v4.0.14

Update release notes
test: remove safari from saucelabs
2019-04-13 16:39:19 +02:00 · 2019-04-13 16:38:47 +02:00 · 2019-04-13 16:23:54 +02:00 · 2019-04-13 16:23:29 +02:00 · 2019-04-13 16:22:01 +02:00 · 2019-03-15 23:07:01 +01:00
31 changed files with 569 additions and 418 deletions
@@ -1,200 +0,0 @@
-{
-  "globals": {
-    "self": false
-  },
-  "env": {
-    "node": true
-  },
-  "ecmaFeatures": {
-    // Enabling features that can be implemented without polyfills. Want to avoid polyfills at this time.
-    "arrowFunctions": true,
-    "blockBindings": true,
-    "defaultParams": true,
-    "destructuring": true,
-    "modules": true,
-    "objectLiteralComputedProperties": true,
-    "objectLiteralDuplicateProperties": true,
-    "objectLiteralShorthandMethods": true,
-    "objectLiteralShorthandProperties": true,
-    "restParams": true,
-    "spread": true,
-    "templateStrings": true
-  },
-  "rules": {
-    // Possible Errors //
-    //-----------------//
-
-    "comma-dangle": [2, "never"],
-    "no-cond-assign": [2, "except-parens"],
-
-    // Allow for debugging
-    "no-console": 1,
-
-    "no-constant-condition": 2,
-    "no-control-regex": 2,
-
-    // Allow for debugging
-    "no-debugger": 1,
-
-    "no-dupe-args": 2,
-    "no-dupe-keys": 2,
-    "no-duplicate-case": 2,
-    "no-empty": 2,
-    "no-empty-character-class": 2,
-    "no-ex-assign": 2,
-    "no-extra-boolean-cast": 2,
-    "no-extra-parens": 0,
-    "no-extra-semi": 2,
-    "no-func-assign": 0,
-
-    // Stylistic... might consider disallowing in the future
-    "no-inner-declarations": 0,
-
-    "no-invalid-regexp": 2,
-    "no-irregular-whitespace": 2,
-    "no-negated-in-lhs": 2,
-    "no-obj-calls": 2,
-    "no-regex-spaces": 2,
-    "quote-props": [2, "as-needed", {"keywords": true}],
-    "no-sparse-arrays": 0,
-
-    // Optimizer and coverage will handle/highlight this and can be useful for debugging
-    "no-unreachable": 1,
-
-    "use-isnan": 2,
-    "valid-jsdoc": 0,
-    "valid-typeof": 2,
-
-
-    // Best Practices //
-    //----------------//
-    "block-scoped-var": 0,
-    "complexity": 0,
-    "consistent-return": 0,
-    "curly": 2,
-    "default-case": 1,
-    "dot-notation": [2, {"allowKeywords": false}],
-    "eqeqeq": 0,
-    "guard-for-in": 1,
-    "no-alert": 2,
-    "no-caller": 2,
-    "no-div-regex": 1,
-    "no-else-return": 0,
-    "no-empty-label": 2,
-    "no-eq-null": 0,
-    "no-eval": 2,
-    "no-extend-native": 2,
-    "no-extra-bind": 2,
-    "no-fallthrough": 2,
-    "no-floating-decimal": 2,
-    "no-implied-eval": 2,
-    "no-iterator": 2,
-    "no-labels": 2,
-    "no-lone-blocks": 2,
-    "no-loop-func": 2,
-    "no-multi-spaces": 2,
-    "no-multi-str": 1,
-    "no-native-reassign": 2,
-    "no-new": 2,
-    "no-new-func": 2,
-    "no-new-wrappers": 2,
-    "no-octal": 2,
-    "no-octal-escape": 2,
-    "no-param-reassign": 0,
-    "no-process-env": 2,
-    "no-proto": 2,
-    "no-redeclare": 2,
-    "no-return-assign": 2,
-    "no-script-url": 2,
-    "no-self-compare": 2,
-    "no-sequences": 2,
-    "no-throw-literal": 2,
-    "no-unused-expressions": 2,
-    "no-void": 0,
-    "no-warning-comments": 1,
-    "no-with": 2,
-    "radix": 2,
-    "vars-on-top": 0,
-    "wrap-iife": 2,
-    "yoda": 0,
-
-
-    // Strict //
-    //--------//
-    "strict": 0,
-
-
-    // Variables //
-    //-----------//
-    "no-catch-shadow": 2,
-    "no-delete-var": 2,
-    "no-label-var": 2,
-    "no-shadow": 0,
-    "no-shadow-restricted-names": 2,
-    "no-undef": 2,
