v3.0.4

This is required by some other dependencies as
peerDependencies, which are not automatically installed
anymore since npm@3

CONTRIBUTING.md

@@ -6,10 +6,18 @@ Please see our [FAQ](https://github.com/wycats/handlebars.js/blob/master/FAQ.md)
 
 Should you run into other issues with the project, please don't hesitate to let us know by filing an [issue][issue]! In general we are going to ask for an example of the problem failing, which can be as simple as a jsfiddle/jsbin/etc. We've put together a jsfiddle [template][jsfiddle] to ease this. (We will keep this link up to date as new releases occur, so feel free to check back here)
 
-Pull requests containing only failing thats demonstrating the issue are welcomed and this also helps ensure that your issue won't regress in the future once it's fixed.
+Pull requests containing only failing tests demonstrating the issue are welcomed and this also helps ensure that your issue won't regress in the future once it's fixed.
 
 Documentation issues on the handlebarsjs.com site should be reported on [handlebars-site](https://github.com/wycats/handlebars-site).
 
+## Branches
+
+* The branch `4.x` contains the currently released version. Bugfixes should be made in this branch.
+* The branch `master` contains the next version. A release date is not yet specified. Maintainers
+  should merge the branch `4.x` into the master branch regularly.
+* The branch `3.x` contains the previous release. Relevant bugfixes may be cherry-picked into this
+  branch from the `4.x` branch. There should be no merges anymore between this branch and `4.x` or `master`.
+
 ## Pull Requests
 
 We also accept [pull requests][pull-request]!
@@ -42,6 +50,25 @@ The `grunt dev` implements watching for tests and allows for in browser testing
 If you notice any problems, please report them to the GitHub issue tracker at
 [http://github.com/wycats/handlebars.js/issues](http://github.com/wycats/handlebars.js/issues).
 
+## Running Tests
+
+To run tests locally, first install all dependencies.
+```sh
+npm install
+```
+
+Clone the mustache specs into the spec/mustache folder.
+```sh
+cd spec
+rm -r mustache
+git clone https://github.com/mustache/spec.git mustache
+```
+
+From the root directory, run the tests.
+```sh
+npm test
+```
+
 ## Ember testing
 
 The current ember distribution should be tested as part of the handlebars release process. This requires building the `handlebars-source` gem locally and then executing the ember test script.

components/bower.json

@@ -1,6 +1,6 @@
 {
   "name": "handlebars",
-  "version": "3.0.3",
+  "version": "3.0.4",
   "main": "handlebars.js",
   "dependencies": {}
 }

components/handlebars.js.nuspec

@@ -2,7 +2,7 @@
 <package>
 	<metadata>
 		<id>handlebars.js</id>
-		<version>3.0.3</version>
+		<version>3.0.4</version>
 		<authors>handlebars.js Authors</authors>
 		<licenseUrl>https://github.com/wycats/handlebars.js/blob/master/LICENSE</licenseUrl>
 		<projectUrl>https://github.com/wycats/handlebars.js/</projectUrl>

lib/handlebars/runtime.js

@@ -20,8 +20,6 @@ export function checkRevision(compilerInfo) {
   }
 }
 
-// TODO: Remove this line and break up compilePartial
-
 export function template(templateSpec, env) {
   /* istanbul ignore next */
   if (!env) {

lib/handlebars/utils.js

@@ -4,11 +4,12 @@ const escape = {
   '>': '>',
   '"': '"',
   "'": ''',
-  '`': '`'
+  '`': '`',
+  '=': '='
 };
 
-const badChars = /[&<>"'`]/g,
-      possible = /[&<>"'`]/;
+const badChars = /[&<>"'`=]/g,
+      possible = /[&<>"'`=]/;
 
 function escapeChar(chr) {
   return escape[chr];

package.json

@@ -1,7 +1,7 @@
 {
   "name": "handlebars",
   "barename": "handlebars",
-  "version": "3.0.3",
+  "version": "3.0.4",
   "description": "Handlebars provides the power necessary to let you build semantic templates effectively with no frustration",
   "homepage": "http://www.handlebarsjs.com/",
   "keywords": [
@@ -25,7 +25,7 @@
     "source-map": "^0.1.40"
   },
   "optionalDependencies": {
-    "uglify-js": "~2.3"
+    "uglify-js": "^2.6"
   },
   "devDependencies": {
     "async": "^0.9.0",
@@ -54,7 +54,9 @@
     "mocha": "~1.20.0",
     "mustache": "0.x",
     "semver": "^4.0.0",
-    "underscore": "^1.5.1"
+    "underscore": "^1.5.1",
+    "webpack": "^1.15.0",
+    "webpack-dev-server": "^1.16.5"
   },
   "main": "lib/index.js",
   "bin": {

release-notes.md

@@ -2,7 +2,17 @@
 
 ## Development
 
-[Commits](https://github.com/wycats/handlebars.js/compare/v3.0.3...master)
+[Commits](https://github.com/wycats/handlebars.js/compare/v3.0.4...master)
+
+## v3.0.4 - December 15th, 2018
+- Further relax uglify dependency - 4cd5305
+- Update uglify-js to avoid vulnerability - d97c2e6
+- Escape = in HTML content - 1c863e3
+
+Compatibility notes:
+- No breaking changes
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v3.0.3...v3.0.4)
 
 ## v3.0.3 - April 28th, 2015
 - [#1004](https://github.com/wycats/handlebars.js/issues/1004) - Latest version breaks with RequireJS (global is undefined) ([@boskee](https://api.github.com/users/boskee))

spec/utils.js

@@ -18,6 +18,7 @@ describe('utils', function() {
   describe('#escapeExpression', function() {
     it('shouhld escape html', function() {
       equals(Handlebars.Utils.escapeExpression('foo<&"\'>'), 'foo&lt;&amp;&quot;&#x27;&gt;');
+      equals(Handlebars.Utils.escapeExpression('foo='), 'foo&#x3D;');
     });
     it('should not escape SafeString', function() {
       var string = new Handlebars.SafeString('foo<&"\'>');