wycats/handlebars.js
### [`v4.7.4`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v474---April-1st-2020)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.7.3...v4.7.4)
Chore/Housekeeping:
- [#1666](https://togithub.com/handlebars-lang/handlebars.js/issues/1666) - Replaced minimist with yargs for handlebars CLI ([@aorinevo](https://api.github.com/users/aorinevo), [@AviVahl](https://api.github.com/users/AviVahl) & [@fabb](https://api.github.com/users/fabb))
Compatibility notes:
- No incompatibilities are to be expected
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.7.3...v4.7.4)
### [`v4.7.3`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v473---February-5th-2020)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.7.2...v4.7.3)
Chore/Housekeeping:
- [#1644](https://togithub.com/handlebars-lang/handlebars.js/issues/1644) - Download links to aws broken on handlebarsjs.com - access denied ([@Tea56](https://api.github.com/users/Tea56))
- Fix spelling and punctuation in changelog - [`d78cc73`](https://togithub.com/wycats/handlebars.js/commit/d78cc73)
Bugfixes:
- Add Type Definition for Handlebars.VERSION, Fixes [#1647](https://togithub.com/wycats/handlebars.js/issues/1647) - [`4de51fe`](https://togithub.com/wycats/handlebars.js/commit/4de51fe)
- Include Type Definition for runtime.js in Package - [`a32d05f`](https://togithub.com/wycats/handlebars.js/commit/a32d05f)
Compatibility notes:
- No incompatibilities are to be expected
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.7.2...v4.7.3)
### [`v4.7.2`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v472---January-13th-2020)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.7.1...v4.7.2)
Bugfixes:
- fix: don't wrap helpers that are not functions - [`9d5aa36`](https://togithub.com/wycats/handlebars.js/commit/9d5aa36), [#1639](https://togithub.com/wycats/handlebars.js/issues/1639)
Chore/Build:
- chore: execute saucelabs-task only if access-key exists - [`a4fd391`](https://togithub.com/wycats/handlebars.js/commit/a4fd391)
Compatibility notes:
- No breaking changes are to be expected
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.7.1...v4.7.2)
### [`v4.7.1`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v471---January-12th-2020)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.7.0...v4.7.1)
Bugfixes:
- fix: fix log output in case of illegal property access - [`f152dfc`](https://togithub.com/wycats/handlebars.js/commit/f152dfc)
- fix: log error for illegal property access only once per property - [`3c1e252`](https://togithub.com/wycats/handlebars.js/commit/3c1e252)
Compatibility notes:
- no incompatibilities are to be expected.
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.7.0...v4.7.1)
### [`v4.7.0`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v470---January-10th-2020)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.6.0...v4.7.0)
Features:
- feat: default options for controlling proto access - [`7af1c12`](https://togithub.com/wycats/handlebars.js/commit/7af1c12), [#1635](https://togithub.com/wycats/handlebars.js/issues/1635)
- This makes it possible to disable the prototype access restrictions added in 4.6.0
- an error is logged in the console, if access to prototype properties is attempted and denied
and no explicit configuration has taken place.
Compatibility notes:
- no compatibilities are expected
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.6.0...v4.7.0)
### [`v4.6.0`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v460---January-8th-2020)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.5.3...v4.6.0)
Features:
- feat: access control to prototype properties via whitelist ([#1633](https://togithub.com/wycats/handlebars.js/issues/1633))- [`d03b6ec`](https://togithub.com/wycats/handlebars.js/commit/d03b6ec)
Bugfixes:
- fix(runtime.js): partials compile not caching ([#1600](https://togithub.com/wycats/handlebars.js/issues/1600)) - [`23d58e7`](https://togithub.com/wycats/handlebars.js/commit/23d58e7)
Chores, docs:
- various refactorings and improvements to tests - [`d7f0dcf`](https://togithub.com/wycats/handlebars.js/commit/d7f0dcf), [`187d611`](https://togithub.com/wycats/handlebars.js/commit/187d611), [`d337f40`](https://togithub.com/wycats/handlebars.js/commit/d337f40)
- modernize the build-setup
- use prettier to format and eslint to verify - [`c40d9f3`](https://togithub.com/wycats/handlebars.js/commit/c40d9f3), [`8901c28`](https://togithub.com/wycats/handlebars.js/commit/8901c28), [`e97685e`](https://togithub.com/wycats/handlebars.js/commit/e97685e), [`1f61f21`](https://togithub.com/wycats/handlebars.js/commit/1f61f21)
- use nyc instead of istanbul to collect coverage - [`164b7ff`](https://togithub.com/wycats/handlebars.js/commit/164b7ff), [`1ebce2b`](https://togithub.com/wycats/handlebars.js/commit/1ebce2b)
- update build code to use modern javascript and make it cleaner - [`14b621c`](https://togithub.com/wycats/handlebars.js/commit/14b621c), [`1ec1737`](https://togithub.com/wycats/handlebars.js/commit/1ec1737), [`3a5b65e`](https://togithub.com/wycats/handlebars.js/commit/3a5b65e), [`dde108e`](https://togithub.com/wycats/handlebars.js/commit/dde108e), [`04b1984`](https://togithub.com/wycats/handlebars.js/commit/04b1984), [`587e7a3`](https://togithub.com/wycats/handlebars.js/commit/587e7a3)
- restructur build commands - [`e913dc5`](https://togithub.com/wycats/handlebars.js/commit/e913dc5),
- eslint rule changes - [`ac4655e`](https://togithub.com/wycats/handlebars.js/commit/ac4655e), [`dc54952`](https://togithub.com/wycats/handlebars.js/commit/dc54952)
- Update (C) year in the LICENSE file - [`d1fb07b`](https://togithub.com/wycats/handlebars.js/commit/d1fb07b)
- chore: try to fix saucelabs credentials ([#1627](https://togithub.com/wycats/handlebars.js/issues/1627)) -
- Update readme.md with updated links ([#1620](https://togithub.com/wycats/handlebars.js/issues/1620)) - [`edcc84f`](https://togithub.com/wycats/handlebars.js/commit/edcc84f)
BREAKING CHANGES:
- access to prototype properties is forbidden completely by default,
specific properties or methods can be allowed via runtime-options.
