v3.0.8

- hopefully fixing hanging saucelabs build

.gitignore

@@ -10,3 +10,4 @@ node_modules
 *.sublime-workspace
 npm-debug.log
 sauce_connect.log*
+/.idea/

.travis.yml

@@ -13,11 +13,13 @@ env:
   - secure: Nm4AgSfsgNB21kgKrF9Tl7qVZU8YYREhouQunFracTcZZh2NZ2XH5aHuSiXCj88B13Cr/jGbJKsZ4T3QS3wWYtz6lkyVOx3H3iI+TMtqhD9RM3a7A4O+4vVN8IioB2YjhEu0OKjwgX5gp+0uF+pLEi7Hpj6fupD3AbbL5uYcKg8=
 matrix:
   include:
-  - node_js: '0.10'
+  - node_js: '10'
     env:
     - PUBLISH=true
     - secure: pLTzghtVll9yGKJI0AaB0uI8GypfWxLTaIB0ZL8//yN3nAEIKMhf/RRilYTsn/rKj2NUa7vt2edYILi3lttOUlCBOwTc9amiRms1W8Lwr/3IdWPeBLvLuH1zNJRm2lBAwU4LBSqaOwhGaxOQr6KHTnWudhNhgOucxpZfvfI/dFw=
     - secure: yERYCf7AwL11D9uMtacly/THGV8BlzsMmrt+iQVvGA3GaY6QMmfYqf6P6cCH98sH5etd1Y+1e6YrPeMjqI6lyRllT7FptoyOdHulazQe86VQN4sc0EpqMlH088kB7gGjTut9Z+X9ViooT5XEh9WA5jXEI9pXhQJNoIHkWPuwGuY=
+  - node_js: '8'
+  - node_js: '6'
 cache:
   directories:
   - node_modules

CONTRIBUTING.md

@@ -6,10 +6,18 @@ Please see our [FAQ](https://github.com/wycats/handlebars.js/blob/master/FAQ.md)
 
 Should you run into other issues with the project, please don't hesitate to let us know by filing an [issue][issue]! In general we are going to ask for an example of the problem failing, which can be as simple as a jsfiddle/jsbin/etc. We've put together a jsfiddle [template][jsfiddle] to ease this. (We will keep this link up to date as new releases occur, so feel free to check back here)
 
-Pull requests containing only failing thats demonstrating the issue are welcomed and this also helps ensure that your issue won't regress in the future once it's fixed.
+Pull requests containing only failing tests demonstrating the issue are welcomed and this also helps ensure that your issue won't regress in the future once it's fixed.
 
 Documentation issues on the handlebarsjs.com site should be reported on [handlebars-site](https://github.com/wycats/handlebars-site).
 
+## Branches
+
+* The branch `4.x` contains the currently released version. Bugfixes should be made in this branch.
+* The branch `master` contains the next version. A release date is not yet specified. Maintainers
+  should merge the branch `4.x` into the master branch regularly.
+* The branch `3.x` contains the previous release. Relevant bugfixes may be cherry-picked into this
+  branch from the `4.x` branch. There should be no merges anymore between this branch and `4.x` or `master`.
+
 ## Pull Requests
 
 We also accept [pull requests][pull-request]!
@@ -42,6 +50,25 @@ The `grunt dev` implements watching for tests and allows for in browser testing
 If you notice any problems, please report them to the GitHub issue tracker at
 [http://github.com/wycats/handlebars.js/issues](http://github.com/wycats/handlebars.js/issues).
 
+## Running Tests
+
+To run tests locally, first install all dependencies.
+```sh
+npm install
+```
+
+Clone the mustache specs into the spec/mustache folder.
+```sh
+cd spec
+rm -r mustache
+git clone https://github.com/mustache/spec.git mustache
+```
+
+From the root directory, run the tests.
+```sh
+npm test
+```
+
 ## Ember testing
 
 The current ember distribution should be tested as part of the handlebars release process. This requires building the `handlebars-source` gem locally and then executing the ember test script.
@@ -60,6 +87,14 @@ npm test
 
 Handlebars utilizes the [release yeoman generator][generator-release] to perform most release tasks.
 
