fix(deps): update dependency handlebars to v4.7.7 #61

renovate · 2020-07-27T01:23:56Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
handlebars (source)	`4.3.0` -> `4.7.7`

Release Notes

wycats/handlebars.js

`v4.7.7`

Compare Source

fix weird error in integration tests - eb860c0
fix: check prototype property access in strict-mode (#1736) - b6d3de7
fix: escape property names in compat mode (#1736) - f058970
refactor: In spec tests, use expectTemplate over equals and shouldThrow (#1683) - 77825f8
chore: start testing on Node.js 12 and 13 - 3789a30

(POSSIBLY) BREAKING CHANGES:

the changes from version 4.6.0 now also apply
in when using the compile-option "strict: true". Access to prototype properties is forbidden completely by default, specific properties or methods
can be allowed via runtime-options. See #1633 for details. If you are using Handlebars as documented, you should not be accessing prototype properties
from your template anyway, so the changes should not be a problem for you. Only the use of undocumented features can break your build.

That is why we only bump the patch version despite mentioning breaking changes.

Commits

`v4.7.6`

Compare Source

Chore/Housekeeping:

#1672 - Switch cmd parser to latest minimist (@dougwilson

Compatibility notes:

Restored Node.js compatibility

Commits

`v4.7.5`

Compare Source

Chore/Housekeeping:

~~Node.js version support has been changed to v6+~~ Reverted in 4.7.6

Compatibility notes:

~~Node.js < v6 is no longer supported~~ Reverted in 4.7.6

Commits

`v4.7.4`

Compare Source

Chore/Housekeeping:

#1666 - Replaced minimist with yargs for handlebars CLI (@aorinevo, @AviVahl & @fabb)

Compatibility notes:

No incompatibilities are to be expected

Commits

`v4.7.3`

Compare Source

Chore/Housekeeping:

#1644 - Download links to aws broken on handlebarsjs.com - access denied (@Tea56)
Fix spelling and punctuation in changelog - d78cc73

Bugfixes:

Add Type Definition for Handlebars.VERSION, Fixes #1647 - 4de51fe
Include Type Definition for runtime.js in Package - a32d05f

Compatibility notes:

No incompatibilities are to be expected

Commits

`v4.7.2`

Compare Source

Bugfixes:

fix: don't wrap helpers that are not functions - 9d5aa36, #1639

Chore/Build:

chore: execute saucelabs-task only if access-key exists - a4fd391

Compatibility notes:

No breaking changes are to be expected

Commits

`v4.7.1`

Compare Source

Bugfixes:

fix: fix log output in case of illegal property access - f152dfc
fix: log error for illegal property access only once per property - 3c1e252

Compatibility notes:

no incompatibilities are to be expected.

Commits

`v4.7.0`

Compare Source

Features:

feat: default options for controlling proto access - 7af1c12, #1635
- This makes it possible to disable the prototype access restrictions added in 4.6.0
- an error is logged in the console, if access to prototype properties is attempted and denied
  and no explicit configuration has taken place.

Compatibility notes:

no compatibilities are expected

Commits

`v4.6.0`

Compare Source

Features:

feat: access control to prototype properties via whitelist (#1633)- d03b6ec

Bugfixes:

fix(runtime.js): partials compile not caching (#1600) - 23d58e7

Chores, docs:

various refactorings and improvements to tests - d7f0dcf, 187d611, d337f40
modernize the build-setup
- use prettier to format and eslint to verify - c40d9f3, 8901c28, e97685e, 1f61f21
- use nyc instead of istanbul to collect coverage - 164b7ff, 1ebce2b
- update build code to use modern javascript and make it cleaner - 14b621c, 1ec1737, 3a5b65e, dde108e, 04b1984, 587e7a3
- restructur build commands - e913dc5,
eslint rule changes - ac4655e, dc54952
Update (C) year in the LICENSE file - d1fb07b
chore: try to fix saucelabs credentials (#1627) -
Update readme.md with updated links (#1620) - edcc84f

BREAKING CHANGES:

access to prototype properties is forbidden completely by default,
specific properties or methods can be allowed via runtime-options.
See #1633 for details.
If you are using Handlebars as documented, you should not be accessing prototype
properties from your template anyway, so the changes should not be a problem
for you. Only the use of undocumented features can break your build.

That is why we only bump the minor version despite mentioning breaking changes.

Commits

`v4.5.3`

Compare Source

Bugfixes:

fix: add "no-prototype-builtins" eslint-rule and fix all occurences - f7f05d7
fix: add more properties required to be enumerable - 1988878

Chores / Build:

fix: use !== 0 instead of != 0 - c02b05f
add chai and dirty-chai and sinon, for cleaner test-assertions and spies,
deprecate old assertion-methods - 93e284e, 886ba86, 0817dad, 93516a0

Security:

The properties __proto__, __defineGetter__, __defineSetter__ and __lookupGetter__
have been added to the list of "properties that must be enumerable".
If a property by that name is found and not enumerable on its parent,
it will silently evaluate to undefined. This is done in both the compiled template and the "lookup"-helper.
This will prevent new Remote-Code-Execution exploits that have been
published recently.