See [#1633](https://togithub.com/wycats/handlebars.js/issues/1633) for details.
If you are using Handlebars as documented, you should not be accessing prototype
properties from your template anyway, so the changes should not be a problem
for you. Only the use of undocumented features can break your build.
That is why we only bump the minor version despite mentioning breaking changes.
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.5.3...v4.6.0)
### [`v4.5.3`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v453---November-18th-2019)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.5.2...v4.5.3)
Bugfixes:
- fix: add "no-prototype-builtins" eslint-rule and fix all occurences - [`f7f05d7`](https://togithub.com/wycats/handlebars.js/commit/f7f05d7)
- fix: add more properties required to be enumerable - [`1988878`](https://togithub.com/wycats/handlebars.js/commit/1988878)
Chores / Build:
- fix: use !== 0 instead of != 0 - [`c02b05f`](https://togithub.com/wycats/handlebars.js/commit/c02b05f)
- add chai and dirty-chai and sinon, for cleaner test-assertions and spies,
deprecate old assertion-methods - [`93e284e`](https://togithub.com/wycats/handlebars.js/commit/93e284e), [`886ba86`](https://togithub.com/wycats/handlebars.js/commit/886ba86), [`0817dad`](https://togithub.com/wycats/handlebars.js/commit/0817dad), [`93516a0`](https://togithub.com/wycats/handlebars.js/commit/93516a0)
Security:
- The properties `__proto__`, `__defineGetter__`, `__defineSetter__` and `__lookupGetter__`
have been added to the list of "properties that must be enumerable".
If a property by that name is found and not enumerable on its parent,
it will silently evaluate to `undefined`. This is done in both the compiled template and the "lookup"-helper.
This will prevent new Remote-Code-Execution exploits that have been
published recently.
Compatibility notes:
- Due to the security-fixes. The semantics of the templates using
`__proto__`, `__defineGetter__`, `__defineSetter__` and `__lookupGetter__` in the respect that those expression now return
`undefined` rather than their actual value from the proto.
- The semantics have not changed in cases where the properties are enumerable, as in:
```js
{
__proto__: 'some string';
}
```
- The change may be breaking in that respect, but we still only
increase the patch-version, because the incompatible use-cases
are not intended, undocumented and far less important than fixing
Remote-Code-Execution exploits on existing systems.
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.5.2...v4.5.3)
### [`v4.5.2`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v452---November-13th-2019)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.5.1...v4.5.2)
### [`v4.5.1`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v451---October-29th-2019)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.5.0...v4.5.1)
Bugfixs
- fix: move "eslint-plugin-compat" to devDependencies - [`5e9d17f`](https://togithub.com/wycats/handlebars.js/commit/5e9d17f) ([#1589](https://togithub.com/wycats/handlebars.js/issues/1589))
Compatibility notes:
- No compatibility issues are to be expected
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.5.0...v4.5.1)
### [`v4.5.0`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v450---October-28th-2019)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.4.5...v4.5.0)
Features / Improvements
- Add method Handlebars.parseWithoutProcessing ([#1584](https://togithub.com/wycats/handlebars.js/issues/1584)) - [`62ed3c2`](https://togithub.com/wycats/handlebars.js/commit/62ed3c2)
- add guard to if & unless helpers ([#1549](https://togithub.com/wycats/handlebars.js/issues/1549))
- show source location for the strict lookup exceptions - [`feb60f8`](https://togithub.com/wycats/handlebars.js/commit/feb60f8)
Bugfixes:
- Use objects for hash value tracking - [`7fcf9d2`](https://togithub.com/wycats/handlebars.js/commit/7fcf9d2)
Chore:
- Resolve deprecation warning message from eslint while running eslint ([#1586](https://togithub.com/wycats/handlebars.js/issues/1586)) - [`7052e88`](https://togithub.com/wycats/handlebars.js/commit/7052e88)
- chore: add eslint-plugin-compat and eslint-plugin-es5 - [`088e618`](https://togithub.com/wycats/handlebars.js/commit/088e618)
Compatibility notes:
- No compatibility issues are to be expected
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.4.5...v4.5.0)
### [`v4.4.5`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v445---October-20th-2019)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.4.4...v4.4.5)
Bugfixes:
- Contents of raw-blocks must be matched with non-eager regex-matching - [`8d5530e`](https://togithub.com/wycats/handlebars.js/commit/8d5530e), [#1579](https://togithub.com/wycats/handlebars.js/issues/1579)
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.4.4...v4.4.5)
### [`v4.4.4`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v444---October-20th-2019)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.4.3...v4.4.4)
Bugfixes:
- fix: prevent zero length tokens in raw-blocks ([#1577](https://togithub.com/wycats/handlebars.js/issues/1577), [#1578](https://togithub.com/wycats/handlebars.js/issues/1578)) - [`f1752fe`](https://togithub.com/wycats/handlebars.js/commit/f1752fe)
Chore:
- chore: link to s3 bucket with https, add "npm ci" to build instructions - [`0b593bf`](https://togithub.com/wycats/handlebars.js/commit/0b593bf)
Compatibility notes:
- no compatibility issues are expected
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.4.3...v4.4.4)
### [`v4.4.3`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v443---October-8th-2019)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.4.2...v4.4.3)
Bugfixes
Typings:
- add missing type fields to AST typings and add tests for them - [`0440af2`](https://togithub.com/wycats/handlebars.js/commit/0440af2)
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.4.2...v4.4.3)
### [`v4.4.2`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v442---October-2nd-2019)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.4.1...v4.4.2)
- chore: fix grunt-saucelabs dependency - [`b7eada0`](https://togithub.com/wycats/handlebars.js/commit/b7eada0)
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.4.1...v4.4.2)
### [`v4.4.1`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v441---October-2nd-2019)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.4.0...v4.4.1)
- [#1562](https://togithub.com/handlebars-lang/handlebars.js/issues/1562) - Error message for syntax error missing location in 4.2.1+
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.4.0...v4.4.1)
### [`v4.4.0`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v440---September-29th-2019)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.3.5...v4.4.0)
- Added support for iterable objects in {{#each}} helper ([#1557](https://togithub.com/wycats/handlebars.js/issues/1557)) - [`cf7545e`](https://togithub.com/wycats/handlebars.js/commit/cf7545e)
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.3.5...v4.4.0)
### [`v4.3.5`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v435---October-2nd-2019)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.3.4...v4.3.5)
- Error message for syntax error missing location in 4.2.1+ ([#1562](https://togithub.com/wycats/handlebars.js/issues/1562))
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.3.4...v4.3.5)
### [`v4.3.4`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v434---September-28th-2019)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.3.3...v4.3.4)
- fix: harden "propertyIsEnumerable"-check - [`ff4d827`](https://togithub.com/wycats/handlebars.js/commit/ff4d827)
Compatibility notes:
- No incompatibilities are known.
