chore(deps): update dependency handlebars to ~4.7.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
handlebars (source)	~4.5.3 -> ~4.7.0

GitHub Vulnerability Alerts

CVE-2021-23369

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

CVE-2021-23383

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

---

Release Notes

handlebars-lang/handlebars.js (handlebars)

v4.7.7

Compare Source

• fix weird error in integration tests - eb860c0
• fix: check prototype property access in strict-mode (#​1736) - b6d3de7
• fix: escape property names in compat mode (#​1736) - f058970
• refactor: In spec tests, use expectTemplate over equals and shouldThrow (#​1683) - 77825f8
• chore: start testing on Node.js 12 and 13 - 3789a30

(POSSIBLY) BREAKING CHANGES:

• the changes from version 4.6.0 now also apply
  in when using the compile-option "strict: true". Access to prototype properties is forbidden completely by default, specific properties or methods
  can be allowed via runtime-options. See #​1633 for details. If you are using Handlebars as documented, you should not be accessing prototype properties
  from your template anyway, so the changes should not be a problem for you. Only the use of undocumented features can break your build.

That is why we only bump the patch version despite mentioning breaking changes.

Commits

v4.7.6

Compare Source

Chore/Housekeeping:

• #​1672 - Switch cmd parser to latest minimist (@​dougwilson

Compatibility notes:

• Restored Node.js compatibility

Commits

v4.7.5

Compare Source

Chore/Housekeeping:

• ~Node.js version support has been changed to v6+~ Reverted in 4.7.6

Compatibility notes:

• ~Node.js < v6 is no longer supported~ Reverted in 4.7.6

Commits

v4.7.4

Compare Source

Chore/Housekeeping:

• #​1666 - Replaced minimist with yargs for handlebars CLI (@​aorinevo, @​AviVahl & @​fabb)

Compatibility notes:

• No incompatibilities are to be expected

Commits

v4.7.3

Compare Source

Chore/Housekeeping:

• #​1644 - Download links to aws broken on handlebarsjs.com - access denied (@​Tea56)
• Fix spelling and punctuation in changelog - d78cc73

Bugfixes:

• Add Type Definition for Handlebars.VERSION, Fixes #​1647 - 4de51fe
• Include Type Definition for runtime.js in Package - a32d05f

Compatibility notes:

• No incompatibilities are to be expected

Commits

v4.7.2

Compare Source

Bugfixes:

• fix: don't wrap helpers that are not functions - 9d5aa36, #​1639

Chore/Build:

• chore: execute saucelabs-task only if access-key exists - a4fd391

Compatibility notes:

• No breaking changes are to be expected

Commits

v4.7.1

Compare Source

Bugfixes:

• fix: fix log output in case of illegal property access - f152dfc
• fix: log error for illegal property access only once per property - 3c1e252

Compatibility notes:

• no incompatibilities are to be expected.

Commits

v4.7.0

Compare Source

Features:

• feat: default options for controlling proto access - 7af1c12, #​1635
  • This makes it possible to disable the prototype access restrictions added in 4.6.0
  • an error is logged in the console, if access to prototype properties is attempted and denied
    and no explicit configuration has taken place.

Compatibility notes:

• no compatibilities are expected

Commits

v4.6.0

Compare Source

Features:

• feat: access control to prototype properties via whitelist (#​1633)- d03b6ec

Bugfixes:

• fix(runtime.js): partials compile not caching (#​1600) - 23d58e7

Chores, docs:

• various refactorings and improvements to tests - d7f0dcf, 187d611, d337f40
• modernize the build-setup
  • use prettier to format and eslint to verify - c40d9f3, 8901c28, e97685e, 1f61f21
  • use nyc instead of istanbul to collect coverage - 164b7ff, 1ebce2b
  • update build code to use modern javascript and make it cleaner - 14b621c, 1ec1737, 3a5b65e, dde108e, 04b1984, 587e7a3
  • restructur build commands - e913dc5,
• eslint rule changes - ac4655e, dc54952
• Update (C) year in the LICENSE file - d1fb07b
• chore: try to fix saucelabs credentials (#​1627) -
• Update readme.md with updated links (#​1620) - edcc84f

BREAKING CHANGES:

• access to prototype properties is forbidden completely by default,
  specific properties or methods can be allowed via runtime-options.
  See #​1633 for details.
  If you are using Handlebars as documented, you should not be accessing prototype
  properties from your template anyway, so the changes should not be a problem
  for you. Only the use of undocumented features can break your build.

  That is why we only bump the minor version despite mentioning breaking changes.

Commits

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Jira Pull request Link

It seems this Pull Request has no issues that refers to Jira!!!
Please check it out.