Dust filter functions previously took one argument, the string to filter. They now accept a second argument, which is the current context.
Helpers
Dust helpers can now return primitives.
Helpers act like references or sections depending on if they have a body. When they have no body, they act like a reference and look in params.filters for filters to use. When they have a body, they act like a section. You can return thenables and streams normally.
In previous versions, setting dust.config.cache to false would blow away the entire cache on every render. Now, setting it to false just prevents new templates from being added and cached templates from being used. Setting it back to true means that previously-cached templates will be ready to use.
dust.onLoad
We have added a callback(null, compiledTemplate) signature to dust.onLoad.
Calling the onLoad callback with a compiled template function will use this template to satisfy the load request. The template is not automatically registered under any name when passed to the callback, so the onLoad function should handle registration as it needs.
You can still call the callback with uncompiled template source and Dust will compile and store it, while respecting your dust.config.cache setting.
#753 {?exists} and {^exists} resolve Promises and check if the result exists (#753) (@samuelms1)
v2.7.4 (2016/09/13 02:52 +00:00)
#744 Don't use instanceof to determine if a Context is a Context. Instead use a flag on the instance itself so it can survive object merges. (@sethkinast)
Previously returning a primitive would crash rendering with no way to recover. You can still return a Chunk and do more complex work if you need to.
Helpers act like references or sections depending on if they have a body. When they have no body, they act like a reference and look in params.filters for filters to use. When they have a body, they act like a section. You can return thenables and streams normally.
#655 Update CommonJS example to make use of new onLoad behavior (@sethkinast)
#653 Fix array iteration when context is undefined (@sethkinast)
#641 Add a cb(null, compiledTemplate) signature to dust.onLoad
Calling the onLoad callback with a compiled template function will use this template to satisfy the load request. The template is not automatically registered under any name when passed to the callback, so the onLoad function should handle registration as it needs.
dust.cache behavior has been changed slightly. Before, setting it to false would blow away the entire cache on every render. Now, setting it to false just prevents new templates from being added and cached templates from being used, but if it's set to true again previously-cached templates will be ready to use. (@sethkinast)
NOTE: Despite being a minor release, this update includes a breaking change that we had to make to fix a security issue ( CVE-2020-11022). Please follow the blog post & the upgrade guide for more details.
I've formatted this as a FAQ, please feel free to open an issue for any additional question and I'll add the response here.
Q: What impact will this have on me?
In most cases, you shouldn't notice any change.
The only exception I can think of is if you pull code directly from https://github.com/visionmedia/debug, e.g. via a "debug": "visionmedia/debug"-type version entry in your package.json - in which case, you should still be fine due to the automatic redirection Github sets up, but you should also update any references as soon as possible.
Q: What are the security implications of this change?
If you pull code directly from the old URL, you should update the URL to https://github.com/debug-js/debug as soon as possible. The old organization has many approved owners and thus a new repository could (in theory) be created at the old URL, circumventing Github's automatic redirect that is in place now and serving malicious code. I (@qix-) also wouldn't have access to that repository, so while I don't think it would happen, it's still something to consider.
Even in such a case, however, the officially released package on npm (debug) would not be affected. That package is still very much under control (even more than it used to be).
Q: What should I do if I encounter an issue related to the migration?
Search the issues first to see if someone has already reported it, and then open a new issue if someone has not.
Q: Why was this done as a 'patch' release? Isn't this breaking?
No, it shouldn't be breaking. The package on npm shouldn't be affected (aside from this patch release) and any references to the old repository should automatically redirect.
Thus, according to all of the "APIs" (loosely put) involved, nothing should have broken.
fix: check prototype property access in strict-mode (#1736) - b6d3de7
fix: escape property names in compat mode (#1736) - f058970
refactor: In spec tests, use expectTemplate over equals and shouldThrow (#1683) - 77825f8
chore: start testing on Node.js 12 and 13 - 3789a30
(POSSIBLY) BREAKING CHANGES:
the changes from version 4.6.0 now also apply
in when using the compile-option "strict: true". Access to prototype properties is forbidden completely by default, specific properties or methods
can be allowed via runtime-options. See #1633 for details. If you are using Handlebars as documented, you should not be accessing prototype properties
from your template anyway, so the changes should not be a problem for you. Only the use of undocumented features can break your build.
That is why we only bump the patch version despite mentioning breaking changes.
Bumps the npm_and_yarn group with 14 updates in the /. directory:
2.5.03.0.00.0.51.4.02.2.43.5.04.17.44.17.210.7.32.0.01.278.11.1064.04.1.14.3.44.12.44.18.26.5.26.11.01.9.01.20.24.0.114.7.74.0.44.2.00.0.81.2.811.1.518.7.0Updates
dustjs-linkedinfrom 2.5.0 to 3.0.0Release notes
Sourced from dustjs-linkedin's releases.
... (truncated)
Changelog
Sourced from dustjs-linkedin's changelog.
Closes #674 (
@sethkinast)Previously returning a primitive would crash rendering with no way to recover. You can still return a Chunk and do more complex work if you need to.
Helpers act like references or sections depending on if they have a body. When they have no body, they act like a reference and look in
params.filtersfor filters to use. When they have a body, they act like a section. You can return thenables and streams normally.{
@returnvalue="" filters="|s" /} {@returnvalue=""}{.} World{/return}Closes #645 (
@sethkinast)Closes #663 (
@sethkinast)Closes #649 Closes #602 Closes #642 (
@sethkinast)Closes #659 (
@sethkinast)Calling the
onLoadcallback with a compiled template function will use this template to satisfy the load request. The template is not automatically registered under any name when passed to the callback, so theonLoadfunction should handle registration as it needs.dust.cachebehavior has been changed slightly. Before, setting it to false would blow away the entire cache on every render. Now, setting it to false just prevents new templates from being added and cached templates from being used, but if it's set to true again previously-cached templates will be ready to use. (@sethkinast)dust.renderanddust.streamnow accept a compiled template function in addition to a template name.dust.compileno longer requires a template name, and will compile an anonymous template without one (so--nameis no longer required for dustc either)dust.loadis removed from the public APIdust.renderSourceis moved to the compiler, so it's only included in dust-full now (Fixes #412)dust.compileFnis moved to the compiler, so it's only included in dust-full nowdust.isTemplateFndust.config.cache = true, set tofalseto disable caching and load templates again every time (Fixes #451)dust.config.cjs = false, set totrueto compile templates as CommonJS modules--cjsflag todustcdust.compiler(but leave it exposed until 2.8) (@sethkinast)... (truncated)
Commits
2e8795cRelease v3.0.06f98371merge from 2.7db6d8b9Merge pull request #805 from sumeetkakkar/fix/proto-pollutionddb6523fix for prototype pollution vulnerability822222eRelease v2.7.5d0f955dDecrease security vulnerabilities by upgrading cli dependency (#754 #748)e0e25f7Merge pull request #756 from danactive/mastereeb1c17Decrease security vulnerabilities by upgrading cli dependency (#754 #748)d485a72{?exists} and {^exists} resolve Promises and check if the result exists (#753)9a08207Release v2.7.4Maintainer changes
This version was pushed to npm by krakenjs, a new releaser for dustjs-linkedin since your current version.
Updates
express-fileuploadfrom 0.0.5 to 1.4.0Release notes
Sourced from express-fileupload's releases.
... (truncated)
Commits
Maintainer changes
This version was pushed to npm by richardgirges, a new releaser for express-fileupload since your current version.
Updates
jqueryfrom 2.2.4 to 3.5.0Release notes
Sourced from jquery's releases.
Commits
7a0a8503.5.08570a08Release: Update AUTHORS.txtda3dd85Ajax: Do not execute scripts for unsuccessful HTTP responses065143cAjax: Overwrite s.contentType with content-type header value, if any1a4f10dTests: Blacklist one focusin test in IE9e15d6bEvent: Use only one focusin/out handler per matching window & document966a709Manipulation: Skip the select wrapper for <option> outside of IE 91d61fd9Manipulation: Make jQuery.htmlPrefilter an identity function04bf577Selector: Update Sizzle from 2.3.4 to 2.3.57506c9cBuild: Resolve Travis config warningsMaintainer changes
This version was pushed to npm by mgol, a new releaser for jquery since your current version.
Updates
lodashfrom 4.17.4 to 4.17.21Commits
f299b52Bump to v4.17.21c4847ebImprove performance oftoNumber,trimandtrimEndon large input strings3469357Prevent command injection through_.template'svariableoptionded9bc6Bump to v4.17.20.63150efDocumentation fixes.00f0f62test.js: Remove trailing comma.846e434Temporarily use a custom fork oflodash-cli.5d046f3Re-enable Travis tests on4.17branch.aa816b3Remove/npm-package.d7fbc52Bump to v4.17.19Maintainer changes
This version was pushed to npm by bnjmnt4n, a new releaser for lodash since your current version.
