1.3.12

1.3.12

Released: Tue Apr 28 2026

bug

• [bug] [template] Fixed issue in TemplateLookup where a URI with backslash path
  separators (e.g. \..\secret.txt) could bypass the directory traversal
  check on Windows, allowing reads of arbitrary files outside of the template
  directory. Backslash characters in URIs are now normalized to forward
  slashes before path resolution.

  References: #435