+Before starting the release, make sure that the `yo`, `generator-release` and `grunt` are installed globally.
+The last release was successfully performed with `yo@2.0.5`, `generator-release@2.6.1` and `grunt@1.0.3` and `node@10.11.0`.
+If the latest versions of the tools don't work you may want to revert to those versions.
+
+```bash
+npm install -g yo generator-release grunt
+```
+
 A full release may be completed with the following:
 
 ```

Gruntfile.js

@@ -161,9 +161,9 @@ module.exports = function(grunt) {
           concurrency: 2,
           browsers: [
             {browserName: 'chrome'},
-            {browserName: 'firefox'},
-            {browserName: 'safari', version: 7, platform: 'OS X 10.9'},
-            {browserName: 'safari', version: 6, platform: 'OS X 10.8'},
+            {browserName: 'firefox', platform: 'Linux'},
+            {browserName: 'safari', version: 9, platform: 'OS X 10.11'},
+            {browserName: 'safari', version: 8, platform: 'OS X 10.10'},
             {browserName: 'internet explorer', version: 11, platform: 'Windows 8.1'},
             {browserName: 'internet explorer', version: 10, platform: 'Windows 8'},
             {browserName: 'internet explorer', version: 9, platform: 'Windows 7'}
@@ -225,7 +225,9 @@ module.exports = function(grunt) {
   grunt.task.loadTasks('tasks');
 
   grunt.registerTask('bench', ['metrics']);
-  grunt.registerTask('sauce', process.env.SAUCE_USERNAME ? ['tests', 'connect', 'saucelabs-mocha'] : []);
+  // remove this comment when saucelabs is working again
+  grunt.registerTask('sauce', process.env.SAUCE_USERNAME ? ['tests' /*, 'connect' , 'saucelabs-mocha' */ ] : []);
+
 
   grunt.registerTask('travis', process.env.PUBLISH ? ['default', 'sauce', 'metrics', 'publish:latest'] : ['default']);
 

README.markdown

@@ -1,4 +1,5 @@
 [![Travis Build Status](https://img.shields.io/travis/wycats/handlebars.js/master.svg)](https://travis-ci.org/wycats/handlebars.js)
+[![Appveyor Build Status](https://ci.appveyor.com/api/projects/status/github/wycats/handlebars.js?branch=master&svg=true)](https://ci.appveyor.com/project/wycats/handlebars-js)
 [![Selenium Test Status](https://saucelabs.com/buildstatus/handlebars)](https://saucelabs.com/u/handlebars)
 
 Handlebars.js

appveyor.yml

@@ -0,0 +1,37 @@
+# Test against these versions of Node.js
+environment:
+  matrix:
+    - nodejs_version: "10"
+
+platform:
+  - x64
+
+# Install scripts (runs after repo cloning)
+install:
+  # Get the latest stable version of Node.js
+  - ps: Install-Product node $env:nodejs_version $env:platform
+  # Clone submodules (mustache spec)
+  - cmd: git submodule update --init --recursive
+  # Install modules
+  - cmd: npm install
+  - cmd: npm install -g grunt-cli
+
+
+# Post-install test scripts
+test_script:
+  # Output useful info for debugging
+  - cmd: node --version
+  - cmd: npm --version
+  # Run tests
+  - cmd: grunt --stack travis
+
+# Don't actually build
+build: off
+
+on_failure:
+  - cmd: 7z a coverage.zip coverage
+  - cmd: appveyor PushArtifact coverage.zip
+
+
+# Set build version format here instead of in the admin panel
+version: "{build}"

components/bower.json

@@ -1,6 +1,6 @@
 {
   "name": "handlebars",
-  "version": "3.0.3",
+  "version": "3.0.8",
   "main": "handlebars.js",
   "dependencies": {}
 }

components/handlebars.js.nuspec

@@ -2,7 +2,7 @@
 <package>
 	<metadata>
 		<id>handlebars.js</id>
-		<version>3.0.3</version>
+		<version>3.0.8</version>
 		<authors>handlebars.js Authors</authors>
 		<licenseUrl>https://github.com/wycats/handlebars.js/blob/master/LICENSE</licenseUrl>
 		<projectUrl>https://github.com/wycats/handlebars.js/</projectUrl>

components/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "handlebars",
+  "version": "3.0.8",
+  "license": "MIT",
+  "jspm": {
+    "main": "handlebars",
+    "shim": {
+      "handlebars": {
+        "exports": "Handlebars"
+      }
+    },
+    "files": [
+      "handlebars.js",
+      "handlebars.runtime.js"
+    ],