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.3.3...v4.3.4)
### [`v4.3.3`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v433---September-27th-2019)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.3.2...v4.3.3)
- fix test case for browsers that do not support **defineGetter** - [`8742bde`](https://togithub.com/wycats/handlebars.js/commit/8742bde)
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.3.2...v4.3.3)
### [`v4.3.2`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v432---September-26th-2019)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.3.1...v4.3.2)
- Use Object.prototype.propertyIsEnumerable to check for constructors - [`213c0bb`](https://togithub.com/wycats/handlebars.js/commit/213c0bb), [#1563](https://togithub.com/wycats/handlebars.js/issues/1563)
Compatibility notes:
- There are no breaking changes
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.3.1...v4.3.2)
### [`v4.3.1`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v431---September-25th-2019)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.3.0...v4.3.1)
Fixes:
- do not break on precompiled templates from Handlebars >=4.0.0 <4.3.0 - [`1266838`](https://togithub.com/wycats/handlebars.js/commit/1266838), [#1561](https://togithub.com/wycats/handlebars.js/issues/1561)
- Ensure allowCallsToHelperMissing runtime option is optional in typings - [`93444c5`](https://togithub.com/wycats/handlebars.js/commit/93444c5), [`64ecb9e`](https://togithub.com/wycats/handlebars.js/commit/64ecb9e), [#1560](https://togithub.com/wycats/handlebars.js/issues/1560)
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.3.0...v4.3.1)
### [`v4.3.0`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v430---September-24th-2019)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.2.2...v4.3.0)
Fixes:
- Security: Disallow calling "helperMissing" and "blockHelperMissing" directly - [`2078c72`](https://togithub.com/wycats/handlebars.js/commit/2078c72)
- Disallow calling "helperMissing" and "blockHelperMissing" directly - [`2078c72`](https://togithub.com/wycats/handlebars.js/commit/2078c72)
Features:
- Add new runtime option `allowCallsToHelperMissing` to allow calling `blockHelperMissing` and `helperMissing`.
Breaking changes:
Compatibility notes:
- Compiler revision increased - [`06b7224`](https://togithub.com/wycats/handlebars.js/commit/06b7224)
- This means that template compiled with versions prior to 4.3.0 will not work with runtimes >= 4.3.0
The increase was done because the "helperMissing" and "blockHelperMissing" are now moved from the helpers
to the internal "container.hooks" object, so old templates will not be able to call them anymore. We suggest
that you always recompile your templates with the latest compiler in your build pipelines.
- Disallow calling "helperMissing" and "blockHelperMissing" directly - [`2078c72`](https://togithub.com/wycats/handlebars.js/commit/2078c72)
- Calling "helperMissing" and "blockHelperMissing" directly from a template (like in `{{blockHelperMissing}}` was
never intended and was part of the exploits that have been revealed early in 2019
(see https://github.com/handlebars-lang/handlebars.js/issues/1495). *It is also part of a new exploit that
is not captured by the earlier fix.* In order to harden Handlebars against such exploits, calling thos helpers
is now not possible anymore. *Overriding* those helpers is still possible.
- If you really need this behavior, you can set the runtime option `allowCallsToHelperMissing` to `true` and the
calls will again be possible
Both bullet points imly that Handlebars is not 100% percent compatible to 4.2.0, despite the minor version bump.
We consider it more important to resolve a major security issue than to maintain 100% compatibility.
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.2.2...v4.3.0)
### [`v4.2.2`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v422---October-2nd-2019)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.2.1...v4.2.2)
- Error message for syntax error missing location in 4.2.1+ ([#1562](https://togithub.com/wycats/handlebars.js/issues/1562))
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.2.1...v4.2.2)
### [`v4.2.1`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v421---September-20th-2019)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.2.0...v4.2.1)
Bugfixes:
- The "browser" property in the package.json has been updated to use the common-js builds instead of the minified UMD - [`c55a7be`](https://togithub.com/wycats/handlebars.js/commit/c55a7be), [#1553](https://togithub.com/wycats/handlebars.js/issues/1553)
Compatibility notes:
- No compatibility issues should arise
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.2.0...v4.2.1)
### [`v4.2.0`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v420---September-3rd-2019)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.1.2...v4.2.0)
Chore/Test:
- Use custom `grunt-saucelab` with current sauce-connect proxy - [`f119497`](https://togithub.com/wycats/handlebars.js/commit/f119497)
- Add framework for various integration tests - [`f9cce4d`](https://togithub.com/wycats/handlebars.js/commit/f9cce4d)
- Add integration test for webpack - [`a57b682`](https://togithub.com/wycats/handlebars.js/commit/a57b682)
Bugfixes:
- [#1544](https://togithub.com/handlebars-lang/handlebars.js/issues/1544) - Typescript types: `knownHelpers` doesnt allow for custom helpers ([@NickCis](https://api.github.com/users/NickCis))
- [#1534](https://togithub.com/handlebars-lang/handlebars.js/pull/1534) - Add typings for "Handlebars.VM.resolvePartial ([@AndrewLeedham](https://api.github.com/users/AndrewLeedham))
Features:
- [#1540](https://togithub.com/handlebars-lang/handlebars.js/pull/1540) - added "browser"-property to package.json, resolves [#1102](https://togithub.com/wycats/handlebars.js/issues/1102) ([@ouijan](https://api.github.com/users/ouijan))
Compatibility notes:
- The new "browser"-property should not break anything, but you can never be sure. The integration test for webpack
shows that it works, but if it doesn't please open an issue.
