Commit ea9ac4c
committed
upgrade handlebars 1.3 -> 4.7.x
handlebars 1.3 is EOL and vulnerable; the prototype-pollution / RCE fixes
only exist on the 4.x line. The AST was rewritten in 2.0 (constructor nodes
-> plain objects, .statements -> .body), so the AST layer is ported to match.
- rewrite pre_processor / extractor / t_call and the canvas scoped_*
subclasses to the 4.x AST; share node builders via a new ast_nodes module
- stamp loc on synthesized nodes (>= 4 bakes node.loc into compiled output,
so a missing loc emits invalid JS)
- keep inferred interpolation keys stable by dropping boolean hash values
(1.x BOOLEAN nodes had no `original`; >= 4 does, which would orphan keys)
- remove the dead handlebars-1.3 subexpression workaround
- bump i18nliner-handlebars 2.0.0 -> 3.0.0, i18nliner-canvas 1.3.0 -> 2.0.0
refs FOO-6432
flag=none
test plan:
1. regression test in canvas
2. all tests should pass1 parent 31497b6 commit ea9ac4c
11 files changed
Lines changed: 443 additions & 203 deletions
File tree
- packages
- i18nliner-canvas
- lib
- i18nliner-handlebars
- lib
- test
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
0 commit comments