-    "no-undef-init": 2,
-    "no-undefined": 0,
-    "no-unused-vars": [2, {"vars": "all", "args": "after-used"}],    
-    "no-use-before-define": [2, "nofunc"],
-
-
-    // Node.js //
-    //---------//
-    // Others left to environment defaults
-    "no-mixed-requires": 0,
-
-
-    // Stylistic //
-    //-----------//
-    "indent": 0,
-    "brace-style": [2, "1tbs", {"allowSingleLine": true}],
-    "camelcase": 2,
-    "comma-spacing": [2, {"before": false, "after": true}],
-    "comma-style": [2, "last"],
-    "consistent-this": [1, "self"],
-    "eol-last": 2,
-    "func-names": 0,
-    "func-style": [2, "declaration"],
-    "key-spacing": [2, {
-        "beforeColon": false,
-        "afterColon": true
-    }],
-    "max-nested-callbacks": 0,
-    "new-cap": 2,
-    "new-parens": 2,
-    "newline-after-var": 0,
-    "no-array-constructor": 2,
-    "no-continue": 0,
-    "no-inline-comments": 0,
-    "no-lonely-if": 2,
-    "no-mixed-spaces-and-tabs": 2,
-    "no-multiple-empty-lines": 0,
-    "no-nested-ternary": 1,
-    "no-new-object": 2,
-    "no-spaced-func": 2,
-    "no-ternary": 0,
-    "no-trailing-spaces": 2,
-    "no-underscore-dangle": 0,
-    "no-extra-parens": [2, "functions"],
-    "one-var": 0,
-    "operator-assignment": 0,
-    "padded-blocks": 0,
-    "quote-props": 0,
-    "quotes": [2, "single", "avoid-escape"],
-    "semi": 2,
-    "semi-spacing": [2, {"before": false, "after": true}],
-    "sort-vars": 0,
-    "space-after-keywords": [2, "always"],
-    "space-before-blocks": [2, "always"],
-    "space-before-function-paren": [2, {"anonymous": "never", "named": "never"}],
-    "space-in-brackets": 0,
-    "space-in-parens": [2, "never"],
-    "space-infix-ops": 2,
-    "space-return-throw-case": 2,
-    "space-unary-ops": 2,
-    "spaced-comment": [2, "always", {"markers": [","]}],
-    "wrap-regex": 1,
-
-    "no-var": 1
-  }
-}
@@ -0,0 +1,129 @@
+module.exports = {
+  "extends": "eslint:recommended",
+  "globals": {
+    "self": false
+  },
+  "env": {
+    "node": true
+  },
+  "ecmaFeatures": {
+    // Enabling features that can be implemented without polyfills. Want to avoid polyfills at this time.
+    "arrowFunctions": true,
+    "blockBindings": true,
+    "defaultParams": true,
+    "destructuring": true,
+    "modules": true,
+    "objectLiteralComputedProperties": true,
+    "objectLiteralDuplicateProperties": true,
+    "objectLiteralShorthandMethods": true,
+    "objectLiteralShorthandProperties": true,
+    "restParams": true,
+    "spread": true,
+    "templateStrings": true
+  },
+  "rules": {
+    // overrides eslint:recommended defaults
+    "no-sparse-arrays": "off",
+    "no-func-assign": "off",
+    "no-console": "warn",
+    "no-debugger": "warn",
+    "no-unreachable": "warn",
+
+    // Possible Errors //
+    //-----------------//
+    "no-unsafe-negation": "error",
+
+
+    // Best Practices //
+    //----------------//
+    "curly": "error",
+    "default-case": "warn",
+    "dot-notation": ["error", { "allowKeywords": false }],
+    "guard-for-in": "warn",
+    "no-alert": "error",
+    "no-caller": "error",
+    "no-div-regex": "warn",
+    "no-eval": "error",
+    "no-extend-native": "error",
+    "no-extra-bind": "error",
+    "no-floating-decimal": "error",
+    "no-implied-eval": "error",
+    "no-iterator": "error",
+    "no-labels": "error",
+    "no-lone-blocks": "error",
+    "no-loop-func": "error",
+    "no-multi-spaces": "error",
+    "no-multi-str": "warn",
+    "no-global-assign": "error",
+    "no-new": "error",
