CLOUD-727: Bump github.com/flosch/pongo2/v6 from 6.0.0 to 6.1.0

[dependabot]

Bumps github.com/flosch/pongo2/v6 from 6.0.0 to 6.1.0.

Release notes

Sourced from github.com/flosch/pongo2/v6's releases.

v6.1.0 - security and bug-fix update

Changelog

All notable changes to this project will be documented in this file.

[6.1.0] - 2026-05-02

This release is primarily a security and bug-fix update. All users are encouraged to update.

Fixed

• removetags filter: tag names containing regex metacharacters no longer panic the renderer.
• {% cycle %} tag: cycle index is now tracked per template execution instead of mutated on the parsed AST node. Concurrent renders of a cached template no longer race, and sequential renders no longer leak state from a previous execution.
• {% ifchanged %} tag: lastValues/lastContent are now tracked per template execution instead of mutated on the parsed AST node, fixing both a data race under concurrent renders and state leaking between sequential renders of a cached template.
• {% ifchanged %} tag: rendering an {% ifchanged %} block without an {% else %} branch no longer crashes with a nil-pointer dereference when the watched value is unchanged. Matches Django's behavior of producing no output.
• {% filter %} tag: BanFilter is now enforced inside {% filter %} blocks.

Changed

• {% ssi %} plaintext mode now reads the included file through the configured TemplateLoader chain instead of ioutil.ReadFile, so non-filesystem loaders (FSLoader, HttpFilesystemLoader, custom) can serve SSI content.
• Template error reporting (RawLine) now reads source lines through the template's loader chain instead of opening files directly with os.Open. Error line extraction now works for any TemplateLoader.

Removed

• SandboxedFilesystemLoader and NewSandboxedFilesystemLoader have been removed. They were marked WIP, never wired into any enforcement path, and behaved as a thin pass-through to LocalFilesystemLoader. Callers should use LocalFilesystemLoader directly; sandboxing should be implemented via a custom TemplateLoader.

  Note: this is technically an API-breaking removal, but the type was unused WIP code that never provided sandboxing.

... (truncated)

Changelog

Sourced from github.com/flosch/pongo2/v6's changelog.

[6.1.0] - 2026-05-02

This release is primarily a security and bug-fix update. All users are encouraged to update.

Fixed

• removetags filter: tag names containing regex metacharacters no longer panic the renderer.
• {% cycle %} tag: cycle index is now tracked per template execution instead of mutated on the parsed AST node. Concurrent renders of a cached template no longer race, and sequential renders no longer leak state from a previous execution.
• {% ifchanged %} tag: lastValues/lastContent are now tracked per template execution instead of mutated on the parsed AST node, fixing both a data race under concurrent renders and state leaking between sequential renders of a cached template.
• {% ifchanged %} tag: rendering an {% ifchanged %} block without an {% else %} branch no longer crashes with a nil-pointer dereference when the watched value is unchanged. Matches Django's behavior of producing no output.
• {% filter %} tag: BanFilter is now enforced inside {% filter %} blocks.

Changed

• {% ssi %} plaintext mode now reads the included file through the configured TemplateLoader chain instead of ioutil.ReadFile, so non-filesystem loaders (FSLoader, HttpFilesystemLoader, custom) can serve SSI content.
• Template error reporting (RawLine) now reads source lines through the template's loader chain instead of opening files directly with os.Open. Error line extraction now works for any TemplateLoader.

Removed

• SandboxedFilesystemLoader and NewSandboxedFilesystemLoader have been removed. They were marked WIP, never wired into any enforcement path, and behaved as a thin pass-through to LocalFilesystemLoader. Callers should use LocalFilesystemLoader directly; sandboxing should be implemented via a custom TemplateLoader.

  Note: this is technically an API-breaking removal, but the type was unused WIP code that never provided sandboxing.

Documentation

• Clarified that pongo2 does not provide a true sandbox. BanTag and BanFilter only refuse to compile templates that reference banned names; they do not isolate Go execution, restrict filesystem access,

... (truncated)

Commits

• 0d8aa98 chore(release): prepare v6.1.0
• 75e020c fix(ifchanged): use per-execution state instead of shared AST node state
• f468d6f fix(cycle): use per-execution state instead of shared AST node state
• dfa652d fix(ban): synchronize BanTag/BanFilter with template creation
• 07b2b10 fix(widthratio): render empty string when max is zero
• 42d30e0 fix(removetags): escape tag-name regex metacharacters
• c5cf3fc docs(readme): document that template loaders do not clamp to baseDir
• 9a92a21 fix(ifchanged): handle missing else branch without panic
• ed38d0b fix(filter): enforce BanFilter inside {% filter %} tag
• 2818c7d docs: clarify that pongo2 has no real sandbox, only banned tags/filters
• Additional commits viewable in compare view

