djlint 1.46.0 on Python PyPI

Feature

New rule T041 reports an {% extends %} that is not the first tag in the template, which django refuses to compile and which leaks whatever text comes before it into the page. A {# #} comment before it is left alone, as is anything inside a {% comment %}, {% raw %} or {% verbatim %} block, named or not, a {# djlint:off #} region or yaml front matter. An html comment is reported, since it is written into the page ahead of the parent template's doctype, and so is a branch tag on the django profile, where {% if x %}{% extends "a.html" %}{% endif %} does not compile; jinja documents that form and keeps it.
New rule T042 reports text or html written after {% extends %} and outside every {% block %}, which the engine silently discards. A template tag there still runs and is left alone, as are comments and the body of a {% macro %}.
New rule T043 reports a block name used more than once in a template, which Django, Jinja and Nunjucks all refuse to parse, even where the two blocks sit in different branches of an {% if %}. A {% blocktrans %}, a named {% endblock %}, a block inside a template comment, a {% comment %} block or a {% raw %} or {% verbatim %} body, and the blocks an {% embed %} fills in another template are left alone; a block inside an html comment or a <script> counts, since the engine still parses it.
New rule T044 reports a statement keyword inside an output tag, such as {{ if x }}, {{ url 'home' }} or {{ endif }}, where a {% %} block tag was meant. A bare keyword such as {{ url }} is an ordinary variable and is left alone, as is an expression that merely starts with one of the names, such as {{ url ~ "/x" }}, {{ url ? url : '#' }} or {{ block ('title') }}, and so is the body of a {% raw %} or {% verbatim %} block, named or not.
New rule T045 reports a statement tag, such as {% include %} or {% if %}, written inside an html comment, where it still runs. A value printed into a comment, as in , is left alone, and so is a bare Go keyword such as , which is an ordinary variable under every other profile, and a {% under handlebars and golang, which have no such syntax. A tag inside a template comment, a {% comment %} block or a raw block is left alone whether it is written with whitespace control, tabs or a named closing tag, as is one inside an Internet Explorer conditional comment, in any case and closed by its <![endif]-->; one left unclosed is the ordinary comment a browser reads it as and is reported.
New rule H053 reports an id used more than once in the file, which breaks getElementById, <label for> and fragment links. Two ids in exclusive branches of one {% if %} are never both rendered and are not reported, whichever language writes the branch, and neither are two ids in separate <template> fragments; a value written by a template tag is left alone.
New rule H054 reports an interactive element nested inside another, such as a <button> inside an <a href> or a link inside a button. An <a> without an href is not interactive and is left alone, as is a hidden input or one whose type a template tag writes.
New rule H055 reports a lang on <html> that is not a language tag, such as lang="english", lang="en_US" or a value that is only whitespace, which H005 reads as present. An empty value is left to H005, and so is a value written by a template tag or by a php short echo, as in lang="<?= $lang ?>", while a value that merely starts with $ or {, such as lang="$LANG", is read as written. A > written inside a template tag ahead of the attribute, as in {% if a > b %}, does not hide it.
New rule H056 reports an empty src on an element that fetches what it names, such as <img src=""> or <script src=""></script>, which a browser resolves to the page itself. A src with no value at all counts too, while an unquoted value such as src=/static/logo.png, a value written by a template tag, a value that is only whitespace, and the separate srcset and data-src attributes are left alone.
New rule H057 reports a <video> with no captions track, which WCAG 1.2.2 requires for prerecorded video with sound. A <track> of kind captions or subtitles counts, as does one with no kind, since subtitles is the default, while a commented out track and one written inside an attribute value do not; a muted video is left alone, as is one whose tracks or attributes a template tag may write, meaning a real {{, {%, {# or ${ rather than the brace of a css value or the $ of a jQuery handler or a price.
New option --sarif writes the findings as a SARIF 2.1.0 document, which GitHub code scanning, Azure DevOps and most editors read, so a run can be uploaded and kept in the Security tab with history rather than shown only as annotations on one pull request. With --check, a file that would be reformatted is reported under a formatting rule.

Fix

A mako <% %> or <%! %> code block is left as written, since its body is python rather than markup. Formatting re-indented it, flattening a return "unit" inside an if to the start of the line and leaving python that no longer parses, and a tag written in a python string was read as markup, so H025, H054 and T001 reported findings inside these blocks. A <%def> body is markup and is still formatted and linted.
H037 no longer reads an unquoted attribute value as an attribute name, so <img width=1 height=1> is not reported as a duplicate 1. This started in 1.45.0, and a real duplicate whose values are unquoted and start with /, . or #, as in href=/a href=/b, is now caught too.