release-notes.md
hash to be a Record<string, any> - de4414d(POSSIBLY) BREAKING CHANGES:
That is why we only bump the patch version despite mentioning breaking changes.
Chore/Housekeeping:
Compatibility notes:
Chore/Housekeeping:
Compatibility notes:
Chore/Housekeeping:
Compatibility notes:
Chore/Housekeeping:
Bugfixes:
Compatibility notes:
Bugfixes:
Chore/Build:
Compatibility notes:
Bugfixes:
Compatibility notes:
Features:
Compatibility notes:
Features:
Bugfixes:
Chores, docs:
BREAKING CHANGES:
access to prototype properties is forbidden completely by default, specific properties or methods can be allowed via runtime-options. See #1633 for details. If you are using Handlebars as documented, you should not be accessing prototype properties from your template anyway, so the changes should not be a problem for you. Only the use of undocumented features can break your build.
That is why we only bump the minor version despite mentioning breaking changes.
Bugfixes:
Chores / Build:
Security:
__proto__, __defineGetter__, __defineSetter__ and __lookupGetter__
have been added to the list of "properties that must be enumerable".
If a property by that name is found and not enumerable on its parent,
it will silently evaluate to undefined. This is done in both the compiled template and the "lookup"-helper.
This will prevent new Remote-Code-Execution exploits that have been
published recently.Compatibility notes:
__proto__, __defineGetter__, __defineSetter__ and __lookupGetter__ in the respect that those expression now return
undefined rather than their actual value from the proto.{
__proto__: 'some string';
}
Compatibility notes:
Bugfixs
Compatibility notes:
Features / Improvements
Bugfixes:
Chore:
Compatibility notes:
Bugfixes:
Bugfixes:
Chore:
Compatibility notes:
Bugfixes
Typings:
Compatibility notes:
Compatibility notes:
Fixes:
Fixes:
Features:
allowCallsToHelperMissing to allow calling blockHelperMissing and helperMissing.Breaking changes:
Compatibility notes:
Compiler revision increased - 06b7224
Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72
{{blockHelperMissing}} was
never intended and was part of the exploits that have been revealed early in 2019
(see https://github.com/wycats/handlebars.js/issues/1495). It is also part of a new exploit that
is not captured by the earlier fix. In order to harden Handlebars against such exploits, calling thos helpers
is now not possible anymore. Overriding those helpers is still possible.allowCallsToHelperMissing to true and the
calls will again be possibleBoth bullet points imly that Handlebars is not 100% percent compatible to 4.2.0, despite the minor version bump.
We consider it more important to resolve a major security issue than to maintain 100% compatibility.
Bugfixes:
Compatibility notes:
Chore/Test:
grunt-saucelab with current sauce-connect proxy - f119497Bugfixes:
knownHelpers doesnt allow for custom helpers (@NickCis)Features:
Compatibility notes:
#1540 - added browser to package.json, resolves #1102 (@ouijan)
Compatibility notes:
Chore/Test:
Bugfixes:
Compatibility notes:
Access to the constructor of a class thought {{lookup obj "constructor" }} is now prohibited. This closes
a leak that only half closed in versions 4.0.13 and 4.1.0, but it is a slight incompatibility.
This kind of access is not the intended use of Handlebars and leads to the vulnerability described in #1495. We will not increase the major version, because such use is not intended or documented, and because of the potential impact of the issue (we fear that most people won't use a new major version and the issue may not be resolved on many systems).
Bugfixes:
Refactorings:
Compatibility notes:
New Features
Security fixes:
Housekeeping
Compatibility notes:
Access to class constructors (i.e. ({}).constructor) is now prohibited to prevent
Remote Code Execution. This means that following construct will no work anymore:
class SomeClass {
}
SomeClass.staticProperty = 'static'
var template = Handlebars.compile('{{constructor.staticProperty}}');
document.getElementById('output').innerHTML = template(new SomeClass());
// expected: 'static', but now this is empty.
This kind of access is not the intended use of Handlebars and leads to the vulnerability described in #1495. We will not increase the major version, because such use is not intended or documented, and because of the potential impact of the issue (we fear that most people won't use a new major version and the issue may not be resolved on many systems).