+    "no-new-func": "error",
+    "no-new-wrappers": "error",
+    "no-octal-escape": "error",
+    "no-process-env": "error",
+    "no-proto": "error",
+    "no-return-assign": "error",
+    "no-script-url": "error",
+    "no-self-compare": "error",
+    "no-sequences": "error",
+    "no-throw-literal": "error",
+    "no-unused-expressions": "error",
+    "no-warning-comments": "warn",
+    "no-with": "error",
+    "radix": "error",
+    "wrap-iife": "error",
+
+
+    // Variables //
+    //-----------//
+    "no-catch-shadow": "error",
+    "no-label-var": "error",
+    "no-shadow-restricted-names": "error",
+    "no-undef-init": "error",
+    "no-use-before-define": ["error", "nofunc"],
+
+
+    // Stylistic Issues //
+    //------------------//
+    "comma-dangle": ["error", "never"],
+    "quote-props": ["error", "as-needed", { "keywords": true, "unnecessary": false }],
+    "brace-style": ["error", "1tbs", { "allowSingleLine": true }],
+    "camelcase": "error",
+    "comma-spacing": ["error", { "before": false, "after": true }],
+    "comma-style": ["error", "last"],
+    "consistent-this": ["warn", "self"],
+    "eol-last": "error",
+    "func-style": ["error", "declaration"],
+    "key-spacing": ["error", {
+      "beforeColon": false,
+      "afterColon": true
+    }],
+    "new-cap": "error",
+    "new-parens": "error",
+    "no-array-constructor": "error",
+    "no-lonely-if": "error",
+    "no-mixed-spaces-and-tabs": "error",
+    "no-nested-ternary": "warn",
+    "no-new-object": "error",
+    "no-spaced-func": "error",
+    "no-trailing-spaces": "error",
+    "no-extra-parens": ["error", "functions"],
+    "quotes": ["error", "single", "avoid-escape"],
+    "semi": "error",
+    "semi-spacing": ["error", { "before": false, "after": true }],
+    "keyword-spacing": "error",
+    "space-before-blocks": ["error", "always"],
+    "space-before-function-paren": ["error", { "anonymous": "never", "named": "never" }],
+    "space-in-parens": ["error", "never"],
+    "space-infix-ops": "error",
+    "space-unary-ops": "error",
+    "spaced-comment": ["error", "always", { "markers": [","] }],
+    "wrap-regex": "warn",
+
+    // ECMAScript 6 //
+    //--------------//
+    "no-var": "warn"
+  },
+  "parserOptions": {
+    "sourceType": "module"
+  }
+}
@@ -10,3 +10,6 @@ node_modules
 *.sublime-workspace
 npm-debug.log
 sauce_connect.log*
+/.idea/
+/*.iml
+/yarn-error-log
@@ -1,25 +0,0 @@
-.DS_Store
-.gitignore
-.rvmrc
-.eslintrc
-.travis.yml
-.rspec
-Gemfile
-Gemfile.lock
-Rakefile
-Gruntfile.js
-*.gemspec
-*.nuspec
-*.log
-bench/*
-configurations/*
-components/*
-coverage/*
-dist/cdnjs/*
-dist/components/*
-spec/*
-src/*
-tasks/*
-tmp/*
-publish/*
-vendor/*
@@ -13,12 +13,11 @@ env:
  - secure: Nm4AgSfsgNB21kgKrF9Tl7qVZU8YYREhouQunFracTcZZh2NZ2XH5aHuSiXCj88B13Cr/jGbJKsZ4T3QS3wWYtz6lkyVOx3H3iI+TMtqhD9RM3a7A4O+4vVN8IioB2YjhEu0OKjwgX5gp+0uF+pLEi7Hpj6fupD3AbbL5uYcKg8=
 matrix:
  include:
-  - node_js: '5'
+  - node_js: '10'
    env:
    - PUBLISH=true
    - secure: pLTzghtVll9yGKJI0AaB0uI8GypfWxLTaIB0ZL8//yN3nAEIKMhf/RRilYTsn/rKj2NUa7vt2edYILi3lttOUlCBOwTc9amiRms1W8Lwr/3IdWPeBLvLuH1zNJRm2lBAwU4LBSqaOwhGaxOQr6KHTnWudhNhgOucxpZfvfI/dFw=
    - secure: yERYCf7AwL11D9uMtacly/THGV8BlzsMmrt+iQVvGA3GaY6QMmfYqf6P6cCH98sH5etd1Y+1e6YrPeMjqI6lyRllT7FptoyOdHulazQe86VQN4sc0EpqMlH088kB7gGjTut9Z+X9ViooT5XEh9WA5jXEI9pXhQJNoIHkWPuwGuY=
-  - node_js: '4'
 cache:
  directories:
  - node_modules
@@ -10,6 +10,12 @@ Pull requests containing only failing tests demonstrating the issue are welcomed