[hors]

@dependabot recreate

[JNKPercona]

Test Name	Result	Time
auto-tuning-8-0	passed	00:00:00
allocator-8-0	passed	00:00:00
allocator-8-4	passed	00:00:00
backup-storage-tls-8-0	passed	00:00:00
cross-site-8-0	passed	00:00:00
cross-site-proxysql-8-0	passed	00:00:00
cross-site-proxysql-8-4	passed	00:00:00
custom-users-8-0	passed	00:00:00
demand-backup-cloud-8-0	passed	00:00:00
demand-backup-cloud-8-4	passed	00:00:00
demand-backup-cloud-pxb-8-0	passed	00:00:00
demand-backup-encrypted-with-tls-5-7	passed	00:00:00
demand-backup-encrypted-with-tls-8-0	passed	00:00:00
demand-backup-encrypted-with-tls-8-4	passed	00:00:00
demand-backup-encrypted-with-tls-pxb-5-7	passed	00:00:00
demand-backup-encrypted-with-tls-pxb-8-0	passed	00:00:00
demand-backup-encrypted-with-tls-pxb-8-4	passed	00:00:00
demand-backup-8-0	passed	00:00:00
demand-backup-flow-control-8-0	passed	00:00:00
demand-backup-flow-control-8-4	passed	00:00:00
demand-backup-parallel-8-0	passed	00:00:00
demand-backup-parallel-8-4	passed	00:00:00
demand-backup-without-passwords-8-0	passed	00:00:00
demand-backup-without-passwords-8-4	passed	00:00:00
extra-pvc-8-0	passed	00:00:00
haproxy-5-7	passed	00:00:00
haproxy-8-0	passed	00:00:00
haproxy-8-4	passed	00:00:00
init-deploy-5-7	passed	00:00:00
init-deploy-8-0	passed	00:00:00
limits-8-0	passed	00:00:00
monitoring-2-0-8-0	passed	00:00:00
monitoring-pmm3-8-0	passed	00:00:00
monitoring-pmm3-8-4	passed	00:00:00
one-pod-5-7	passed	00:00:00
one-pod-8-0	passed	00:00:00
pitr-8-0	passed	00:00:00
pitr-8-4	passed	00:00:00
pitr-pxb-8-0	passed	00:00:00
pitr-pxb-8-4	passed	00:00:00
pitr-gap-errors-8-0	passed	00:48:59
pitr-gap-errors-8-4	passed	00:00:00
proxy-protocol-8-0	passed	00:00:00
proxy-switch-8-0	passed	00:00:00
proxysql-sidecar-res-limits-8-0	passed	00:00:00
proxysql-scheduler-8-0	passed	00:00:00
pvc-resize-5-7	passed	00:00:00
pvc-resize-8-0	passed	00:00:00
pvc-auto-resize-5-7	passed	00:00:00
pvc-auto-resize-8-0	passed	00:00:00
recreate-8-0	passed	00:00:00
restore-to-encrypted-cluster-8-0	passed	00:00:00
restore-to-encrypted-cluster-8-4	passed	00:00:00
restore-to-encrypted-cluster-pxb-8-0	passed	00:00:00
restore-to-encrypted-cluster-pxb-8-4	passed	00:00:00
scaling-proxysql-8-0	passed	00:00:00
scaling-8-0	passed	00:00:00
scheduled-backup-5-7	passed	00:00:00
scheduled-backup-8-0	passed	00:00:00
scheduled-backup-8-4	passed	00:00:00
security-context-8-0	passed	00:00:00
smart-update1-8-0	passed	00:00:00
smart-update1-8-4	passed	00:00:00
smart-update2-8-0	passed	00:00:00
smart-update2-8-4	passed	00:00:00
smart-update3-8-0	passed	00:00:00
sst-retry-limit-8-0	passed	00:00:00
sst-retry-limit-8-4	passed	00:00:00
storage-8-0	passed	00:00:00
tls-issue-cert-manager-ref-8-0	passed	00:00:00
tls-issue-cert-manager-8-0	passed	00:00:00
tls-issue-self-8-0	passed	00:00:00
upgrade-consistency-8-0	passed	00:00:00
upgrade-consistency-8-4	passed	00:00:00
upgrade-haproxy-5-7	passed	00:00:00
upgrade-haproxy-8-0	passed	00:00:00
upgrade-proxysql-5-7	passed	00:00:00
upgrade-proxysql-8-0	passed	00:00:00
users-5-7	passed	00:00:00
users-8-0	passed	00:00:00
users-scheduler-8-4	passed	00:00:00
validation-hook-8-0	passed	00:00:00

Summary	Value
Tests Run	82/82
Job Duration	01:14:05
Total Test Time	00:48:59

commit: 3559db9
image: perconalab/percona-xtradb-cluster-operator:PR-2465-3559db98