New features:
Various dependency updates
Bugfixes:
source-map-package should work better with rollup#1463Removed obsolete code:
files field - 69c6ca5Compatibility notes:
uglify-js is unconditionally imported, but only listed as optional dependency (@Turbo87)Compatibility notes:
node handlebars -a ... on Windows - 2e21e2bCompatibility notes:
Compatibility notes:
Compatibility notes:
each iteration with undefined values has been restored to the 3.0 behaviors. Helper calls with undefined context values will now execute against an arbitrary empty object to avoid executing against global object in non-strict mode.] can now be included in [] wrapped identifiers by escaping with \. Any [] identifiers that include \ will now have to properly escape these values.Compatibility notes:
if that do not seem to alter the context. Any instances of ../ in templates will need to be checked for the correct behavior under 4.0.0. In general templates will either reduce the number of ../ instances or leave them as is. See #1028.= character is now HTML escaped. This closes a potential exploit case when using unquoted attributes, i.e. <div foo={{bar}}>. In general it's recommended that attributes always be quoted when their values are generated from a mustache to avoid any potential exploit surfaces.#940 - Add missing reserved words so compiler knows to use array syntax: (@mattflaschen)
#930 - Add parent tracking and mutation to AST visitors (@kpdecker)
#926 - Depthed lookups fail when program duplicator runs (@kpdecker)
#918 - Add instructions for 'spec/mustache' to CONTRIBUTING.md, fix a few typos (@oneeman)
#910 - Different behavior of {{@last}} when {{#each}} in {{#each}} (@zordius)
#907 - Implement named helper variable references (@kpdecker)
#903 - Only provide aliases for multiple use calls (@kpdecker)
#901 - Still escapes with noEscape enabled on isolated Handlebars environment (@zedknight)
#896 - Simplify BlockNode by removing intermediate MustacheNode (@mmun)
#892 - Implement parser for else chaining of helpers (@kpdecker)
#887 - Handlebars.noConflict() option? (@bradvogel)
#886 - Add SafeString to context (or use duck-typing) (@dominicbarnes)
#870 - Registering undefined partial throws exception. (@max-b)
#858 - Disable new default auto-indent at included partials (@majodev)
#856 - jspm compatibility (@MajorBreakfast)
Export the default object for handlebars/runtime - 5594416
Lookup partials when undefined - 617dd57
Compatibility notes:
JavaScriptCompiler APIs have been formalized and documented. As part of the sourcemap handling these should be updated to return arrays for concatenation.JavaScriptCompiler.namespace has been removed as it was unused.SafeString is now duck typed on toHTMLNew Features:
#787 - Remove whitespace surrounding standalone statements (@kpdecker)
Changes to 0/undefined handling
#773 - Implicit parameters in {{#each}} introduces a peculiarity in helpers calling convention (@Bertrand)
#783 - helperMissing and consistency for different expression types (@ErisDS)
#795 - Turn the precompile script into a wrapper around a module. (@jwietelmann)
#823 - Support inverse sections on the with helper (@dan-manges)
#852 - {{foo~}} space control behavior is different from older version (@zordius)
#835 - Templates overwritten if file is loaded twice
Expose escapeExpression on the root object - 980c38c
Remove nested function eval in blockHelperMissing - 6f22ec1
Fix compiler program de-duping - 9e3f824
Compatibility notes:
programWithDepth has been removed an instead an array of context values is passed to fields needing depth lookups.false values are now printed to output rather than silently droppedAST.ProgramNode's signature has changed.JavaScriptCompiler.registerJavaScriptCompiler.replaceStack no longer supports non-inline replaceCompiler.disassembleDECLARE opcodestrip opcodelookup opcodestring values mutated over time. original field provides the unmodified value.Handlebars.registerHelper inverse parametereach helper requires iterator parameterhandlebars --version (@apfelbox)Compatibility notes:
#182 - Allow passing hash parameters to partials (@kpdecker)
#392 - Access to root context in partials and helpers (@kpdecker)
#569 - Unable to lookup array values using @index (@kpdecker)
#491 - For nested helpers: get the @ variables of the outer helper from the inner one (@kpdecker)
#669 - Ability to unregister a helper (@dbachrach)
#634 - It would be great to have the helper name passed to blockHelperMissing (@kpdecker)
#658 - Depthed helpers do not work after an upgrade from 1.0.0 (@xibxor)
#671 - Crashes on no-parameter {{#each}} (@stepancheg)
#699 - @DATA not compiles to invalid JS in stringParams mode (@kpdecker)
#705 - 1.3.0 can not be wrapped in an IIFE (@craigteegarden)
#706 - README: Use with helper instead of relying on blockHelperMissing (@scottgonzalez)
#700 - Remove redundant conditions (@blakeembrey)
#704 - JavaScript Compiler Cleanup (@blakeembrey)
Compatibility notes:
helperMissing helper no longer has the indexed name argument. Helper name is now available via options.name.JavaScriptCompiler.compilerInfo now returns generic objects rather than javascript source._parent field. This is internal but is enumerable for performance/compatibility reasons.Compatibility notes:
@index and @first are now supported for each iteration on objectsHandlebars.VM.checkRevision and Handlebars.JavaScriptCompiler.prototype.compilerInfo now available to modify the version checking behavior.require('handlebars/runtime')#644 - Using precompiled templates (AMD mode) with handlebars.runtime 1.1.1 (@fddima)
Add simple binary utility tests - 96a45a4
Fix empty string compilation - eea708a
#642 - handlebars 1.1.0 are broken with nodejs
Fix release notes link - 17ba258
#483 - Add first and last @ vars to each helper (@denniskuczynski)
#557 - \\{{foo}} escaping only works in some situations (@dmarcotte)
#543 - publish passing master builds to s3 (@fivetanley)
#608 - Add includeZero flag to if conditional
#498 - Handlebars.compile fails on empty string although a single blank works fine
#599 - lambda helpers only receive options if used with arguments
#592 - Optimize array and subprogram performance
#571 - uglify upgrade breaks compatibility with older versions of node
#587 - Partial inside partial breaks?
Compatibility notes:
handlebars.amd.js or handlebars.runtime.amd.js files or load individual modules directly. AMD users should also note that the handlebars object is exposed via the default field on the imported object. This gist provides some discussion of possible compatibility shims.requirehandlebars.js and handlebars.runtime.js files should behave in the same manner as the v1.0.12 / 1.0.0 release.options hash. Previously no-argument helpers did not have this argument.? in idsCompatibility notes:
{{{, requiring that the end token be }}}. Templates that do not
follow this convention should add the additional brace value.undefined value for any helpers that should not be available../foo syntax (@jpfiset): in unescaped identifiers (@jpfiset)\\escapeExpression""with (@thejohnfreeman)toString handling under IE and browserify (@tommydudebreaux)Handlebars.create API in node module for sandboxed instances (@tommydudebreaux)this or .. in illogical place (@leshill)parse/compile/precompile (@machty)When upgrading from the Handlebars 0.9 series, be aware that the signature for passing custom helpers or partials to templates has changed.
Instead of:
template(context, helpers, partials, [data]);
Use:
template(context, { helpers: helpers, partials: partials, data: data });