Changelog
*Sourced from [handlebars's changelog](https://github.com/wycats/handlebars.js/blob/v4.3.3/release-notes.md).*
> ## v4.3.3 - September 27th, 2019
> - fix test case for browsers that do not support __defineGetter__ - 8742bde
>
>
> [Commits](https://github.com/wycats/handlebars.js/compare/v4.3.2...v4.3.3)
>
> ## v4.3.2 - September 26th, 2019
> - Use Object.prototype.propertyIsEnumerable to check for constructors - 213c0bb, [#1563](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1563)
>
> Compatibility notes:
> - There are no breaking changes
>
> [Commits](https://github.com/wycats/handlebars.js/compare/v4.3.1...v4.3.2)
>
> ## v4.3.1 - September 25th, 2019
> Fixes:
>
> - do not break on precompiled templates from Handlebars >=4.0.0 <4.3.0 - 1266838, [#1561](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1561)
> - Ensure allowCallsToHelperMissing runtime option is optional in typings - 93444c5, 64ecb9e, [#1560](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1560)
>
>
>
> [Commits](https://github.com/wycats/handlebars.js/compare/v4.3.0...v4.3.1)
>
> ## v4.3.0 - September 24th, 2019
> Fixes:
>
> - Security: Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72
> - Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72
>
> Features:
>
> - Add new runtime option `allowCallsToHelperMissing` to allow calling `blockHelperMissing` and `helperMissing`.
>
> Breaking changes:
>
> Compatibility notes:
> - Compiler revision increased - 06b7224
> - This means that template compiled with versions prior to 4.3.0 will not work with runtimes >= 4.3.0
> The increase was done because the "helperMissing" and "blockHelperMissing" are now moved from the helpers
> to the internal "container.hooks" object, so old templates will not be able to call them anymore. We suggest
> that you always recompile your templates with the latest compiler in your build pipelines.
>
> - Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72
> - Calling "helperMissing" and "blockHelperMissing" directly from a template (like in `{{blockHelperMissing}}` was
> never intended and was part of the exploits that have been revealed early in 2019
> (see https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1495). *It is also part of a new exploit that
> is not captured by the earlier fix.* In order to harden Handlebars against such exploits, calling thos helpers
> is now not possible anymore. *Overriding* those helpers is still possible.
> - If you really need this behavior, you can set the runtime option `allowCallsToHelperMissing` to `true` and the
> ... (truncated)
Commits
- [`e473849`](https://github.com/wycats/handlebars.js/commit/e4738491b3e8db97aa9b4f9967f04093ceba1a1f) v4.3.3
- [`54f7e11`](https://github.com/wycats/handlebars.js/commit/54f7e11b28d81852cfc2cdf9d75c013af989495b) Update release notes
- [`8742bde`](https://github.com/wycats/handlebars.js/commit/8742bde70159559b0898d3c2c72eb4a2a1c6dd04) fix test case for browsers that do not support __defineGetter__
- [`2357140`](https://github.com/wycats/handlebars.js/commit/2357140c68d17cb4f8ab74431e8737de6b4b39b5) v4.3.2
- [`c5cbeac`](https://github.com/wycats/handlebars.js/commit/c5cbeac039de4a05113dbe1f5e14f29175228c78) Update release notes
- [`213c0bb`](https://github.com/wycats/handlebars.js/commit/213c0bbe3c4bd83a534d67384e5afa0000347ff6) Use Object.prototype.propertyIsEnumerable to check for constructors
- [`050cca0`](https://github.com/wycats/handlebars.js/commit/050cca0866b3496852d9b198141807c32e4dae81) v4.3.1
- [`2d55790`](https://github.com/wycats/handlebars.js/commit/2d5579078b36734b7db7f65b24a1ce5340164f78) Update release notes
- [`e3639e2`](https://github.com/wycats/handlebars.js/commit/e3639e240755ef713e128e7c67d30443ea01b732) fix saucelabs tests (internet explorer)
- [`c2a17c7`](https://github.com/wycats/handlebars.js/commit/c2a17c7b30009059743e3cb3c677d0adc2002775) fix saucelabs tests (internet explorer)
- Additional commits viewable in [compare view](https://github.com/wycats/handlebars.js/compare/v4.1.0...v4.3.3)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/aliatech/loopback-mongo-distinct-mixin/network/alerts).
