Changelog
*Sourced from [handlebars's changelog](https://github.com/wycats/handlebars.js/blob/master/release-notes.md).*
> ## v4.3.0 - September 24th, 2019
> Fixes:
>
> - Security: Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72
> - Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72
>
> Features:
>
> - Add new runtime option `allowCallsToHelperMissing` to allow calling `blockHelperMissing` and `helperMissing`.
>
> Breaking changes:
>
> Compatibility notes:
> - Compiler revision increased - 06b7224
> - This means that template compiled with versions prior to 4.3.0 will not work with runtimes >= 4.3.0
> The increase was done because the "helperMissing" and "blockHelperMissing" are now moved from the helpers
> to the internal "container.hooks" object, so old templates will not be able to call them anymore. We suggest
> that you always recompile your templates with the latest compiler in your build pipelines.
>
> - Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72
> - Calling "helperMissing" and "blockHelperMissing" directly from a template (like in `{{blockHelperMissing}}` was
> never intended and was part of the exploits that have been revealed early in 2019
> (see https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1495). *It is also part of a new exploit that
> is not captured by the earlier fix.* In order to harden Handlebars against such exploits, calling thos helpers
> is now not possible anymore. *Overriding* those helpers is still possible.
> - If you really need this behavior, you can set the runtime option `allowCallsToHelperMissing` to `true` and the
> calls will again be possible
>
> Both bullet points imly that Handlebars is not 100% percent compatible to 4.2.0, despite the minor version bump.
>
> We consider it more important to resolve a major security issue than to maintain 100% compatibility.
>
>
>
> [Commits](https://github.com/wycats/handlebars.js/compare/v4.2.1...v4.3.0)
>
> ## v4.2.1 - September 20th, 2019
> Bugfixes:
>
> - The "browser" property in the package.json has been updated to use the common-js builds instead of the minified UMD - c55a7be, [#1553](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1553)
>
> Compatibility notes:
> - No compatibility issues should arise
>
> [Commits](https://github.com/wycats/handlebars.js/compare/v4.2.0...v4.2.1)
>
> ## v4.2.0 - September 3rd, 2019
> Chore/Test:
> - Use custom `grunt-saucelab` with current sauce-connect proxy - f119497
> - Add framework for various integration tests - f9cce4d
> ... (truncated)
Commits
- [`a89081d`](https://github.com/wycats/handlebars.js/commit/a89081d440a9da9f3f25835f47de837907b0094a) v4.3.0
- [`bba6560`](https://github.com/wycats/handlebars.js/commit/bba65605b111965bc1e1643a489a3b3c56f190b3) Update release notes
- [`06b7224`](https://github.com/wycats/handlebars.js/commit/06b7224ed94ad00d342be416250305a8cb92112b) adjust compiler revision
- [`2078c72`](https://github.com/wycats/handlebars.js/commit/2078c727c627f25d4a149962f05c1e069beb18bc) Disallow calling "helperMissing" and "blockHelperMissing" directly
- [`fff3e40`](https://github.com/wycats/handlebars.js/commit/fff3e40402c9f9cd790984560658646a26e1c930) v4.2.1
- [`35bcd44`](https://github.com/wycats/handlebars.js/commit/35bcd4405fad758520308754f05b88c97c7b380c) Update release notes
- [`00b4f2f`](https://github.com/wycats/handlebars.js/commit/00b4f2ff98bf6285cc551f090166a92a70196124) Fix some small typos.
- [`e47b5ec`](https://github.com/wycats/handlebars.js/commit/e47b5ec192392cee548c5c01dc85b72b0fc8419b) integration-tests for various webpack-scenarios
- [`c55a7be`](https://github.com/wycats/handlebars.js/commit/c55a7bed781b4cff132d18d778bf16268ce34f01) fix: use cjs for browser fields
- [`164c7ce`](https://github.com/wycats/handlebars.js/commit/164c7ceea4ce074f70f2fefeba81e2e551757ea6) v4.2.0
- Additional commits viewable in [compare view](https://github.com/wycats/handlebars.js/compare/v4.1.2...v4.3.0)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/bbc/speculate/network/alerts).
dependabot[bot]
commented
4 years ago
Bumps handlebars from 4.1.2 to 4.3.0.
