
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
Scriban is a fast, powerful, safe and lightweight scripting language and engine for .NET, which was primarily developed for text templating with a compatibility mode for parsing liquid templates.
Scriban is a fast, powerful, safe and lightweight scripting language and engine for .NET, which was primarily developed for text templating with a compatibility mode for parsing liquid templates.
Today, not only Scriban can be used in text templating scenarios, but also can be integrated as a general scripting engine: For example, Scriban is at the core of the scripting engine for kalk, a command line calculator application for developers.
// Parse a scriban template
var template = Template.Parse("Hello {{name}}!");
var result = template.Render(new { Name = "World" }); // => "Hello World!"
Parse a Liquid template using the Liquid language:
// Parse a liquid template
var template = Template.ParseLiquid("Hello {{name}}!");
var result = template.Render(new { Name = "World" }); // => "Hello World!"
The language is very versatile, easy to read and use, similar to liquid templates:
var template = Template.Parse(@"
<ul id='products'>
{{ for product in products }}
<li>
<h2>{{ product.name }}</h2>
Price: {{ product.price }}
{{ product.description | string.truncate 15 }}
</li>
{{ end }}
</ul>
");
var result = template.Render(new { Products = this.ProductList });
Scriban can also be used in pure scripting context without templating ({{ and }}) and can help you to create your own small DSL.
[!NOTE] By default, Properties and methods of .NET objects are automatically exposed with lowercase and
_names. It means that a property likeMyMethodIsNicewill be exposed asmy_method_is_nice. This is the default convention, originally to match the behavior of liquid templates. If you want to change this behavior, you need to use aMemberRenamerdelegate
ScriptVisitor, parent links on ScriptNode, and round-trippable formatting with Template.ToText.?.), and conditional expressions.ScriptLang and ScriptMode, including Scriban, Liquid, and Scientific parsing.TemplateContext options such as relaxed member, function, target, and indexer access.object.eval and object.eval_template.Template.RenderAsync.Template.ToText, allowing to manipulate scripts in memory and re-save them to the disk, useful for roundtrip script update scenariosliquid by using the Template.ParseLiquid method
liquid language is less powerful than scriban, this mode allows to migrate from liquid to scriban language easilyliquid script to a scriban script using Template.ToText on a template parsed with Template.ParseLiquidasync/await evaluation of scripts (e.g Template.RenderAsync)if/else/for/while, expressions (x = 1 + 2), conditions... etc.myvar | string.capitalize)
func statement and allow function pointers/delegates via the alias @ directivex = {mymember: 1}) and arrays (e.g x = [1,2,3,4])wrap statementarray, date, html, math, object, regex, string, timespan{{...}}ScriptObject-based APIs produce zero linker warnings for Native AOT publishingYou can install the Scriban Extension for Visual Studio Code to get syntax coloring for scriban scripts (without HTML) and scriban html files.
The full documentation is available at https://scriban.github.io.
Scriban is available as a NuGet package:
dotnet add package Scriban
The package targets netstandard2.0 and net8.0, so it works with .NET 6+, .NET Framework 4.7.2+, and other compatible runtimes.
Also the Scriban.Signed NuGet package provides signed assemblies.
The package includes Scriban source files so that you can internalize Scriban into your project instead of consuming it only as a binary dependency. This is useful in environments where NuGet references are not convenient, such as Roslyn source generators.
[!WARNING] Currently, Scriban source files are not marked as read-only in this mode. Do not modify them unless you intend to affect other projects on the same machine that use the embedded sources. Use this feature at your own risk.
In order to activate this feature you need to:
PackageScribanIncludeSource to true in your project:
<PropertyGroup>
<PackageScribanIncludeSource>true</PackageScribanIncludeSource>
</PropertyGroup>
IncludeAssets="Build" to the NuGet PackageReference for Scriban:
<ItemGroup>
<PackageReference Include="Scriban" Version="x.y.z" IncludeAssets="Build" />
</ItemGroup>
<PropertyGroup>
<LangVersion>9.0</LangVersion>
<Nullable>enable</Nullable>
</PropertyGroup>
If you are targeting netstandard2.0 or .NET Framework 4.7.2+, you will also need the supporting packages Scriban compiles against. They can already come from another dependency in your project:
<ItemGroup>
<PackageReference Include="Microsoft.CSharp" Version="4.7.0" />
<PackageReference Include="System.Threading.Tasks.Extensions" Version="4.6.3" />
<PackageReference Include="PolySharp" Version="1.15.0">
<PrivateAssets>all</PrivateAssets>
<IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
</PackageReference>
</ItemGroup>
[!NOTE]
Scriban.targetsalready definesSCRIBAN_NO_SYSTEM_TEXT_JSONandSCRIBAN_SOURCE_INCLUDEwhenPackageScribanIncludeSourceistrue, so you do not need to add these constants manually.In this mode, all Scriban types are marked as
internal.
System.Text.Json-based features are intentionally disabled in source-embedding mode. This includes helpers such asobject.from_json,object.to_json, and directJsonElementimport support.
This software is released under the BSD-Clause 2 license.
Supports this project with a monthly donation and help me continue improving it. [Become a sponsor]
Lilith River, author of Imageflow Server, an easy on-demand
image editing, optimization, and delivery server
Adapted logo Puzzle by Andrew Doane from the Noun Project
Alexandre Mutel aka xoofx.
FAQs
Scriban is a fast, powerful, safe and lightweight scripting language and engine for .NET, which was primarily developed for text templating with a compatibility mode for parsing liquid templates.
We found that scriban demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.