fix: check prototype property access in strict-mode (#1736) - b6d3de7
fix: escape property names in compat mode (#1736) - f058970
refactor: In spec tests, use expectTemplate over equals and shouldThrow (#1683) - 77825f8
chore: start testing on Node.js 12 and 13 - 3789a30
(POSSIBLY) BREAKING CHANGES:
the changes from version 4.6.0 now also apply
in when using the compile-option "strict: true". Access to prototype properties is forbidden completely by default, specific properties or methods
can be allowed via runtime-options. See #1633 for details. If you are using Handlebars as documented, you should not be accessing prototype properties
from your template anyway, so the changes should not be a problem for you. Only the use of undocumented features can break your build.
That is why we only bump the patch version despite mentioning breaking changes.
BUGFIX allow the user's devTool setting to take priority over the default provided by forbidEval by @apellerano-pw.
1.12.1
COMPAT upgraded to @embroider/shared-internals 1.0 so that apps can avoid redundant copies
1.12.0
FEATURE: We now properly optimize TypeScript's import type syntax, meaning
if you only import the types from a package it will not be included in your
build.
Backports #380 from
v2.1.0 by @buschtoens.
1.11.3
NO-OP: I accidentally published 2.0.0-alpha.0 to NPM under the latest tag. This is a re-published of 1.11.2 to supplant that as latest.
1.11.2
BUGFIX: the new prefix matching implementation of alias turned out to be a breaking change, so we're rolling it back in order to make it opt-in.
1.11.1
BUGFIX: as part of the watchDependencies feature we changed webpack splitChunksPlugin config in a way that broke in apps with common lazy chunks.
1.11.0
HOUSEKEEPING: major test infrastructure refactor by @ef4 & @mattmcmanus
COMPAT: ensure babel compilation ignores a babel.config.js by @rwjblue
ENHANCEMENT: introduce watchDependencies option
ENHANCEMENT: allow unambiguous data URIs
ENHANCEMENT: make alias option support prefix matching by @buschtoens
BUGFIX: update test-support regex to work with scoped packages by @paddyobrien
1.10.1
BUGFIX: the previous release accidentally leaked code to browsers that was not IE11-safe.
1.10.0
ENHANCEMENT: we are now compatible with the Embroider package spec's handling of import(). Template string literals are allowed so long as they point unambiguously to modules within a specific package, or are unambiguously a URL.
BUGFIX: the test-support tree detection feature in 1.9.0 didn't actually match ember-cli's naming scheme, by @rwjblue.
1.9.0
ENHANCEMENT: use new API from ember-cli to reliably detect which trees are test-support only, even when addons override the default naming scheme by @rwjblue
ENHANCEMENT: switch to resolve-package-path for better shared caching with the rest of ember-cli by @rwjblue
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/FirebaseExtended/emberfire/network/alerts).
Bumps handlebars to 4.7.8 and updates ancestor dependency ember-auto-import. These dependencies need to be updated together.
Updates
handlebarsfrom 4.0.11 to 4.7.8Release notes
Sourced from handlebars's releases.
Changelog
Sourced from handlebars's changelog.
... (truncated)
Commits
8dc3d25v4.7.8668c4fbFix browser tests in CI pipelinec65c6ccTest on Node 183d3796cMake library compatible with workers075b354Fix sync issue with npm lock-file30dbf04Fix compiling of each block params in strict modee3a5448Fix bundler issue with webpack 58e23642Fix integration-tests issue with npm >= 788ac068use https instead of git for mustache submodulec68bc08Fix typoMaintainer changes
This version was pushed to npm by jaylinski, a new releaser for handlebars since your current version.
Updates
ember-auto-importfrom 1.5.2 to 1.12.2Changelog
Sourced from ember-auto-import's changelog.
... (truncated)
Commits
52bb126releasingeaeb05fAllow user webpack config to override internal config37d112areleasing0b779b6backporting embroider relase to 1.x series7c2517cRelease v1.12.03ac52fffix(analyzer): ignore type-only imports & exports (#433)1e04b7apublishing 1.11.36817a2ereleasinge180226Revert "feat: resolve alias as prefix"75e761fversion numberDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show