Changelog
*Sourced from [handlebars's changelog](https://github.com/wycats/handlebars.js/blob/master/release-notes.md).* > ## v4.3.0 - September 24th, 2019 > Fixes: > > - Security: Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72 > - Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72 > > Features: > > - Add new runtime option `allowCallsToHelperMissing` to allow calling `blockHelperMissing` and `helperMissing`. > > Breaking changes: > > Compatibility notes: > - Compiler revision increased - 06b7224 > - This means that template compiled with versions prior to 4.3.0 will not work with runtimes >= 4.3.0 > The increase was done because the "helperMissing" and "blockHelperMissing" are now moved from the helpers > to the internal "container.hooks" object, so old templates will not be able to call them anymore. We suggest > that you always recompile your templates with the latest compiler in your build pipelines. > > - Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72 > - Calling "helperMissing" and "blockHelperMissing" directly from a template (like in `{{blockHelperMissing}}` was > never intended and was part of the exploits that have been revealed early in 2019 > (see https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1495). *It is also part of a new exploit that > is not captured by the earlier fix.* In order to harden Handlebars against such exploits, calling thos helpers > is now not possible anymore. *Overriding* those helpers is still possible. > - If you really need this behavior, you can set the runtime option `allowCallsToHelperMissing` to `true` and the > calls will again be possible > > Both bullet points imly that Handlebars is not 100% percent compatible to 4.2.0, despite the minor version bump. > > We consider it more important to resolve a major security issue than to maintain 100% compatibility. > > > > [Commits](https://github.com/wycats/handlebars.js/compare/v4.2.1...v4.3.0) > > ## v4.2.1 - September 20th, 2019 > Bugfixes: > > - The "browser" property in the package.json has been updated to use the common-js builds instead of the minified UMD - c55a7be, [#1553](https://github-redirect.dependabot.com/wycats/handlebars.js/issues/1553) > > Compatibility notes: > - No compatibility issues should arise > > [Commits](https://github.com/wycats/handlebars.js/compare/v4.2.0...v4.2.1) > > ## v4.2.0 - September 3rd, 2019 > Chore/Test: > - Use custom `grunt-saucelab` with current sauce-connect proxy - f119497 > - Add framework for various integration tests - f9cce4d > ... (truncated)Commits
- [`a89081d`](https://github.com/wycats/handlebars.js/commit/a89081d440a9da9f3f25835f47de837907b0094a) v4.3.0 - [`bba6560`](https://github.com/wycats/handlebars.js/commit/bba65605b111965bc1e1643a489a3b3c56f190b3) Update release notes - [`06b7224`](https://github.com/wycats/handlebars.js/commit/06b7224ed94ad00d342be416250305a8cb92112b) adjust compiler revision - [`2078c72`](https://github.com/wycats/handlebars.js/commit/2078c727c627f25d4a149962f05c1e069beb18bc) Disallow calling "helperMissing" and "blockHelperMissing" directly - [`fff3e40`](https://github.com/wycats/handlebars.js/commit/fff3e40402c9f9cd790984560658646a26e1c930) v4.2.1 - [`35bcd44`](https://github.com/wycats/handlebars.js/commit/35bcd4405fad758520308754f05b88c97c7b380c) Update release notes - [`00b4f2f`](https://github.com/wycats/handlebars.js/commit/00b4f2ff98bf6285cc551f090166a92a70196124) Fix some small typos. - [`e47b5ec`](https://github.com/wycats/handlebars.js/commit/e47b5ec192392cee548c5c01dc85b72b0fc8419b) integration-tests for various webpack-scenarios - [`c55a7be`](https://github.com/wycats/handlebars.js/commit/c55a7bed781b4cff132d18d778bf16268ce34f01) fix: use cjs for browser fields - [`164c7ce`](https://github.com/wycats/handlebars.js/commit/164c7ceea4ce074f70f2fefeba81e2e551757ea6) v4.2.0 - Additional commits viewable in [compare view](https://github.com/wycats/handlebars.js/compare/v4.1.2...v4.3.0)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/bbc/speculate/network/alerts).