+    "buildConfig": {
+      "minify": true
+    }
+  }
+}

lib/handlebars/base.js

@@ -212,7 +212,13 @@ function registerDefaultHelpers(instance) {
   });
 
   instance.registerHelper('lookup', function(obj, field) {
-    return obj && obj[field];
+    if (!obj) {
+      return obj;
+    }
+    if (Utils.dangerousPropertyRegex.test(String(field)) && !Object.prototype.hasOwnProperty.call(obj, field)) {
+      return undefined;
+    }
+    return obj[field];
   });
 }
 

lib/handlebars/compiler/javascript-compiler.js

@@ -1,6 +1,6 @@
 import { COMPILER_REVISION, REVISION_CHANGES } from '../base';
 import Exception from '../exception';
-import {isArray} from '../utils';
+import {isArray, dangerousPropertyRegex} from '../utils';
 import CodeGen from './code-gen';
 
 function Literal(value) {
@@ -13,10 +13,18 @@ JavaScriptCompiler.prototype = {
   // PUBLIC API: You can override these methods in a subclass to provide
   // alternative compiled forms for name lookup and buffering semantics
   nameLookup: function(parent, name /* , type*/) {
-    if (JavaScriptCompiler.isValidJavaScriptVariableName(name)) {
-      return [parent, '.', name];
-    } else {
-      return [parent, "['", name, "']"];
+    if (dangerousPropertyRegex.test(name)) {
+      const isOwnProperty = [ this.aliasable('Object.prototype.hasOwnProperty'), '.call(', parent, ',', JSON.stringify(name), ')'];
+      return ['(', isOwnProperty, '?', _actualLookup(), ' : undefined)'];
+    }
+    return _actualLookup();
+
+    function _actualLookup() {
+      if (JavaScriptCompiler.isValidJavaScriptVariableName(name)) {
+        return [parent, '.', name];
+      } else {
+        return [parent, '[', JSON.stringify(name), ']'];
+      }
     }
   },
   depthedLookup: function(name) {

lib/handlebars/exception.js

@@ -19,13 +19,28 @@ function Exception(message, node) {
     this[errorProps[idx]] = tmp[errorProps[idx]];
   }
 
+  /* istanbul ignore else */
   if (Error.captureStackTrace) {
     Error.captureStackTrace(this, Exception);
   }
 
-  if (loc) {
-    this.lineNumber = line;
-    this.column = column;
+  try {
+    if (loc) {
+      this.lineNumber = line;
+
+      // Work around issue under safari where we can't directly set the column value
+      /* istanbul ignore next */
+      if (Object.defineProperty) {
+        Object.defineProperty(this, 'column', {
+          value: column,
+          enumerable: true
+        });
+      } else {
+        this.column = column;
+      }
+    }
+  } catch (nop) {
+    /* Ignore if the browser is very particular */
   }
 }
 

lib/handlebars/runtime.js

@@ -20,8 +20,6 @@ export function checkRevision(compilerInfo) {
   }
 }
 
-// TODO: Remove this line and break up compilePartial
-
 export function template(templateSpec, env) {
   /* istanbul ignore next */
   if (!env) {

lib/handlebars/utils.js

@@ -5,6 +5,8 @@ const escape = {
   '"': '"',
   "'": ''',
   '`': '`'
+  // The "equals-sign" is intentionally excluded from this list
+  // due to semantic-versioning issues (see #1489)
 };
 
 const badChars = /[&<>"'`]/g,
@@ -99,3 +101,5 @@ export function blockParams(params, ids) {
 export function appendContextPath(contextPath, id) {
   return (contextPath ? contextPath + '.' : '') + id;
 }
+
+export const dangerousPropertyRegex = /^(constructor|__defineGetter__|__defineSetter__|__lookupGetter__|__proto__)$/;

package.json

@@ -1,7 +1,7 @@
 {
   "name": "handlebars",
   "barename": "handlebars",
-  "version": "3.0.3",
+  "version": "3.0.8",
   "description": "Handlebars provides the power necessary to let you build semantic templates effectively with no frustration",
   "homepage": "http://www.handlebarsjs.com/",
   "keywords": [
@@ -10,6 +10,9 @@
     "template",
     "html"
   ],
+  "publishConfig": {
+    "tag": "legacy"
+  },
   "repository": {
     "type": "git",
     "url": "https://github.com/wycats/handlebars.js.git"
@@ -25,11 +28,11 @@
     "source-map": "^0.1.40"
   },
   "optionalDependencies": {
-    "uglify-js": "~2.3"