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.1.2-0...v4.2.0)
### [`v4.1.2`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v412-0---August-25th-2019)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.1.1...v4.1.2)
[#1540](https://togithub.com/handlebars-lang/handlebars.js/pull/1540) - added browser to package.json, resolves [#1102](https://togithub.com/wycats/handlebars.js/issues/1102) ([@ouijan](https://api.github.com/users/ouijan))
Compatibility notes:
- We are not sure if imports via webpack are still working, which is why this release is a pre-release
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.1.2...v4.1.2-0)
### [`v4.1.1`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v411---March-16th-2019)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.1.0...v4.1.1)
Bugfixes:
- fix: add "runtime.d.ts" to allow "require('handlebars/runtime')" in TypeScript - [`5cedd62`](https://togithub.com/wycats/handlebars.js/commit/5cedd62)
Refactorings:
- replace "async" with "neo-async" - [`048f2ce`](https://togithub.com/wycats/handlebars.js/commit/048f2ce)
- use "substring"-function instead of "substr" - [`445ae12`](https://togithub.com/wycats/handlebars.js/commit/445ae12)
Compatibility notes:
- This is a bugfix release. There are no breaking change and no new features.
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.1.0...v4.1.1)
### [`v4.1.0`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v410---February-7th-2019)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.0.14...v4.1.0)
New Features
- import TypeScript typings - [`27ac1ee`](https://togithub.com/wycats/handlebars.js/commit/27ac1ee)
Security fixes:
- disallow access to the constructor in templates to prevent RCE - [`42841c4`](https://togithub.com/wycats/handlebars.js/commit/42841c4), [#1495](https://togithub.com/wycats/handlebars.js/issues/1495)
Housekeeping
- chore: fix components/handlebars package.json and auto-update on release - [`bacd473`](https://togithub.com/wycats/handlebars.js/commit/bacd473)
- chore: Use node 10 to build handlebars - [`78dd89c`](https://togithub.com/wycats/handlebars.js/commit/78dd89c)
- chore/doc: Add more release docs - [`6b87c21`](https://togithub.com/wycats/handlebars.js/commit/6b87c21)
Compatibility notes:
Access to class constructors (i.e. `({}).constructor`) is now prohibited to prevent
Remote Code Execution. This means that following construct will no work anymore:
class SomeClass {
}
SomeClass.staticProperty = 'static'
var template = Handlebars.compile('{{constructor.staticProperty}}');
document.getElementById('output').innerHTML = template(new SomeClass());
// expected: 'static', but now this is empty.
This kind of access is not the intended use of Handlebars and leads to the vulnerability described in [#1495](https://togithub.com/wycats/handlebars.js/issues/1495). We will **not** increase the major version, because such use is not intended or documented, and because of the potential impact of the issue (we fear that most people won't use a new major version and the issue may not be resolved on many systems).
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.0.12...v4.1.0)
### [`v4.0.14`](https://togithub.com/wycats/handlebars.js/compare/v4.0.13...v4.0.14)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.0.13...v4.0.14)
### [`v4.0.13`](https://togithub.com/wycats/handlebars.js/compare/v4.0.12...v4.0.13)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.0.12...v4.0.13)
### [`v4.0.12`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v4012---September-4th-2018)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.0.11...v4.0.12)
New features:
- none
Various dependency updates
- [#1464](https://togithub.com/handlebars-lang/handlebars.js/pull/1464) - Bump versions of grunt-plugins to 1.x
- [#1398](https://togithub.com/handlebars-lang/handlebars.js/pull/1398) - Chore: updated various dev dependencies
- upgrade uglify-js - [`d3d3942`](https://togithub.com/wycats/handlebars.js/commit/d3d3942)
- Update grunt-eslint to 20.1.0 - [`7729aa9`](https://togithub.com/wycats/handlebars.js/commit/7729aa9)
- Update dependencies "async" to 2.5.0 and "source-map" to 0.6.1 ([`73d5637`](https://togithub.com/wycats/handlebars.js/commit/73d5637))
Bugfixes:
- [components/handlebars.js#24](https://togithub.com/components/handlebars.js#24) Add package.json to components shim
- Updated `source-map`-package should work better with `rollup`[#1463](https://togithub.com/handlebars-lang/handlebars.js/issues/1463)
Removed obsolete code:
- unnecessary check - [`0ddff8b`](https://togithub.com/wycats/handlebars.js/commit/0ddff8b)
- Use `files` field - [`69c6ca5`](https://togithub.com/wycats/handlebars.js/commit/69c6ca5)
- Update jsfiddle to 4.0.11 - [`8947dd0`](https://togithub.com/wycats/handlebars.js/commit/8947dd0)
Compatibility notes:
- No compatibility issues are to be expected
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.0.11...v4.0.12)
### [`v4.0.11`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v4011---October-17th-2017)
[Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.0.10...v4.0.11)
- [#1391](https://togithub.com/handlebars-lang/handlebars.js/issues/1391) - `uglify-js` is unconditionally imported, but only listed as optional dependency ([@Turbo87](https://togithub.com/Turbo87))
- [#1233](https://togithub.com/handlebars-lang/handlebars.js/issues/1233) - Unable to build under windows - error at test:bin task ([@blikblum](https://togithub.com/blikblum))
- Update (C) year in the LICENSE file - [`21386b6`](https://togithub.com/wycats/handlebars.js/commit/21386b6)
Compatibility notes:
- This is a bugfix release. There are no breaking change and no new features.
[Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.0.10...v4.0.11)
[ ] If you want to rebase/retry this PR, click this checkbox.
This PR contains the following updates:
4.0.10->4.7.4By merging this PR, the issue #2 will be automatically resolved and closed:
Release Notes
wycats/handlebars.js
### [`v4.7.4`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v474---April-1st-2020) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.7.3...v4.7.4) Chore/Housekeeping: - [#1666](https://togithub.com/handlebars-lang/handlebars.js/issues/1666) - Replaced minimist with yargs for handlebars CLI ([@aorinevo](https://api.github.com/users/aorinevo), [@AviVahl](https://api.github.com/users/AviVahl) & [@fabb](https://api.github.com/users/fabb)) Compatibility notes: - No incompatibilities are to be expected [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.7.3...v4.7.4) ### [`v4.7.3`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v473---February-5th-2020) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.7.2...v4.7.3) Chore/Housekeeping: - [#1644](https://togithub.com/handlebars-lang/handlebars.js/issues/1644) - Download links to aws broken on handlebarsjs.com - access denied ([@Tea56](https://api.github.com/users/Tea56)) - Fix spelling and punctuation in changelog - [`d78cc73`](https://togithub.com/wycats/handlebars.js/commit/d78cc73) Bugfixes: - Add Type Definition for Handlebars.VERSION, Fixes [#1647](https://togithub.com/wycats/handlebars.js/issues/1647) - [`4de51fe`](https://togithub.com/wycats/handlebars.js/commit/4de51fe) - Include Type Definition for runtime.js in Package - [`a32d05f`](https://togithub.com/wycats/handlebars.js/commit/a32d05f) Compatibility notes: - No incompatibilities are to be expected [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.7.2...v4.7.3) ### [`v4.7.2`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v472---January-13th-2020) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.7.1...v4.7.2) Bugfixes: - fix: don't wrap helpers that are not functions - [`9d5aa36`](https://togithub.com/wycats/handlebars.js/commit/9d5aa36), [#1639](https://togithub.com/wycats/handlebars.js/issues/1639) Chore/Build: - chore: execute saucelabs-task only if access-key exists - [`a4fd391`](https://togithub.com/wycats/handlebars.js/commit/a4fd391) Compatibility notes: - No breaking changes are to be expected [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.7.1...v4.7.2) ### [`v4.7.1`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v471---January-12th-2020) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.7.0...v4.7.1) Bugfixes: - fix: fix log output in case of illegal property access - [`f152dfc`](https://togithub.com/wycats/handlebars.js/commit/f152dfc) - fix: log error for illegal property access only once per property - [`3c1e252`](https://togithub.com/wycats/handlebars.js/commit/3c1e252) Compatibility notes: - no incompatibilities are to be expected. [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.7.0...v4.7.1) ### [`v4.7.0`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v470---January-10th-2020) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.6.0...v4.7.0) Features: - feat: default options for controlling proto access - [`7af1c12`](https://togithub.com/wycats/handlebars.js/commit/7af1c12), [#1635](https://togithub.com/wycats/handlebars.js/issues/1635) - This makes it possible to disable the prototype access restrictions added in 4.6.0 - an error is logged in the console, if access to prototype properties is attempted and denied and no explicit configuration has taken place. Compatibility notes: - no compatibilities are expected [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.6.0...v4.7.0) ### [`v4.6.0`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v460---January-8th-2020) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.5.3...v4.6.0) Features: - feat: access control to prototype properties via whitelist ([#1633](https://togithub.com/wycats/handlebars.js/issues/1633))- [`d03b6ec`](https://togithub.com/wycats/handlebars.js/commit/d03b6ec) Bugfixes: - fix(runtime.js): partials compile not caching ([#1600](https://togithub.com/wycats/handlebars.js/issues/1600)) - [`23d58e7`](https://togithub.com/wycats/handlebars.js/commit/23d58e7) Chores, docs: - various refactorings and improvements to tests - [`d7f0dcf`](https://togithub.com/wycats/handlebars.js/commit/d7f0dcf), [`187d611`](https://togithub.com/wycats/handlebars.js/commit/187d611), [`d337f40`](https://togithub.com/wycats/handlebars.js/commit/d337f40) - modernize the build-setup - use prettier to format and eslint to verify - [`c40d9f3`](https://togithub.com/wycats/handlebars.js/commit/c40d9f3), [`8901c28`](https://togithub.com/wycats/handlebars.js/commit/8901c28), [`e97685e`](https://togithub.com/wycats/handlebars.js/commit/e97685e), [`1f61f21`](https://togithub.com/wycats/handlebars.js/commit/1f61f21) - use nyc instead of istanbul to collect coverage - [`164b7ff`](https://togithub.com/wycats/handlebars.js/commit/164b7ff), [`1ebce2b`](https://togithub.com/wycats/handlebars.js/commit/1ebce2b) - update build code to use modern javascript and make it cleaner - [`14b621c`](https://togithub.com/wycats/handlebars.js/commit/14b621c), [`1ec1737`](https://togithub.com/wycats/handlebars.js/commit/1ec1737), [`3a5b65e`](https://togithub.com/wycats/handlebars.js/commit/3a5b65e), [`dde108e`](https://togithub.com/wycats/handlebars.js/commit/dde108e), [`04b1984`](https://togithub.com/wycats/handlebars.js/commit/04b1984), [`587e7a3`](https://togithub.com/wycats/handlebars.js/commit/587e7a3) - restructur build commands - [`e913dc5`](https://togithub.com/wycats/handlebars.js/commit/e913dc5), - eslint rule changes - [`ac4655e`](https://togithub.com/wycats/handlebars.js/commit/ac4655e), [`dc54952`](https://togithub.com/wycats/handlebars.js/commit/dc54952) - Update (C) year in the LICENSE file - [`d1fb07b`](https://togithub.com/wycats/handlebars.js/commit/d1fb07b) - chore: try to fix saucelabs credentials ([#1627](https://togithub.com/wycats/handlebars.js/issues/1627)) - - Update readme.md with updated links ([#1620](https://togithub.com/wycats/handlebars.js/issues/1620)) - [`edcc84f`](https://togithub.com/wycats/handlebars.js/commit/edcc84f) BREAKING CHANGES: - access to prototype properties is forbidden completely by default, specific properties or methods can be allowed via runtime-options. See [#1633](https://togithub.com/wycats/handlebars.js/issues/1633) for details. If you are using Handlebars as documented, you should not be accessing prototype properties from your template anyway, so the changes should not be a problem for you. Only the use of undocumented features can break your build. That is why we only bump the minor version despite mentioning breaking changes. [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.5.3...v4.6.0) ### [`v4.5.3`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v453---November-18th-2019) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.5.2...v4.5.3) Bugfixes: - fix: add "no-prototype-builtins" eslint-rule and fix all occurences - [`f7f05d7`](https://togithub.com/wycats/handlebars.js/commit/f7f05d7) - fix: add more properties required to be enumerable - [`1988878`](https://togithub.com/wycats/handlebars.js/commit/1988878) Chores / Build: - fix: use !