Skip to content

Commit ea9ac4c

Browse files
committed
upgrade handlebars 1.3 -> 4.7.x
handlebars 1.3 is EOL and vulnerable; the prototype-pollution / RCE fixes only exist on the 4.x line. The AST was rewritten in 2.0 (constructor nodes -> plain objects, .statements -> .body), so the AST layer is ported to match. - rewrite pre_processor / extractor / t_call and the canvas scoped_* subclasses to the 4.x AST; share node builders via a new ast_nodes module - stamp loc on synthesized nodes (>= 4 bakes node.loc into compiled output, so a missing loc emits invalid JS) - keep inferred interpolation keys stable by dropping boolean hash values (1.x BOOLEAN nodes had no `original`; >= 4 does, which would orphan keys) - remove the dead handlebars-1.3 subexpression workaround - bump i18nliner-handlebars 2.0.0 -> 3.0.0, i18nliner-canvas 1.3.0 -> 2.0.0 refs FOO-6432 flag=none test plan: 1. regression test in canvas 2. all tests should pass
1 parent 31497b6 commit ea9ac4c

11 files changed

Lines changed: 443 additions & 203 deletions

File tree

package-lock.json

Lines changed: 175 additions & 18 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)