+    "uglify-js": "^2.6"
   },
   "devDependencies": {
     "async": "^0.9.0",
-    "aws-sdk": "~1.5.0",
+    "aws-sdk": "^2.1.49",
     "babel-loader": "^5.0.0",
     "babel-runtime": "^5.1.10",
     "benchmark": "~1.0",
@@ -46,15 +49,17 @@
     "grunt-contrib-uglify": "0.x",
     "grunt-contrib-watch": "0.x",
     "grunt-eslint": "^11.0.0",
-    "grunt-saucelabs": "8.x",
+    "grunt-saucelabs": "9.x",
     "grunt-webpack": "^1.0.8",
     "istanbul": "^0.3.0",
     "jison": "~0.3.0",
     "keen.io": "0.0.3",
-    "mocha": "~1.20.0",
+    "mocha": "~1.21.5",
     "mustache": "0.x",
     "semver": "^4.0.0",
-    "underscore": "^1.5.1"
+    "underscore": "^1.5.1",
+    "webpack": "^1.15.0",
+    "webpack-dev-server": "^1.16.5"
   },
   "main": "lib/index.js",
   "bin": {

release-notes.md

@@ -2,7 +2,111 @@
 
 ## Development
 
-[Commits](https://github.com/wycats/handlebars.js/compare/v3.0.3...master)
+[Commits](https://github.com/wycats/handlebars.js/compare/v3.0.8...master)
+
+## v3.0.8 - February 23rd, 2020
+Bugfixes:
+- backport some (but not all) of the security fixes from 4.x - 156061e
+
+Compatibility notes:
+- The properties `__proto__`, `__defineGetter__`, `__defineSetter__` and `__lookupGetter__` 
+  have been added to the list of "dangerous properties". If a property
+  by that name is found and not an own-property of its parent, it will silently evaluate to undefined.
+  This is done in both the compiled template and the "lookup"-helper. This will prevent
+  Remote-Code-Execution exploits that have been published in npm advisories [1324](https://www.npmjs.com/advisories/1324)
+  and [1316](https://www.npmjs.com/advisories/1316).
+- The check for dangerous properties has been changed from "propertyIsEnumerable" to "hasOwnProperty", as it is now done 
+  in Handlebars 4.6.0 and later.
+
+Security issues resolved:
+- [npm advisory 1324](https://www.npmjs.com/advisories/1324)
+- [npm advisory 1316](https://www.npmjs.com/advisories/1316)
+- [npm advisory 1325](https://www.npmjs.com/advisories/1325)
+- [npm advisory 1164](https://www.npmjs.com/advisories/1164)
+
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v3.0.7...v3.0.8)
+
+## v3.0.7 - June 30th, 2019
+Security fixes:
+
+- [#1532](https://github.com/wycats/handlebars.js/pull/1532) - Backport security fixes to 3.x branch ([@mattolson](https://api.github.com/users/mattolson))
+
+Housekeeping
+
+- disable saucelabs-tests since the tunnel is not working - 95f33b1
+- update grunt-saucelabs and aws dependency - 09aaa56
+- fix package.json of components/handlebars.js repo - 7cf753b
+- Fix Travis by updating git tag retrieval - 7c3944015d30a4348ae66ec1736b752cd864d5c1
+- Use istanbul/lib/cli.js instead of node_modules/.bin/istanbul - 7820b207e123babd0bda0b4871790f2ea6b36b01
+
+Tests:
+
+- test: run appveyor tests in Node 10 - 420ac171a01b8777ebce0a777221754fcc72a5a8
+- Fix build on Windows - 47adcda48530ab1504b8019fe17eaedd4f4c943f
+
+
+Compatibility notes:
+
+Access to class constructors (i.e. `({}).constructor`) is now prohibited to prevent
+Remote Code Execution. This means that following construct will no work anymore:
+
+```
+class SomeClass {
+}
+
+SomeClass.staticProperty = 'static'
+
+var template = Handlebars.compile('{{constructor.staticProperty}}');
+document.getElementById('output').innerHTML = template(new SomeClass());
+// expected: 'static', but now this is empty.
+```
+
+This kind of access is not the intended use of Handlebars and leads to the vulnerability described in #1495. We will **not** increase the major version, because such use is not intended or documented, and because of the potential impact of the issue (we fear that most people won't use a new major version and the issue may not be resolved on many systems).
+
+
+
+
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v3.0.6...v3.0.7)
+
+## v3.0.6 - January 2nd, 2019
+Chore:
+- prevent tagging 3.x versions as "latest" in npm - df403ed, [#1486](https://github.com/wycats/handlebars.js/issues/1486)