== 0 instead of != 0 - [`c02b05f`](https://togithub.com/wycats/handlebars.js/commit/c02b05f) - add chai and dirty-chai and sinon, for cleaner test-assertions and spies, deprecate old assertion-methods - [`93e284e`](https://togithub.com/wycats/handlebars.js/commit/93e284e), [`886ba86`](https://togithub.com/wycats/handlebars.js/commit/886ba86), [`0817dad`](https://togithub.com/wycats/handlebars.js/commit/0817dad), [`93516a0`](https://togithub.com/wycats/handlebars.js/commit/93516a0) Security: - The properties `__proto__`, `__defineGetter__`, `__defineSetter__` and `__lookupGetter__` have been added to the list of "properties that must be enumerable". If a property by that name is found and not enumerable on its parent, it will silently evaluate to `undefined`. This is done in both the compiled template and the "lookup"-helper. This will prevent new Remote-Code-Execution exploits that have been published recently. Compatibility notes: - Due to the security-fixes. The semantics of the templates using `__proto__`, `__defineGetter__`, `__defineSetter__` and `__lookupGetter__` in the respect that those expression now return `undefined` rather than their actual value from the proto. - The semantics have not changed in cases where the properties are enumerable, as in: ```js { __proto__: 'some string'; } ``` - The change may be breaking in that respect, but we still only increase the patch-version, because the incompatible use-cases are not intended, undocumented and far less important than fixing Remote-Code-Execution exploits on existing systems. [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.5.2...v4.5.3) ### [`v4.5.2`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v452---November-13th-2019) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.5.1...v4.5.2) ### [`v4.5.1`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v451---October-29th-2019) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.5.0...v4.5.1) Bugfixs - fix: move "eslint-plugin-compat" to devDependencies - [`5e9d17f`](https://togithub.com/wycats/handlebars.js/commit/5e9d17f) ([#1589](https://togithub.com/wycats/handlebars.js/issues/1589)) Compatibility notes: - No compatibility issues are to be expected [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.5.0...v4.5.1) ### [`v4.5.0`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v450---October-28th-2019) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.4.5...v4.5.0) Features / Improvements - Add method Handlebars.parseWithoutProcessing ([#1584](https://togithub.com/wycats/handlebars.js/issues/1584)) - [`62ed3c2`](https://togithub.com/wycats/handlebars.js/commit/62ed3c2) - add guard to if & unless helpers ([#1549](https://togithub.com/wycats/handlebars.js/issues/1549)) - show source location for the strict lookup exceptions - [`feb60f8`](https://togithub.com/wycats/handlebars.js/commit/feb60f8) Bugfixes: - Use objects for hash value tracking - [`7fcf9d2`](https://togithub.com/wycats/handlebars.js/commit/7fcf9d2) Chore: - Resolve deprecation warning message from eslint while running eslint ([#1586](https://togithub.com/wycats/handlebars.js/issues/1586)) - [`7052e88`](https://togithub.com/wycats/handlebars.js/commit/7052e88) - chore: add eslint-plugin-compat and eslint-plugin-es5 - [`088e618`](https://togithub.com/wycats/handlebars.js/commit/088e618) Compatibility notes: - No compatibility issues are to be expected [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.4.5...v4.5.0) ### [`v4.4.5`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v445---October-20th-2019) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.4.4...v4.4.5) Bugfixes: - Contents of raw-blocks must be matched with non-eager regex-matching - [`8d5530e`](https://togithub.com/wycats/handlebars.js/commit/8d5530e), [#1579](https://togithub.com/wycats/handlebars.js/issues/1579) [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.4.4...v4.4.5) ### [`v4.4.4`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v444---October-20th-2019) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.4.3...v4.4.4) Bugfixes: - fix: prevent zero length tokens in raw-blocks ([#1577](https://togithub.com/wycats/handlebars.js/issues/1577), [#1578](https://togithub.com/wycats/handlebars.js/issues/1578)) - [`f1752fe`](https://togithub.com/wycats/handlebars.js/commit/f1752fe) Chore: - chore: link to s3 bucket with https, add "npm ci" to build instructions - [`0b593bf`](https://togithub.com/wycats/handlebars.js/commit/0b593bf) Compatibility notes: - no compatibility issues are expected [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.4.3...v4.4.4) ### [`v4.4.3`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v443---October-8th-2019) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.4.2...v4.4.3) Bugfixes Typings: - add missing type fields to AST typings and add tests for them - [`0440af2`](https://togithub.com/wycats/handlebars.js/commit/0440af2) [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.4.2...v4.4.3) ### [`v4.4.2`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v442---October-2nd-2019) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.4.1...v4.4.2) - chore: fix grunt-saucelabs dependency - [`b7eada0`](https://togithub.com/wycats/handlebars.js/commit/b7eada0) [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.4.1...v4.4.2) ### [`v4.4.1`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v441---October-2nd-2019) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.4.0...v4.4.1) - [#1562](https://togithub.com/handlebars-lang/handlebars.js/issues/1562) - Error message for syntax error missing location in 4.2.1+ [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.4.0...v4.4.1) ### [`v4.4.0`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v440---September-29th-2019) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.3.5...v4.4.0) - Added support for iterable objects in {{#each}} helper ([#1557](https://togithub.com/wycats/handlebars.js/issues/1557)) - [`cf7545e`](https://togithub.com/wycats/handlebars.js/commit/cf7545e) [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.3.5...v4.4.0) ### [`v4.3.5`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v435---October-2nd-2019) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.3.4...v4.3.5) - Error message for syntax error missing location in 4.2.1+ ([#1562](https://togithub.com/wycats/handlebars.js/issues/1562)) [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.3.4...v4.3.5) ### [`v4.3.4`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v434---September-28th-2019) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.3.3...v4.3.4) - fix: harden "propertyIsEnumerable"-check - [`ff4d827`](https://togithub.com/wycats/handlebars.js/commit/ff4d827) Compatibility notes: - No incompatibilities are known. [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.3.3...v4.3.4) ### [`v4.3.3`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v433---September-27th-2019) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.3.2...v4.3.3) - fix test case for browsers that do not support **defineGetter** - [`8742bde`](https://togithub.com/wycats/handlebars.js/commit/8742bde) [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.3.2...v4.3.3) ### [`v4.3.2`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v432---September-26th-2019) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.3.1...v4.3.2) - Use Object.prototype.propertyIsEnumerable to check for constructors - [`213c0bb`](https://togithub.com/wycats/handlebars.js/commit/213c0bb), [#1563](https://togithub.com/wycats/handlebars.js/issues/1563) Compatibility notes: - There are no breaking changes [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.3.1...v4.3.2) ### [`v4.3.1`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v431---September-25th-2019) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.3.0...v4.3.1) Fixes: - do not break on precompiled templates from Handlebars >=4.0.0 <4.3.0 - [`1266838`](https://togithub.com/wycats/handlebars.js/commit/1266838), [#1561](https://togithub.com/wycats/handlebars.js/issues/1561) - Ensure allowCallsToHelperMissing runtime option is optional in typings - [`93444c5`](https://togithub.com/wycats/handlebars.js/commit/93444c5), [`64ecb9e`](https://togithub.com/wycats/handlebars.js/commit/64ecb9e), [#1560](https://togithub.com/wycats/handlebars.js/issues/1560) [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.3.0...v4.3.1) ### [`v4.3.0`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v430---September-24th-2019) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.2.2...v4.3.0) Fixes: - Security: Disallow calling "helperMissing" and "blockHelperMissing" directly - [`2078c72`](https://togithub.com/wycats/handlebars.js/commit/2078c72) - Disallow calling "helperMissing" and "blockHelperMissing" directly - [`2078c72`](https://togithub.com/wycats/handlebars.js/commit/2078c72) Features: - Add new runtime option `allowCallsToHelperMissing` to allow calling `blockHelperMissing` and `helperMissing`. Breaking changes: Compatibility notes: - Compiler revision increased - [`06b7224`](https://togithub.com/wycats/handlebars.js/commit/06b7224) - This means that template compiled with versions prior to 4.3.0 will not work with runtimes >= 4.3.0 The increase was done because the "helperMissing" and "blockHelperMissing" are now moved from the helpers to the internal "container.hooks" object, so old templates will not be able to call them anymore. We suggest that you always recompile your templates with the latest compiler in your build pipelines. - Disallow calling "helperMissing" and "blockHelperMissing" directly - [`2078c72`](https://togithub.com/wycats/handlebars.js/commit/2078c72) - Calling "helperMissing" and "blockHelperMissing" directly from a template (like in `{{blockHelperMissing}}` was never intended and was part of the exploits that have been revealed early in 2019 (see https://github.com/handlebars-lang/handlebars.js/issues/1495). *It is also part of a new exploit that is not captured by the earlier fix.* In order to harden Handlebars against such exploits, calling thos helpers is now not possible anymore. *Overriding* those helpers is still possible. - If you really need this behavior, you can set the runtime option `allowCallsToHelperMissing` to `true` and the calls will again be possible Both bullet points imly that Handlebars is not 100% percent compatible to 4.2.0, despite the minor version bump. We consider it more important to resolve a major security issue than to maintain 100% compatibility. [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.2.2...v4.3.0) ### [`v4.2.2`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v422---October-2nd-2019) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.2.1...v4.2.2) - Error message for syntax error missing location in 4.2.1+ ([#1562](https://togithub.com/wycats/handlebars.js/issues/1562)) [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.2.1...v4.2.2) ### [`v4.2.1`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v421---September-20th-2019) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.2.0...v4.2.1) Bugfixes: - The "browser" property in the package.json has been updated to use the common-js builds instead of the minified UMD - [`c55a7be`](https://togithub.com/wycats/handlebars.js/commit/c55a7be), [#1553](https://togithub.com/wycats/handlebars.js/issues/1553) Compatibility notes: - No compatibility issues should arise [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.2.0...v4.2.1) ### [`v4.2.0`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v420---September-3rd-2019) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.1.2...v4.2.0) Chore/Test: - Use custom `grunt-saucelab` with current sauce-connect proxy - [`f119497`](https://togithub.com/wycats/handlebars.js/commit/f119497) - Add framework for various integration tests - [`f9cce4d`](https://togithub.com/wycats/handlebars.js/commit/f9cce4d) - Add integration test for webpack - [`a57b682`](https://togithub.com/wycats/handlebars.js/commit/a57b682) Bugfixes: - [#1544](https://togithub.com/handlebars-lang/handlebars.js/issues/1544) - Typescript