 Documentation issues on the handlebarsjs.com site should be reported on [handlebars-site](https://github.com/wycats/handlebars-site).

+## Branches
+
+* The branch `4.x` contains the currently released version. Bugfixes should be made in this branch.
+* The branch `master` contains the next version. A release date is not yet specified. Maintainers
+  should merge the branch `4.x` into the master branch regularly.
+
 ## Pull Requests

 We also accept [pull requests][pull-request]!
@@ -96,4 +102,4 @@ After this point the handlebars site needs to be updated to point to the new ver
 [generator-release]: https://github.com/walmartlabs/generator-release
 [pull-request]: https://github.com/wycats/handlebars.js/pull/new/master
 [issue]: https://github.com/wycats/handlebars.js/issues/new
-[jsfiddle]: https://jsfiddle.net/9D88g/113/
+[jsfiddle]: https://jsfiddle.net/9D88g/180/
@@ -166,8 +166,8 @@ module.exports = function(grunt) {
          browsers: [
            {browserName: 'chrome'},
            {browserName: 'firefox', platform: 'Linux'},
-            {browserName: 'safari', version: 9, platform: 'OS X 10.11'},
-            {browserName: 'safari', version: 8, platform: 'OS X 10.10'},
+            // {browserName: 'safari', version: 9, platform: 'OS X 10.11'},
+            // {browserName: 'safari', version: 8, platform: 'OS X 10.10'},
            {browserName: 'internet explorer', version: 11, platform: 'Windows 8.1'},
            {browserName: 'internet explorer', version: 10, platform: 'Windows 8'}
          ]
@@ -1,8 +1,7 @@
 # Test against these versions of Node.js
 environment:
  matrix:
-    - nodejs_version: "4"
-    - nodejs_version: "5"
+    - nodejs_version: "10"

 platform:
  - x64
@@ -5,7 +5,7 @@ module.exports = {
    header: function() {
      return 'Colors';
    },
-    hasItems: true,   // To make things fairer in mustache land due to no `{{if}}` construct on arrays
+    hasItems: true, // To make things fairer in mustache land due to no `{{if}}` construct on arrays
    items: [
      {name: 'red', current: true, url: '#Red'},
      {name: 'green', current: false, url: '#Green'},
@@ -1,6 +1,6 @@
 {
  "name": "handlebars",
-  "version": "4.0.11",
+  "version": "4.0.14",
  "main": "handlebars.js",
  "license": "MIT",
  "dependencies": {}
@@ -2,7 +2,7 @@
 <package>
 	<metadata>
 		<id>handlebars.js</id>
-		<version>4.0.11</version>
+		<version>4.0.14</version>
 		<authors>handlebars.js Authors</authors>
 		<licenseUrl>https://github.com/wycats/handlebars.js/blob/master/LICENSE</licenseUrl>
 		<projectUrl>https://github.com/wycats/handlebars.js/</projectUrl>
@@ -0,0 +1,19 @@
+{
+  "version": "4.0.11",
+  "license": "MIT",
+  "jspm": {
+    "main": "handlebars",
+    "shim": {
+      "handlebars": {
+        "exports": "Handlebars"
+      }
+    },
+    "files": [
+      "handlebars.js",
+      "handlebars.runtime.js"
+    ],
+    "buildConfig": {
+      "minify": true
+    }
+  }
+}
@@ -4,7 +4,7 @@ import {registerDefaultHelpers} from './helpers';
 import {registerDefaultDecorators} from './decorators';
 import logger from './logger';

-export const VERSION = '4.0.11';
+export const VERSION = '4.0.14';
 export const COMPILER_REVISION = 7;

 export const REVISION_CHANGES = {
@@ -118,7 +118,7 @@ CodeGen.prototype = {
      .replace(/"/g, '\\"')
      .replace(/\n/g, '\\n')
      .replace(/\r/g, '\\r')
-      .replace(/\u2028/g, '\\u2028')   // Per Ecma-262 7.3 + 7.8.4
+      .replace(/\u2028/g, '\\u2028') // Per Ecma-262 7.3 + 7.8.4
      .replace(/\u2029/g, '\\u2029') + '"';
  },

@@ -67,11 +67,11 @@ Compiler.prototype = {
      'lookup': true
    };
    if (knownHelpers) {
+      // the next line should use "Object.keys", but the code has been like this a long time and changing it, might
+      // cause backwards-compatibility issues... It's an old library...
+      // eslint-disable-next-line guard-for-in
      for (let name in knownHelpers) {
-        /* istanbul ignore else */
-        if (name in knownHelpers) {
          this.options.knownHelpers[name] = knownHelpers[name];
-        }
      }
    }

