All Versions
74
Latest Version
Avg Release Cycle
24 days
Latest Release
1157 days ago

Changelog History
Page 3

  • v4.3.4 Changes

    September 28, 2019
    • 🛠 fix: harden "propertyIsEnumerable"-check - ff4d827

    Compatibility notes:

    • No incompatibilities are known.

    Commits

  • v4.3.3 Changes

    September 27, 2019
    • fix test case for browsers that do not support defineGetter - 8742bde

    Commits

  • v4.3.2 Changes

    September 26, 2019
    • 👉 Use Object.prototype.propertyIsEnumerable to check for constructors - 213c0bb, #1563

    Compatibility notes:

    • There are no breaking changes

    Commits

  • v4.3.1 Changes

    September 25, 2019

    🛠 Fixes:

    • do not break on precompiled templates from Handlebars >=4.0.0 <4.3.0 - 1266838, #1561
    • Ensure allowCallsToHelperMissing runtime option is optional in typings - 93444c5, 64ecb9e, #1560

    Commits

  • v4.3.0 Changes

    September 24, 2019

    🛠 Fixes:

    • 🔒 Security: Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72
    • Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72

    🔋 Features:

    • ➕ Add new runtime option allowCallsToHelperMissing to allow calling blockHelperMissing and helperMissing.

    💥 Breaking changes:

    Compatibility notes:

    • Compiler revision increased - 06b7224

      • This means that template compiled with versions prior to 4.3.0 will not work with runtimes >= 4.3.0 The increase was done because the "helperMissing" and "blockHelperMissing" are now moved from the helpers to the internal "container.hooks" object, so old templates will not be able to call them anymore. We suggest that you always recompile your templates with the latest compiler in your build pipelines.

    • Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72

      • Calling "helperMissing" and "blockHelperMissing" directly from a template (like in {{blockHelperMissing}} was never intended and was part of the exploits that have been revealed early in 2019 (see https://github.com/handlebars-lang/handlebars.js/issues/1495). It is also part of a new exploit that is not captured by the earlier fix. In order to harden Handlebars against such exploits, calling thos helpers is now not possible anymore. Overriding those helpers is still possible.
      • If you really need this behavior, you can set the runtime option allowCallsToHelperMissing to true and the calls will again be possible

    Both bullet points imly that Handlebars is not 100% percent compatible to 4.2.0, despite the minor version bump.

    🔒 We consider it more important to resolve a major security issue than to maintain 100% compatibility.

    Commits

  • v4.2.2 Changes

    October 02, 2019
    • Error message for syntax error missing location in 4.2.1+ (#1562)

    Commits

  • v4.2.1 Changes

    September 20, 2019

    🛠 Bugfixes:

    • ⚡️ The "browser" property in the package.json has been updated to use the common-js builds instead of the minified UMD - c55a7be, #1553

    Compatibility notes:

    • No compatibility issues should arise

    Commits

  • v4.2.0 Changes

    September 03, 2019

    ✅ Chore/Test:

    • 👉 Use custom grunt-saucelab with current sauce-connect proxy - f119497
    • ➕ Add framework for various integration tests - f9cce4d
    • ➕ Add integration test for webpack - a57b682

    🛠 Bugfixes:

    🔋 Features:

    • 📦 #1540 - added "browser"-property to package.json, resolves #1102 (@ouijan)

    Compatibility notes:

    • ✅ The new "browser"-property should not break anything, but you can never be sure. The integration test for webpack shows that it works, but if it doesn't please open an issue.

    Commits

  • v4.1.2 Changes

    April 13, 2019

    ✅ Chore/Test:

    • 👕 #1515 - Port over linting and test for typings (@zimmi88)
    • 🔒 chore: add missing typescript dependency, add package-lock.json - 594f1e3
    • 🚚 test: remove safari from saucelabs - 871accc

    🛠 Bugfixes:

    • 🛠 fix: prevent RCE through the "lookup"-helper - cd38583

    Compatibility notes:

    Access to the constructor of a class thought {{lookup obj "constructor" }} is now prohibited. This closes a leak that only half closed in versions 4.0.13 and 4.1.0, but it is a slight incompatibility.

    This kind of access is not the intended use of Handlebars and leads to the vulnerability described in #1495. We will not increase the major version, because such use is not intended or documented, and because of the potential impact of the issue (we fear that most people won't use a new major version and the issue may not be resolved on many systems).

    Commits

  • v4.1.2-0 Changes

    August 25, 2019

    📦 #1540 - added browser to package.json, resolves #1102 (@ouijan)

    Compatibility notes:

    • 🚀 We are not sure if imports via webpack are still working, which is why this release is a pre-release

    Commits