We use https://github.com/TomFrost/Jexl to parse the expressions while filtering out plugin properties from widget json while the user is configuring the plugin.
We use an internal API to parse the expression and get tokens. This API was changed and we didn't check post upgrade.
We have unit tests for this and this was not run as part of each PR. So we merged without checking with unit tests.