@@ -38,7 +38,7 @@ export function stripFlags(open, close) {
 }

 export function stripComment(comment) {
-  return comment.replace(/^\{\{~?\!-?-?/, '')
+  return comment.replace(/^\{\{~?!-?-?/, '')
                .replace(/-?-?~?\}\}$/, '');
 }

@@ -47,8 +47,7 @@ export function preparePath(data, parts, loc) {

  let original = data ? '@' : '',
      dig = [],
-      depth = 0,
-      depthString = '';
+      depth = 0;

  for (let i = 0, l = parts.length; i < l; i++) {
    let part = parts[i].part,
@@ -62,7 +61,6 @@ export function preparePath(data, parts, loc) {
        throw new Exception('Invalid path: ' + original, {loc});
      } else if (part === '..') {
        depth++;
-        depthString += '../';
      }
    } else {
      dig.push(part);
@@ -13,6 +13,9 @@ JavaScriptCompiler.prototype = {
  // PUBLIC API: You can override these methods in a subclass to provide
  // alternative compiled forms for name lookup and buffering semantics
  nameLookup: function(parent, name/* , type*/) {
+    if (name === 'constructor') {
+      return ['(', parent, '.propertyIsEnumerable(\'constructor\') ? ', parent, '.constructor : undefined', ')'];
+    }
    if (JavaScriptCompiler.isValidJavaScriptVariableName(name)) {
      return [parent, '.', name];
    } else {
@@ -133,7 +136,7 @@ JavaScriptCompiler.prototype = {
      };

      if (this.decorators) {
-        ret.main_d = this.decorators;   // eslint-disable-line camelcase
+        ret.main_d = this.decorators; // eslint-disable-line camelcase
        ret.useDecorators = true;
      }

@@ -209,7 +212,7 @@ JavaScriptCompiler.prototype = {
    // aliases will not be used, but this case is already being run on the client and
    // we aren't concern about minimizing the template size.
    let aliasCount = 0;
-    for (let alias in this.aliases) {    // eslint-disable-line guard-for-in
+    for (let alias in this.aliases) { // eslint-disable-line guard-for-in
      let node = this.aliases[alias];

      if (this.aliases.hasOwnProperty(alias) && node.children && node.referenceCount > 1) {
@@ -776,12 +779,12 @@ JavaScriptCompiler.prototype = {

    for (let i = 0, l = children.length; i < l; i++) {
      child = children[i];
-      compiler = new this.compiler();    // eslint-disable-line new-cap
+      compiler = new this.compiler(); // eslint-disable-line new-cap

      let existing = this.matchExistingProgram(child);

      if (existing == null) {
-        this.context.programs.push('');     // Placeholder to prevent name conflicts for nested children
+        this.context.programs.push(''); // Placeholder to prevent name conflicts for nested children
        let index = this.context.programs.length;
        child.index = index;
        child.name = 'program' + index;
@@ -1,5 +1,11 @@
 export default function(instance) {
  instance.registerHelper('lookup', function(obj, field) {
-    return obj && obj[field];
+    if (!obj) {
+      return obj;
+    }
+    if (field === 'constructor' && !obj.propertyIsEnumerable(field)) {
+      return undefined;
+    }
+    return obj[field];
  });
 }
@@ -24,10 +24,10 @@ let logger = {

    if (typeof console !== 'undefined' && logger.lookupLevel(logger.level) <= level) {
      let method = logger.methodMap[level];
-      if (!console[method]) {   // eslint-disable-line no-console
+      if (!console[method]) { // eslint-disable-line no-console
        method = 'log';
      }
-      console[method](...message);    // eslint-disable-line no-console
+      console[method](...message); // eslint-disable-line no-console
    }
  }
 };
@@ -60,7 +60,7 @@ function loadStrings(opts, callback) {

 function loadFiles(opts, callback) {
  // Build file extension pattern
-  let extension = (opts.extension || 'handlebars').replace(/[\\^$*+?.():=!|{}\-\[\]]/g, function(arg) { return '\\' + arg; });
+  let extension = (opts.extension || 'handlebars').replace(/[\\^$*+?.():=!|{}\-[\]]/g, function(arg) { return '\\' + arg; });
  extension = new RegExp('\\.' + extension + '$');

