mustache 3.0.0 — security major The protections v2.1 introduced in report mode become the enforced default, and every fail-open path found while hardening them is closed. Null validator means the DEFAULT POLICY (spec 11.2); containers are blocked by default with two escapes; getResolvedValues() types change; Stringable is no longer trusted by shape; parse-time ceilings apply in enforce, compound expressions included. Read UPGRADE-3.md (ships in this dist) before updating. 2.x is maintained for new vulnerabilities and Laravel compatibility until 2027-02-03. Approved 2026-08-03 (approvals/majors/mustache-3.md, central workspace) on candidate 1aca3db; tagged commit is docs-stamping only on top, code tree identical.