Bumps handlebars from 4.1.0 to 4.3.3.
Changelog
*Sourced from [handlebars's changelog](https://github.com/wycats/handlebars.js/blob/v4.3.3/release-notes.md).* > ## v4.3.3 - September 27th, 2019 > - fix test case for browsers that do not support __defineGetter__ - 8742bde > > > [Commits](https://github.com/wycats/handlebars.js/compare/v4.3.2...v4.3.3) > > ## v4.3.2 - September 26th, 2019 > - Use Object.prototype.propertyIsEnumerable to check for constructors - 213c0bb, [#1563](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1563) > > Compatibility notes: > - There are no breaking changes > > [Commits](https://github.com/wycats/handlebars.js/compare/v4.3.1...v4.3.2) > > ## v4.3.1 - September 25th, 2019 > Fixes: > > - do not break on precompiled templates from Handlebars >=4.0.0 <4.3.0 - 1266838, [#1561](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1561) > - Ensure allowCallsToHelperMissing runtime option is optional in typings - 93444c5, 64ecb9e, [#1560](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1560) > > > > [Commits](https://github.com/wycats/handlebars.js/compare/v4.3.0...v4.3.1) > > ## v4.3.0 - September 24th, 2019 > Fixes: > > - Security: Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72 > - Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72 > > Features: > > - Add new runtime option `allowCallsToHelperMissing` to allow calling `blockHelperMissing` and `helperMissing`. > > Breaking changes: > > Compatibility notes: > - Compiler revision increased - 06b7224 > - This means that template compiled with versions prior to 4.3.0 will not work with runtimes >= 4.3.0 > The increase was done because the "helperMissing" and "blockHelperMissing" are now moved from the helpers > to the internal "container.hooks" object, so old templates will not be able to call them anymore. We suggest > that you always recompile your templates with the latest compiler in your build pipelines. > > - Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72 > - Calling "helperMissing" and "blockHelperMissing" directly from a template (like in `{{blockHelperMissing}}` was > never intended and was part of the exploits that have been revealed early in 2019 > (see https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1495). *It is also part of a new exploit that > is not captured by the earlier fix.* In order to harden Handlebars against such exploits, calling thos helpers > is now not possible anymore. *Overriding* those helpers is still possible. > - If you really need this behavior, you can set the runtime option `allowCallsToHelperMissing` to `true` and the > ... (truncated)Commits
- [`e473849`](https://github.com/wycats/handlebars.js/commit/e4738491b3e8db97aa9b4f9967f04093ceba1a1f) v4.3.3 - [`54f7e11`](https://github.com/wycats/handlebars.js/commit/54f7e11b28d81852cfc2cdf9d75c013af989495b) Update release notes - [`8742bde`](https://github.com/wycats/handlebars.js/commit/8742bde70159559b0898d3c2c72eb4a2a1c6dd04) fix test case for browsers that do not support __defineGetter__ - [`2357140`](https://github.com/wycats/handlebars.js/commit/2357140c68d17cb4f8ab74431e8737de6b4b39b5) v4.3.2 - [`c5cbeac`](https://github.com/wycats/handlebars.js/commit/c5cbeac039de4a05113dbe1f5e14f29175228c78) Update release notes - [`213c0bb`](https://github.com/wycats/handlebars.js/commit/213c0bbe3c4bd83a534d67384e5afa0000347ff6) Use Object.prototype.propertyIsEnumerable to check for constructors - [`050cca0`](https://github.com/wycats/handlebars.js/commit/050cca0866b3496852d9b198141807c32e4dae81) v4.3.1 - [`2d55790`](https://github.com/wycats/handlebars.js/commit/2d5579078b36734b7db7f65b24a1ce5340164f78) Update release notes - [`e3639e2`](https://github.com/wycats/handlebars.js/commit/e3639e240755ef713e128e7c67d30443ea01b732) fix saucelabs tests (internet explorer) - [`c2a17c7`](https://github.com/wycats/handlebars.js/commit/c2a17c7b30009059743e3cb3c677d0adc2002775) fix saucelabs tests (internet explorer) - Additional commits viewable in [compare view](https://github.com/wycats/handlebars.js/compare/v4.1.0...v4.3.3)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/aliatech/loopback-mongo-distinct-mixin/network/alerts).