  let ret = [],
@@ -290,8 +290,9 @@ function minify(output, sourceMapFile) {
    return output;
  }
  return require('uglify-js').minify(output.code, {
-    fromString: true,
-    outSourceMap: sourceMapFile,
-    inSourceMap: JSON.parse(output.map)
+    sourceMap: {
+      content: output.map,
+      url: sourceMapFile
+    }
  });
 }
@@ -1,7 +1,7 @@
 {
  "name": "handlebars",
  "barename": "handlebars",
-  "version": "4.0.11",
+  "version": "4.0.14",
  "description": "Handlebars provides the power necessary to let you build semantic templates effectively with no frustration",
  "homepage": "http://www.handlebarsjs.com/",
  "keywords": [
@@ -10,6 +10,9 @@
    "template",
    "html"
  ],
+  "publishConfig": {
+    "tag": "4.0-patch"
+  },
  "repository": {
    "type": "git",
    "url": "https://github.com/wycats/handlebars.js.git"
@@ -21,12 +24,12 @@
    "node": ">=0.4.7"
  },
  "dependencies": {
-    "async": "^1.4.0",
+    "async": "^2.5.0",
    "optimist": "^0.6.1",
-    "source-map": "^0.4.4"
+    "source-map": "^0.6.1"
  },
  "optionalDependencies": {
-    "uglify-js": "^2.6"
+    "uglify-js": "^3.1.4"
  },
  "devDependencies": {
    "aws-sdk": "^2.1.49",
@@ -35,22 +38,22 @@
    "benchmark": "~1.0",
    "dustjs-linkedin": "^2.0.2",
    "eco": "~1.1.0-rc-3",
-    "grunt": "~0.4.1",
+    "grunt": "^1.0.3",
    "grunt-babel": "^5.0.0",
-    "grunt-cli": "~0.1.10",
-    "grunt-contrib-clean": "0.x",
-    "grunt-contrib-concat": "0.x",
-    "grunt-contrib-connect": "0.x",
-    "grunt-contrib-copy": "0.x",
-    "grunt-contrib-requirejs": "0.x",
-    "grunt-contrib-uglify": "0.x",
-    "grunt-contrib-watch": "0.x",
-    "grunt-eslint": "^17.1.0",
+    "grunt-cli": "^1",
+    "grunt-contrib-clean": "^1",
+    "grunt-contrib-concat": "^1",
+    "grunt-contrib-connect": "^1",
+    "grunt-contrib-copy": "^1",
+    "grunt-contrib-requirejs": "^1",
+    "grunt-contrib-uglify": "^1",
+    "grunt-contrib-watch": "^1.1.0",
+    "grunt-eslint": "^20.1.0",
    "grunt-saucelabs": "8.x",
    "grunt-webpack": "^1.0.8",
    "istanbul": "^0.3.0",
    "jison": "~0.3.0",
-    "mocha": "~1.20.0",
+    "mocha": "^5",
    "mock-stdin": "^0.3.0",
    "mustache": "^2.1.3",
    "semver": "^5.0.1",
@@ -73,5 +76,15 @@
    "buildConfig": {
      "minify": true
    }
-  }
+  },
+  "files": [
+    "bin",
+    "dist/*.js",
+    "dist/amd/**/*.js",
+    "dist/cjs/**/*.js",
+    "lib",
+    "print-script",
+    "release-notes.md",
+    "runtime.js"
+  ]
 }
@@ -2,24 +2,169 @@