Compatibility notes:

Due to the security-fixes. The semantics of the templates using
__proto__, __defineGetter__, __defineSetter__ and __lookupGetter__ in the respect that those expression now return
undefined rather than their actual value from the proto.
The semantics have not changed in cases where the properties are enumerable, as in:

{
  __proto__: 'some string';
}

The change may be breaking in that respect, but we still only
increase the patch-version, because the incompatible use-cases
are not intended, undocumented and far less important than fixing
Remote-Code-Execution exploits on existing systems.

Commits

`v4.5.2`

Compare Source

`v4.5.1`

Compare Source

Bugfixs

fix: move "eslint-plugin-compat" to devDependencies - 5e9d17f (#1589)

Compatibility notes:

No compatibility issues are to be expected

Commits

`v4.5.0`

Compare Source

Features / Improvements

Add method Handlebars.parseWithoutProcessing (#1584) - 62ed3c2
add guard to if & unless helpers (#1549)
show source location for the strict lookup exceptions - feb60f8

Bugfixes:

Use objects for hash value tracking - 7fcf9d2

Chore:

Resolve deprecation warning message from eslint while running eslint (#1586) - 7052e88
chore: add eslint-plugin-compat and eslint-plugin-es5 - 088e618

Compatibility notes:

No compatibility issues are to be expected

Commits

`v4.4.5`

Compare Source

Bugfixes:

Contents of raw-blocks must be matched with non-eager regex-matching - 8d5530e, #1579

Commits

`v4.4.4`

Compare Source

Bugfixes:

fix: prevent zero length tokens in raw-blocks (#1577, #1578) - f1752fe

Chore:

chore: link to s3 bucket with https, add "npm ci" to build instructions - 0b593bf

Compatibility notes:

no compatibility issues are expected

Commits

`v4.4.3`

Compare Source

Bugfixes

Typings:

add missing type fields to AST typings and add tests for them - 0440af2

Commits

`v4.4.2`

Compare Source

chore: fix grunt-saucelabs dependency - b7eada0

Commits

`v4.4.1`

Compare Source

#1562 - Error message for syntax error missing location in 4.2.1+

Commits

`v4.4.0`

Compare Source

Added support for iterable objects in {{#each}} helper (#1557) - cf7545e

Commits

`v4.3.5`

Compare Source

`v4.3.4`

Compare Source

fix: harden "propertyIsEnumerable"-check - ff4d827

Compatibility notes:

No incompatibilities are known.

Commits

`v4.3.3`

Compare Source

fix test case for browsers that do not support defineGetter - 8742bde

Commits

`v4.3.2`

Compare Source

Use Object.prototype.propertyIsEnumerable to check for constructors - 213c0bb, #1563

Compatibility notes:

There are no breaking changes

Commits

`v4.3.1`

Compare Source

Fixes:

do not break on precompiled templates from Handlebars >=4.0.0 <4.3.0 - 1266838, #1561
Ensure allowCallsToHelperMissing runtime option is optional in typings - 93444c5, 64ecb9e, #1560

Commits

Configuration

📅 Schedule: "before 11pm on Monday" (UTC).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box.

This PR has been generated by WhiteSource Renovate. View repository job log here.

codecov · 2020-07-27T01:29:07Z

Codecov Report

Merging #61 (fb389a2) into master (60d559e) will not change coverage.
The diff coverage is n/a.

❗ Current head fb389a2 differs from pull request most recent head 10715e6. Consider uploading reports for the commit 10715e6 to get more accurate results

@@           Coverage Diff           @@
##           master      #61   +/-   ##
=======================================
  Coverage   80.00%   80.00%           
=======================================
  Files          17       17           
  Lines         105      105           
  Branches        4        4           
=======================================
  Hits           84       84           
  Misses         18       18           
  Partials        3        3

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 60d559e...10715e6. Read the comment docs.

fix(deps): update dependency handlebars to v4.7.7

10715e6

renovate bot force-pushed the renovate/handlebars-4.x branch from 6767379 to 10715e6 Compare April 26, 2021 16:59

renovate bot changed the title ~~fix(deps): update dependency handlebars to v4.7.6~~ fix(deps): update dependency handlebars to v4.7.7 Apr 26, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update dependency handlebars to v4.7.7 #61

fix(deps): update dependency handlebars to v4.7.7 #61

renovate bot commented Jul 27, 2020 •

edited

Loading

codecov bot commented Jul 27, 2020 •

edited

Loading

fix(deps): update dependency handlebars to v4.7.7 #61

Are you sure you want to change the base?

fix(deps): update dependency handlebars to v4.7.7 #61

Conversation

renovate bot commented Jul 27, 2020 • edited Loading

Release Notes

Configuration

codecov bot commented Jul 27, 2020 • edited Loading

Codecov Report

renovate bot commented Jul 27, 2020 •

edited

Loading

codecov bot commented Jul 27, 2020 •

edited

Loading