+- ignore idea config - af919d2
+- fix travis build - 9283205
+- update components/handlebars package.json on release - 9679fe6
+- add active NodeJS versions to travis - d207ad0
+
+Fix: 
+- No longer escape "=" in HTML content - 6e9dbac, [#1489](https://github.com/wycats/handlebars.js/issues/1489)
+- gracefully handle read-only "column"-property of the Error class (required in Safari 9+) - 725986d
+
+
+Compatibility notes:
+- Compatibility to 3.0.5 is broken due to reverting to *not* escaping "=" in HTML,
+  but compatibility to 3.0.3 is restored.
+
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v3.0.5...v3.0.6)
+
+## v3.0.5 - December 15th, 2018
+- chore: use node 10.x in travis-build - 4ed0a62
+
+Compatibility notes:
+- no breaking changes
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v3.0.4...v3.0.5)
+
+## v3.0.4 - December 15th, 2018
+- Further relax uglify dependency - 4cd5305
+- Update uglify-js to avoid vulnerability - d97c2e6
+- Escape = in HTML content - 1c863e3
+
+Compatibility notes:
+- No breaking changes
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v3.0.3...v3.0.4)
 
 ## v3.0.3 - April 28th, 2015
 - [#1004](https://github.com/wycats/handlebars.js/issues/1004) - Latest version breaks with RequireJS (global is undefined) ([@boskee](https://api.github.com/users/boskee))

spec/env/browser.js

@@ -4,7 +4,13 @@ var fs = require('fs'),
     vm = require('vm');
 
 global.Handlebars = 'no-conflict';
-vm.runInThisContext(fs.readFileSync(__dirname + '/../../dist/handlebars.js'), 'dist/handlebars.js');
+
+var filename = 'dist/handlebars.js';
+if (global.minimizedTest) {
+  filename = 'dist/handlebars.min.js';
+}
+var distHandlebars = fs.readFileSync(require.resolve(`../../${filename}`), 'utf-8');
+vm.runInThisContext(distHandlebars, filename);
 
 global.CompilerContext = {
   browser: true,

spec/env/common.js

@@ -1,3 +1,21 @@
+var global = (function() { return this; }());
+
+var AssertError;
+if (Error.captureStackTrace) {
+  AssertError = function AssertError(message, caller) {
+    Error.prototype.constructor.call(this, message);
+    this.message = message;
+
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, caller || AssertError);
+    }
+  };
+
+  AssertError.prototype = new Error();
+} else {
+  AssertError = Error;
+}
+
 global.shouldCompileTo = function(string, hashOrArray, expected, message) {
   shouldCompileToWithPartials(string, hashOrArray, false, expected, message);
 };

spec/env/runner.js

@@ -11,7 +11,7 @@ var files = [ testDir + '/basic.js' ];
 
 var files = fs.readdirSync(testDir)
       .filter(function(name) { return (/.*\.js$/).test(name); })
-      .map(function(name) { return testDir + '/' + name; });
+      .map(function(name) { return testDir + path.sep + name; });
 
 run('./node', function() {
   run('./browser', function() {
@@ -27,6 +27,7 @@ run('./node', function() {
 function run(env, callback) {
   var mocha = new Mocha();
   mocha.ui('bdd');
+  mocha.reporter('dot');
   mocha.files = files.slice();
   if (grep) {
     mocha.grep(grep);

spec/security.js

@@ -0,0 +1,49 @@
+describe('security issues', function() {
+    describe('GH-1495: Prevent Remote Code Execution via constructor', function() {
+        it('should not allow constructors to be accessed', function() {
+            shouldCompileTo('{{constructor.name}}', {}, '');
+            shouldCompileTo('{{lookup (lookup this "constructor") "name"}}', {}, '');
+        });
+
+        it('should allow the "constructor" property to be accessed if it is enumerable', function() {
+            shouldCompileTo('{{constructor.name}}', {'constructor': {
+                'name': 'here we go'
+            }}, 'here we go');
+            shouldCompileTo('{{lookup (lookup this "constructor") "name"}}', {'constructor': {
+                'name': 'here we go'
+            }}, 'here we go');
+        });
+
+        it('should allow prototype properties that are not constructors', function() {
+            function TestClass() {
