchemy/mako/issues/430))
  
  -   The `SyntaxException` raised for a syntax error in Python code spanning
      several lines of a template, such as that within a `<% %>` or `<%! %>`
      block, is now reported against the line the error is on, rather than
      against the line on which the block begins.  The line reported for code
      that occupies a single line, such as an expression or a control line, is
      unchanged. ([#245](https://github.com/sqlalchemy/mako/issues/245))
  
  -   The `SyntaxException` raised for a tag or expression that is never
      closed is now reported against the line the construct begins on, rather
      than the point at which the search for the closing token gave up, which
      for an unclosed construct is the end of the template.  The message of the
      exception is amended to indicate that the position given is where the
      unterminated construct begins. ([#428](https://github.com/sqlalchemy/mako/issues/428))
  

  References: #245, #428, #430

1.3.12

Released: Tue Apr 28 2026

bug

• [bug] [template] Fixed issue in TemplateLookup where a URI with backslash path
  separators (e.g. \..\secret.txt) could bypass the directory traversal
  check on Windows, allowing reads of arbitrary files outside of the template
  directory. Backslash characters in URIs are now normalized to forward
  slashes before path resolution.

  References: #435

1.3.11

Released: Tue Apr 14 2026

bug

• [bug] [template] Fixed issue in TemplateLookup where a URI with a double-slash
  prefix (e.g. //../../) could bypass the directory traversal check in
  Template, allowing reads of arbitrary files outside of the
  template directory. The issue was caused by an inconsistency in how leading
  slashes were stripped between TemplateLookup.get_template() and
  Template initialization.

  References: #434

1.3.10

Released: Thu Apr 10 2025

bug

• [bug] [lexer] Fix undefined variable errors when strict_undefined=True when using a
  nested list comprehension. Pull request courtesy Sébastien Granjoux.

  References: #418

1.3.9

Released: Tue Feb 4 2025

bug

• [bug] [tests] Fixed test suite to not rely upon ancient "future division" statement to
  test the Template.future_imports feature. The test is
  replaced with one that tests only the rendering, not the ultimate effect.

  References: #408

1.3.8

Released: Sat Dec 7 2024

bug

• [bug] [lexer] Reverted the fix for #140 released in Mako 1.3.7 as it produced
  regressions in existing user code.

  References: #140, #415

1.3.7

Released: Tue Dec 3 2024

bug

• [bug] [codegen] [lexer] During the lexical analysis phase, add an additional prefix for undeclared
  identifiers that have the same name as built-in flags, and determine the
  final filter to be used during the code generation phase based on the
  context provided by the user. Pull request by Hai Zhu.

  References: #140

• [bug] [lexer] Support the direct passing of dictionary literals when calling functions
  and fix the errors caused by nested braces. This revises the fix that was
  released in 1.3.4 and then reverted in 1.3.5. Pull request by Hai Zhu and
  Jose Galvez.

  References: #400, #401