 ## Development

-[Commits](https://github.com/wycats/handlebars.js/compare/v4.0.11...master)
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.0.14...master)
+
+## v4.0.14 - April 13th, 2019
+Chore/Test:
+- test: remove safari from saucelabs - 871accc
+
+Bugfixes: 
+- fix: prevent RCE through the "lookup"-helper - cd38583
+
+Compatibility notes:
+
+Access to the constructor of a class thought `{{lookup obj "constructor" }}` is now prohibited. This closes 
+a leak that only half closed in versions 4.0.13 and 4.1.0, but it is a slight incompatibility.
+
+This kind of access is not the intended use of Handlebars and leads to the vulnerability described
+in #1495. We will **not** increase the major version, because such use is not intended or documented, 
+and because of the potential impact of the issue (we fear that most people won't use a new major version
+and the issue may not be resolved on many systems). 
+
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.0.13...v4.0.14)
+
+## v4.0.13 - February 7th, 2019
+New Features
+
+- none
+
+Security fixes:
+
+- disallow access to the constructor in templates to prevent RCE - 42841c4, #1495
+
+Housekeeping
+
+- chore: fix components/handlebars package.json and auto-update on release - bacd473
+- chore: Use node 10 to build handlebars - 78dd89c
+
+Compatibility notes:
+
+Access to class constructors (i.e. `({}).constructor`) is now prohibited to prevent
+Remote Code Execution. This means that following construct will no work anymore:
+
+```
+class SomeClass {
+}
+
+SomeClass.staticProperty = 'static'
+
+var template = Handlebars.compile('{{constructor.staticProperty}}');
+document.getElementById('output').innerHTML = template(new SomeClass());
+// expected: 'static', but now this is empty.
+```
+
+This kind of access is not the intended use of Handlebars and leads to the vulnerability described in #1495. We will **not** increase the major version, because such use is not intended or documented, and because of the potential impact of the issue (we fear that most people won't use a new major version and the issue may not be resolved on many systems).
+
+
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.0.12...v4.1.0)
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.0.12...v4.0.13)
+
+## v4.0.12 - September 4th, 2018
+New features:
+
+- none
+
+Various dependency updates
+
+- [#1464](https://github.com/wycats/handlebars.js/pull/1464) - Bump versions of grunt-plugins to 1.x
+- [#1398](https://github.com/wycats/handlebars.js/pull/1398) - Chore: updated various dev dependencies
+- upgrade uglify-js - d3d3942
+- Update grunt-eslint to 20.1.0 - 7729aa9
+- Update dependencies "async" to 2.5.0 and "source-map" to 0.6.1 (73d5637)
+
+Bugfixes:
+
+- [components/handlebars.js#24](https://github.com/components/handlebars.js#24) Add package.json to components shim
+- Updated `source-map`-package should work better with `rollup`[#1463](https://github.com/wycats/handlebars.js/issues/1463)
+
+Removed obsolete code:
+
+- unnecessary check - 0ddff8b
+- Use `files` field - 69c6ca5
+- Update jsfiddle to 4.0.11 - 8947dd0
+
+Compatibility notes:
+- No compatibility issues are to be expected
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.0.12...v4.0.12)
+
+## v4.0.12 - September 4th, 2018
+New features:
+
+- none
+
+Various dependency updates
+
+- [#1464](https://github.com/wycats/handlebars.js/pull/1464) - Bump versions of grunt-plugins to 1.x
+- [#1398](https://github.com/wycats/handlebars.js/pull/1398) - Chore: updated various dev dependencies
+- upgrade uglify-js - d3d3942
+- Update grunt-eslint to 20.1.0 - 7729aa9
+- Update dependencies "async" to 2.5.0 and "source-map" to 0.6.1 (73d5637)
+
+Bugfixes:
+
+- [components/handlebars.js#24](https://github.com/components/handlebars.js#24) Add package.json to components shim
+- Updated `source-map`-package should work better with `rollup`[#1463](https://github.com/wycats/handlebars.js/issues/1463)
+
+Removed obsolete code:
+
+- unnecessary check - 0ddff8b
+- Use `files` field - 69c6ca5
+- Update jsfiddle to 4.0.11 - 8947dd0
+
+Compatibility notes:
+- No compatibility issues are to be expected
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.0.12...v4.0.12)
+
+## v4.0.12 - September 4th, 2018
+New features:
+
+- none
+
+Various dependency updates
+
+- [#1464](https://github.com/wycats/handlebars.js/pull/1464) - Bump versions of grunt-plugins to 1.x
+- [#1398](https://github.com/wycats/handlebars.js/pull/1398) - Chore: updated various dev dependencies
+- upgrade uglify-js - d3d3942
+- Update grunt-eslint to 20.1.0 - 7729aa9
+- Update dependencies "async" to 2.5.0 and "source-map" to 0.6.1 (73d5637)
+
+Bugfixes:
+
+- [components/handlebars.js#24](https://github.com/components/handlebars.js#24) Add package.json to components shim
+- Updated `source-map`-package should work better with `rollup`[#1463](https://github.com/wycats/handlebars.js/issues/1463)
+
+Removed obsolete code:
+
+- unnecessary check - 0ddff8b
+- Use `files` field - 69c6ca5
+- Update jsfiddle to 4.0.11 - 8947dd0
+
+Compatibility notes:
+- No compatibility issues are to be expected
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.0.11...v4.0.12)

 ## v4.0.11 - October 17th, 2017
- [#1391](https://github.com/wycats/handlebars.js/issues/1391) - `uglify-js` is unconditionally imported, but only listed as optional dependency ([@Turbo87](https://api.github.com/users/Turbo87))
- [#1233](https://github.com/wycats/handlebars.js/issues/1233) - Unable to build under windows - error at test:bin task ([@blikblum](https://api.github.com/users/blikblum))
+- [#1391](https://github.com/wycats/handlebars.js/issues/1391) - `uglify-js` is unconditionally imported, but only listed as optional dependency ([@Turbo87](https://github.com/Turbo87))
+- [#1233](https://github.com/wycats/handlebars.js/issues/1233) - Unable to build under windows - error at test:bin task ([@blikblum](https://github.com/blikblum))
 - Update (C) year in the LICENSE file - 21386b6

 Compatibility notes:
 - This is a bugfix release. There are no breaking change and no new features.