types: `knownHelpers` doesnt allow for custom helpers ([@NickCis](https://api.github.com/users/NickCis)) - [#1534](https://togithub.com/handlebars-lang/handlebars.js/pull/1534) - Add typings for "Handlebars.VM.resolvePartial ([@AndrewLeedham](https://api.github.com/users/AndrewLeedham)) Features: - [#1540](https://togithub.com/handlebars-lang/handlebars.js/pull/1540) - added "browser"-property to package.json, resolves [#1102](https://togithub.com/wycats/handlebars.js/issues/1102) ([@ouijan](https://api.github.com/users/ouijan)) Compatibility notes: - The new "browser"-property should not break anything, but you can never be sure. The integration test for webpack shows that it works, but if it doesn't please open an issue. [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.1.2-0...v4.2.0) ### [`v4.1.2`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v412-0---August-25th-2019) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.1.1...v4.1.2) [#1540](https://togithub.com/handlebars-lang/handlebars.js/pull/1540) - added browser to package.json, resolves [#1102](https://togithub.com/wycats/handlebars.js/issues/1102) ([@ouijan](https://api.github.com/users/ouijan)) Compatibility notes: - We are not sure if imports via webpack are still working, which is why this release is a pre-release [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.1.2...v4.1.2-0) ### [`v4.1.1`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v411---March-16th-2019) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.1.0...v4.1.1) Bugfixes: - fix: add "runtime.d.ts" to allow "require('handlebars/runtime')" in TypeScript - [`5cedd62`](https://togithub.com/wycats/handlebars.js/commit/5cedd62) Refactorings: - replace "async" with "neo-async" - [`048f2ce`](https://togithub.com/wycats/handlebars.js/commit/048f2ce) - use "substring"-function instead of "substr" - [`445ae12`](https://togithub.com/wycats/handlebars.js/commit/445ae12) Compatibility notes: - This is a bugfix release. There are no breaking change and no new features. [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.1.0...v4.1.1) ### [`v4.1.0`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v410---February-7th-2019) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.0.14...v4.1.0) New Features - import TypeScript typings - [`27ac1ee`](https://togithub.com/wycats/handlebars.js/commit/27ac1ee) Security fixes: - disallow access to the constructor in templates to prevent RCE - [`42841c4`](https://togithub.com/wycats/handlebars.js/commit/42841c4), [#1495](https://togithub.com/wycats/handlebars.js/issues/1495) Housekeeping - chore: fix components/handlebars package.json and auto-update on release - [`bacd473`](https://togithub.com/wycats/handlebars.js/commit/bacd473) - chore: Use node 10 to build handlebars - [`78dd89c`](https://togithub.com/wycats/handlebars.js/commit/78dd89c) - chore/doc: Add more release docs - [`6b87c21`](https://togithub.com/wycats/handlebars.js/commit/6b87c21) Compatibility notes: Access to class constructors (i.e. `({}).constructor`) is now prohibited to prevent Remote Code Execution. This means that following construct will no work anymore: class SomeClass { } SomeClass.staticProperty = 'static' var template = Handlebars.compile('{{constructor.staticProperty}}'); document.getElementById('output').innerHTML = template(new SomeClass()); // expected: 'static', but now this is empty. This kind of access is not the intended use of Handlebars and leads to the vulnerability described in [#1495](https://togithub.com/wycats/handlebars.js/issues/1495). We will **not** increase the major version, because such use is not intended or documented, and because of the potential impact of the issue (we fear that most people won't use a new major version and the issue may not be resolved on many systems). [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.0.12...v4.1.0) ### [`v4.0.14`](https://togithub.com/wycats/handlebars.js/compare/v4.0.13...v4.0.14) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.0.13...v4.0.14) ### [`v4.0.13`](https://togithub.com/wycats/handlebars.js/compare/v4.0.12...v4.0.13) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.0.12...v4.0.13) ### [`v4.0.12`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v4012---September-4th-2018) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.0.11...v4.0.12) New features: - none Various dependency updates - [#1464](https://togithub.com/handlebars-lang/handlebars.js/pull/1464) - Bump versions of grunt-plugins to 1.x - [#1398](https://togithub.com/handlebars-lang/handlebars.js/pull/1398) - Chore: updated various dev dependencies - upgrade uglify-js - [`d3d3942`](https://togithub.com/wycats/handlebars.js/commit/d3d3942) - Update grunt-eslint to 20.1.0 - [`7729aa9`](https://togithub.com/wycats/handlebars.js/commit/7729aa9) - Update dependencies "async" to 2.5.0 and "source-map" to 0.6.1 ([`73d5637`](https://togithub.com/wycats/handlebars.js/commit/73d5637)) Bugfixes: - [components/handlebars.js#24](https://togithub.com/components/handlebars.js#24) Add package.json to components shim - Updated `source-map`-package should work better with `rollup`[#1463](https://togithub.com/handlebars-lang/handlebars.js/issues/1463) Removed obsolete code: - unnecessary check - [`0ddff8b`](https://togithub.com/wycats/handlebars.js/commit/0ddff8b) - Use `files` field - [`69c6ca5`](https://togithub.com/wycats/handlebars.js/commit/69c6ca5) - Update jsfiddle to 4.0.11 - [`8947dd0`](https://togithub.com/wycats/handlebars.js/commit/8947dd0) Compatibility notes: - No compatibility issues are to be expected [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.0.11...v4.0.12) ### [`v4.0.11`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v4011---October-17th-2017) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.0.10...v4.0.11) - [#1391](https://togithub.com/handlebars-lang/handlebars.js/issues/1391) - `uglify-js` is unconditionally imported, but only listed as optional dependency ([@Turbo87](https://togithub.com/Turbo87)) - [#1233](https://togithub.com/handlebars-lang/handlebars.js/issues/1233) - Unable to build under windows - error at test:bin task ([@blikblum](https://togithub.com/blikblum)) - Update (C) year in the LICENSE file - [`21386b6`](https://togithub.com/wycats/handlebars.js/commit/21386b6) Compatibility notes: - This is a bugfix release. There are no breaking change and no new features. [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.0.10...v4.0.11)