+            }
+
+            Object.defineProperty(TestClass.prototype, 'abc', {
+                get: function() {
+                    return 'xyz';
+                }
+            });
+
+            shouldCompileTo('{{#with this}}{{this.abc}}{{/with}}',
+                new TestClass(), 'xyz');
+            shouldCompileTo('{{#with this}}{{lookup this "abc"}}{{/with}}',
+                new TestClass(), 'xyz');
+        });
+    });
+
+    describe('GH-1595', function() {
+        it('properties, that are required to be enumerable', function() {
+            shouldCompileTo('{{constructor.name}}', {}, '');
+            shouldCompileTo('{{__defineGetter__.name}}', {}, '');
+            shouldCompileTo('{{__defineSetter__.name}}', {}, '');
+            shouldCompileTo('{{__lookupGetter__.name}}', {}, '');
+            shouldCompileTo('{{__proto__.__defineGetter__.name}}', {}, '');
+
+            shouldCompileTo('{{lookup this "constructor"}}', {}, '');
+            shouldCompileTo('{{lookup this "__defineGetter__"}}', {}, '');
+            shouldCompileTo('{{lookup this "__defineSetter__"}}', {}, '');
+            shouldCompileTo('{{lookup this "__lookupGetter__"}}', {}, '');
+            shouldCompileTo('{{lookup this "__proto__"}}', {}, '');
+        });
+    });
+});

spec/utils.js

@@ -19,6 +19,9 @@ describe('utils', function() {
     it('shouhld escape html', function() {
       equals(Handlebars.Utils.escapeExpression('foo<&"\'>'), 'foo&lt;&amp;&quot;&#x27;&gt;');
     });
+    it('should not escape the equals-sign in 3.x (#1489)', function() {
+      equals(Handlebars.Utils.escapeExpression('foo='), 'foo=');
+    });
     it('should not escape SafeString', function() {
       var string = new Handlebars.SafeString('foo<&"\'>');
       equals(Handlebars.Utils.escapeExpression(string), 'foo<&"\'>');

tasks/test.js

@@ -1,11 +1,20 @@
 var childProcess = require('child_process'),
-    fs = require('fs');
+    fs = require('fs'),
+    os = require('os');
 
 module.exports = function(grunt) {
   grunt.registerTask('test:bin', function() {
     var done = this.async();
 
-    childProcess.exec('./bin/handlebars -a spec/artifacts/empty.handlebars', function(err, stdout) {
+    var cmd = './bin/handlebars';
+    var args = [ '-a', 'spec/artifacts/empty.handlebars' ];
+
+    // On Windows, the executable handlebars.js file cannot be run directly
+    if (os.platform() === 'win32') {
+      args.unshift(cmd);
+      cmd = process.argv[0];
+    }
+    childProcess.execFile(cmd, args, function(err, stdout) {
       if (err) {
         throw err;
       }
@@ -32,7 +41,7 @@ module.exports = function(grunt) {
   grunt.registerTask('test:cov', function() {
     var done = this.async();
 
-    var runner = childProcess.fork('node_modules/.bin/istanbul', ['cover', '--', './spec/env/runner.js'], {stdio: 'inherit'});
+    var runner = childProcess.fork('node_modules/istanbul/lib/cli.js', ['cover', '--source-map', '--', './spec/env/runner.js'], {stdio: 'inherit'});
     runner.on('close', function(code) {
       if (code != 0) {
         grunt.fatal(code + ' tests failed');

tasks/util/git.js

@@ -86,7 +86,7 @@ module.exports = {
     });
   },
   tagName: function(callback) {
-    childProcess.exec('git describe --tags', {}, function(err, stdout) {
+    childProcess.exec('git describe --tags --always', {}, function(err, stdout) {
       if (err) {
         throw new Error('git.tagName: ' + err.message);
       }

tasks/version.js

@@ -20,6 +20,7 @@ module.exports = function(grunt) {
     async.each([
         ['lib/handlebars/base.js', /var VERSION = ['"](.*)['"];/, 'var VERSION = "' + version + '";'],
         ['components/bower.json', /"version":.*/, '"version": "' + version + '",'],
+        ['components/package.json', /"version":.*/, '"version": "' + version + '",'],
         ['components/handlebars.js.nuspec', /<version>.*<\/version>/, '<version>' + version + '</version>']
       ],
       function(args, callback) {