Changelog
*Sourced from [handlebars's changelog](https://github.com/wycats/handlebars.js/blob/master/release-notes.md).*
> ## v4.3.0 - September 24th, 2019
> Fixes:
>
> - Security: Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72
> - Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72
>
> Features:
>
> - Add new runtime option `allowCallsToHelperMissing` to allow calling `blockHelperMissing` and `helperMissing`.
>
> Breaking changes:
>
> Compatibility notes:
> - Compiler revision increased - 06b7224
> - This means that template compiled with versions prior to 4.3.0 will not work with runtimes >= 4.3.0
> The increase was done because the "helperMissing" and "blockHelperMissing" are now moved from the helpers
> to the internal "container.hooks" object, so old templates will not be able to call them anymore. We suggest
> that you always recompile your templates with the latest compiler in your build pipelines.
>
> - Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72
> - Calling "helperMissing" and "blockHelperMissing" directly from a template (like in `{{blockHelperMissing}}` was
> never intended and was part of the exploits that have been revealed early in 2019
> (see https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1495). *It is also part of a new exploit that
> is not captured by the earlier fix.* In order to harden Handlebars against such exploits, calling thos helpers
> is now not possible anymore. *Overriding* those helpers is still possible.
> - If you really need this behavior, you can set the runtime option `allowCallsToHelperMissing` to `true` and the
> calls will again be possible
>
> Both bullet points imly that Handlebars is not 100% percent compatible to 4.2.0, despite the minor version bump.
>
> We consider it more important to resolve a major security issue than to maintain 100% compatibility.
>
>
>
> [Commits](https://github.com/wycats/handlebars.js/compare/v4.2.1...v4.3.0)
Commits
- [`a89081d`](https://github.com/wycats/handlebars.js/commit/a89081d440a9da9f3f25835f47de837907b0094a) v4.3.0
- [`bba6560`](https://github.com/wycats/handlebars.js/commit/bba65605b111965bc1e1643a489a3b3c56f190b3) Update release notes
- [`06b7224`](https://github.com/wycats/handlebars.js/commit/06b7224ed94ad00d342be416250305a8cb92112b) adjust compiler revision
- [`2078c72`](https://github.com/wycats/handlebars.js/commit/2078c727c627f25d4a149962f05c1e069beb18bc) Disallow calling "helperMissing" and "blockHelperMissing" directly
- See full diff in [compare view](https://github.com/wycats/handlebars.js/compare/v4.2.1...v4.3.0)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/OysteinAmundsen/gymsystems/network/alerts).
Bumps handlebars from 4.2.1 to 4.3.0.
Changelog
*Sourced from [handlebars's changelog](https://github.com/wycats/handlebars.js/blob/master/release-notes.md).* > ## v4.3.0 - September 24th, 2019 > Fixes: > > - Security: Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72 > - Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72 > > Features: > > - Add new runtime option `allowCallsToHelperMissing` to allow calling `blockHelperMissing` and `helperMissing`. > > Breaking changes: > > Compatibility notes: > - Compiler revision increased - 06b7224 > - This means that template compiled with versions prior to 4.3.0 will not work with runtimes >= 4.3.0 > The increase was done because the "helperMissing" and "blockHelperMissing" are now moved from the helpers > to the internal "container.hooks" object, so old templates will not be able to call them anymore. We suggest > that you always recompile your templates with the latest compiler in your build pipelines. > > - Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72 > - Calling "helperMissing" and "blockHelperMissing" directly from a template (like in `{{blockHelperMissing}}` was > never intended and was part of the exploits that have been revealed early in 2019 > (see https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1495). *It is also part of a new exploit that > is not captured by the earlier fix.* In order to harden Handlebars against such exploits, calling thos helpers > is now not possible anymore. *Overriding* those helpers is still possible. > - If you really need this behavior, you can set the runtime option `allowCallsToHelperMissing` to `true` and the > calls will again be possible > > Both bullet points imly that Handlebars is not 100% percent compatible to 4.2.0, despite the minor version bump. > > We consider it more important to resolve a major security issue than to maintain 100% compatibility. > > > > [Commits](https://github.com/wycats/handlebars.js/compare/v4.2.1...v4.3.0)Commits
- [`a89081d`](https://github.com/wycats/handlebars.js/commit/a89081d440a9da9f3f25835f47de837907b0094a) v4.3.0 - [`bba6560`](https://github.com/wycats/handlebars.js/commit/bba65605b111965bc1e1643a489a3b3c56f190b3) Update release notes - [`06b7224`](https://github.com/wycats/handlebars.js/commit/06b7224ed94ad00d342be416250305a8cb92112b) adjust compiler revision - [`2078c72`](https://github.com/wycats/handlebars.js/commit/2078c727c627f25d4a149962f05c1e069beb18bc) Disallow calling "helperMissing" and "blockHelperMissing" directly - See full diff in [compare view](https://github.com/wycats/handlebars.js/compare/v4.2.1...v4.3.0)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/OysteinAmundsen/gymsystems/network/alerts).