Skip to content

Bump handlebars from 4.5.3 to 4.7.9#73

Open
renovate-pagopa[bot] wants to merge 1 commit into
masterfrom
renovate/handlebars-to-4.7.9
Open

Bump handlebars from 4.5.3 to 4.7.9#73
renovate-pagopa[bot] wants to merge 1 commit into
masterfrom
renovate/handlebars-to-4.7.9

Conversation

@renovate-pagopa

Copy link
Copy Markdown

This PR contains the following updates:

Package Change Age Confidence
handlebars (source) ~4.5.3 -> ~4.7.0 age confidence

For further information on security, please refer to the Confluence page link


Release Notes

handlebars-lang/handlebars.js (handlebars)

v4.7.9

Compare Source

Commits

v4.7.8

Compare Source

Commits

v4.7.7

Compare Source

  • fix weird error in integration tests - eb860c0
  • fix: check prototype property access in strict-mode (#​1736) - b6d3de7
  • fix: escape property names in compat mode (#​1736) - f058970
  • refactor: In spec tests, use expectTemplate over equals and shouldThrow (#​1683) - 77825f8
  • chore: start testing on Node.js 12 and 13 - 3789a30

(POSSIBLY) BREAKING CHANGES:

  • the changes from version 4.6.0 now also apply
    in when using the compile-option "strict: true". Access to prototype properties is forbidden completely by default, specific properties or methods
    can be allowed via runtime-options. See #​1633 for details. If you are using Handlebars as documented, you should not be accessing prototype properties
    from your template anyway, so the changes should not be a problem for you. Only the use of undocumented features can break your build.

That is why we only bump the patch version despite mentioning breaking changes.

Commits

v4.7.6

Compare Source

Chore/Housekeeping:

Compatibility notes:

  • Restored Node.js compatibility

Commits

v4.7.5

Compare Source

Chore/Housekeeping:

  • Node.js version support has been changed to v6+ Reverted in 4.7.6

Compatibility notes:

  • Node.js < v6 is no longer supported Reverted in 4.7.6

Commits

v4.7.4

Compare Source

Chore/Housekeeping:

Compatibility notes:

  • No incompatibilities are to be expected

Commits

v4.7.3

Compare Source

Chore/Housekeeping:

  • #​1644 - Download links to aws broken on handlebarsjs.com - access denied (@​Tea56)
  • Fix spelling and punctuation in changelog - d78cc73

Bugfixes:

  • Add Type Definition for Handlebars.VERSION, Fixes #​1647 - 4de51fe
  • Include Type Definition for runtime.js in Package - a32d05f

Compatibility notes:

  • No incompatibilities are to be expected

Commits

v4.7.2

Compare Source

Bugfixes:

Chore/Build:

  • chore: execute saucelabs-task only if access-key exists - a4fd391

Compatibility notes:

  • No breaking changes are to be expected

Commits

v4.7.1

Compare Source

Bugfixes:

  • fix: fix log output in case of illegal property access - f152dfc
  • fix: log error for illegal property access only once per property - 3c1e252

Compatibility notes:

  • no incompatibilities are to be expected.

Commits

v4.7.0

Compare Source

Features:

  • feat: default options for controlling proto access - 7af1c12, #​1635
    • This makes it possible to disable the prototype access restrictions added in 4.6.0
    • an error is logged in the console, if access to prototype properties is attempted and denied
      and no explicit configuration has taken place.

Compatibility notes:

  • no compatibilities are expected

Commits

v4.6.0

Compare Source

Features:

  • feat: access control to prototype properties via whitelist (#​1633)- d03b6ec

Bugfixes:

Chores, docs:

BREAKING CHANGES:

  • access to prototype properties is forbidden completely by default,
    specific properties or methods can be allowed via runtime-options.
    See #​1633 for details.
    If you are using Handlebars as documented, you should not be accessing prototype
    properties from your template anyway, so the changes should not be a problem
    for you. Only the use of undocumented features can break your build.

    That is why we only bump the minor version despite mentioning breaking changes.

Commits


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@renovate-pagopa

Copy link
Copy Markdown
Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: yarn.lock
Unknown Syntax Error: Unsupported option name ("--ignore-platform").

$ yarn install [--json] [--immutable] [--immutable-cache] [--refresh-lockfile] [--check-cache] [--check-resolutions] [--inline-builds] [--mode #0]

@renovate-pagopa renovate-pagopa Bot requested a review from a team as a code owner March 30, 2026 04:40
@renovate-pagopa renovate-pagopa Bot added the OER label Mar 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants