Handlebars 4.7.2 is a minor version update to the popular Handlebars templating engine, building upon the solid foundation of version 4.7.1. Both versions share the same core dependencies, including neo-async, optimist, source-map, and uglify-js, ensuring continued compatibility with existing projects. The development dependencies also remain consistent, suggesting a focus on maintaining code quality and developer tooling. Key tools for development and testing such as eslint, prettier, mocha, and chai remain unchanged, indicating no significant shifts in the development workflow.
The primary difference lies in the bug fixes and internal improvements incorporated in version 4.7.2, making it a recommended upgrade for users of 4.7.1. While the specifics of these changes aren't detailed, this update likely addresses minor issues and edge cases, enhancing the stability and reliability of the library. The slight increase in unpacked size of 4.7.2 may reflect these internal adjustments.
Developers using Handlebars will appreciate the continued commitment to backward compatibility demonstrated by the similar dependency profiles. Transitioning to version 4.7.2 should be seamless, offering improved stability without requiring significant code modifications. This increment focuses on refining the existing feature set rather than introducing breaking changes, providing a familiar and dependable templating experience. The library's robust tooling and extensive community support further contribute to its ease of use and long-term viability for building dynamic web applications.
All the vulnerabilities related to the version 4.7.2 of the package
Prototype Pollution in handlebars
The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.
Remote code execution in handlebars when compiling templates
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.
Prototype Pollution in minimist
Affected versions of minimist are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --__proto__.y=Polluted adds a y property with value Polluted to all objects. The argument --__proto__=Polluted raises and uncaught error and crashes the application.
This is exploitable if attackers have control over the arguments being passed to minimist.
Upgrade to versions 0.2.1, 1.2.3 or later.
Prototype Pollution in minimist
Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