Updates
msfrom 0.7.3 to 2.0.0Release notes
Sourced from ms's releases.
Commits
9b88d152.0.094b995cInvalidated cache for slack badgebcf5715Bumped dependencies to the latest versionb1eaab7Ignored logs coming from npmcaae298Limit str to 100 to avoid ReDoS of 0.3s (#89)b83b36dchore(package): update eslint to version 3.19.0 (#88)3f2a4d7chore(package): update husky to version 0.13.3 (#86)7daf9841.0.0ee91f30More suitable name for file containing testse818c35Removed browser testingUpdates
snykfrom 1.278.1 to 1.1064.0Commits
bd96e74Merge pull request #4221 from snyk/fix/quote-args80d97a9fix: escape child process argumentsc028b50Merge pull request #4216 from snyk/feat/unmanaged-deps-severity-thresholdcc329fdfeat: support sev.threshold for unm.-deps3daf5c7Merge pull request #4214 from snyk/feat/base64-default2df2037Merge pull request #4219 from snyk/fix/gradle-use-lenient-configafc1ccbfix: use lenient config in gradle plugin85bb57fMerge pull request #4215 from snyk/feat/upgrade-policy-engine-v0.12.2ef864befeat: upgrade snyk-iac-test to v0.37.0369fe11feat: base64 default for sast analysisMaintainer changes
This version was pushed to npm by snyk-admin, a new releaser for snyk since your current version.
Updates
debugfrom 4.1.1 to 4.3.4Release notes
Sourced from debug's releases.
... (truncated)
Commits
da66c864.3.49b33412replace deprecated String.prototype.substr() (#876)c0805ccadd section about configuring JS console to show debug messages (#866)043d3cd4.3.34079aaeupdate license and more maintainership information19b36c0update repository location + maintainership informationf851b00adds README section regarding usage in child procs (#850)d177f2bRemove accidental epizeuxise47f96d4.3.21e9d38ccache enabled status per-logger (#799)Maintainer changes
This version was pushed to npm by qix, a new releaser for debug since your current version.
Updates
expressfrom 4.12.4 to 4.18.2Release notes
Sourced from express's releases.
... (truncated)
Changelog
Sourced from express's changelog.
... (truncated)
Commits
8368dc14.18.261f4049docs: replace Freenode with Libera Chatbb7907bbuild: Node.js@18.10f56ce73build: supertest@6.3.024b3dc5deps: qs@6.11.0689d175deps: body-parser@1.20.1340be0fbuild: eslint@8.24.033e8dc3docs: use Node.js name style644f646build: supertest@6.2.4ecd7572build: Node.js@14.20Updates
xml2jsfrom 0.4.19 to 0.4.23Commits
Updates
qsfrom 6.5.2 to 6.11.0Changelog
Sourced from qs's changelog.
... (truncated)
Commits
56763c1v6.11.0ddd3e29[readme] fix version badgec313472[New] [Fix]stringify: revert 0e903c0; addcommaRoundTripoption95bc018v6.10.50e903c0[Fix]stringify: witharrayFormat: comma, properly include an explicit `[...ba9703cv6.10.44e44019[Fix]stringify: witharrayFormat: comma, include an explicit[]on a s...113b990[Dev Deps] updateobject-inspectc77f38f[Dev Deps] updateeslint,@ljharb/eslint-config,aud,has-symbol,tape2cf45b2[meta] usenpmignoreto autogenerate an npmignore fileUpdates
body-parserfrom 1.9.0 to 1.20.2Release notes
Sourced from body-parser's releases.
... (truncated)
Changelog
Sourced from body-parser's changelog.
... (truncated)
Commits
ee913741.20.2368a93aFix strict json error message on Node.js 19+0385872deps: raw-body@2.5.22c35b41build: eslint@8.34.0f0646c2build: Node.js@18.14f345fb1build: Node.js@14.216842efcdeps: content-type@~1.0.55af7315build: eslint-plugin-promise@6.1.18e605b3build: supertest@6.3.3cba6e77build: mocha@10.2.0Updates
handlebarsfrom 4.0.11 to 4.7.7Changelog
Sourced from handlebars's changelog.