-[Commits](https://github.com/nknapp/handlebars.js/compare/v4.0.10...v4.0.11)
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.0.10...v4.0.11)

 ## v4.0.10 - May 21st, 2017
 - Fix regression in 4.0.9: Replace "Object.assign" (not support in IE) by "util/extend" - 0e953d1



-[Commits](https://github.com/nknapp/handlebars.js/compare/v4.0.9...v4.0.10)
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.0.9...v4.0.10)

 ## v4.0.9 - May 21st, 2017

@@ -36,7 +181,7 @@ Compatibility notes:
 Compatibility notes:
 - No compatibility issues are expected.

-[Commits](https://github.com/nknapp/handlebars.js/compare/v4.0.8...v4.0.9)
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.0.8...v4.0.9)

 ## v4.0.8 - May 2nd, 2017
 - [#1341](https://github.com/wycats/handlebars.js/issues/1341) [#1342](https://github.com/wycats/handlebars.js/issues/1342) Allow partial-blocks to be executed without "options" ([@nknapp](https://github.com/nknapp)) - a00c598
@@ -44,7 +189,7 @@ Compatibility notes:
 Compatibility notes:
 - No breaking changes

-[Commits](https://github.com/nknapp/handlebars.js/compare/v4.0.7...v4.0.8)
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.0.7...v4.0.8)

 ## v4.0.7 - April 29th, 2017
 - [#1319](https://github.com/wycats/handlebars.js/issues/1319): Fix context-stack when calling block-helpers on null values ([@nknapp](https://github.com/nknapp)) - c8f4b57
@@ -80,8 +225,8 @@ Compatibility notes:
 [Commits](https://github.com/wycats/handlebars.js/compare/v4.0.5...v4.0.6)

 ## v4.0.5 - November 19th, 2015
- [#1132](https://github.com/wycats/handlebars.js/pull/1132) - Update uglify-js to avoid vulnerability ([@plynchnlm](https://api.github.com/users/plynchnlm))
- [#1129](https://github.com/wycats/handlebars.js/issues/1129) - Minified lib returns an empty string ([@bricss](https://api.github.com/users/bricss))
+- [#1132](https://github.com/wycats/handlebars.js/pull/1132) - Update uglify-js to avoid vulnerability ([@plynchnlm](https://github.com/plynchnlm))
+- [#1129](https://github.com/wycats/handlebars.js/issues/1129) - Minified lib returns an empty string ([@bricss](https://github.com/bricss))
 - Return current handlebars instance from noConflict - 685cf92
 - Add webpack to dev dependency to support npm 3 - 7a6c228
 - Further relax uglify dependency - 0a3b3c2
@@ -92,17 +237,17 @@ Compatibility notes:
 [Commits](https://github.com/wycats/handlebars.js/compare/v4.0.4...v4.0.5)

 ## v4.0.4 - October 29th, 2015
- [#1121](https://github.com/wycats/handlebars.js/pull/1121) - Include partial name in 'undefined partial' exception message ([@shinypb](https://api.github.com/users/shinypb))
- [#1125](https://github.com/wycats/handlebars.js/pull/1125) - Add promised-handlebars to "in-the-wild"-list ([@nknapp](https://api.github.com/users/nknapp))
+- [#1121](https://github.com/wycats/handlebars.js/pull/1121) - Include partial name in 'undefined partial' exception message ([@shinypb](https://github.com/shinypb))
+- [#1125](https://github.com/wycats/handlebars.js/pull/1125) - Add promised-handlebars to "in-the-wild"-list ([@nknapp](https://github.com/nknapp))

 [Commits](https://github.com/wycats/handlebars.js/compare/v4.0.3...v4.0.4)

 ## v4.0.3 - September 23rd, 2015
- [#1099](https://github.com/wycats/handlebars.js/issues/1099) - @partial-block is overridden ([@btmorex](https://api.github.com/users/btmorex))
- [#1093](https://github.com/wycats/handlebars.js/issues/1093) - #each skips iteration on undefined values ([@florianpilz](https://api.github.com/users/florianpilz))
- [#1092](https://github.com/wycats/handlebars.js/issues/1092) - Square braces in key name ([@distantnative](https://api.github.com/users/distantnative))
- [#1091](https://github.com/wycats/handlebars.js/pull/1091) - fix typo in release notes ([@nikolas](https://api.github.com/users/nikolas))
- [#1090](https://github.com/wycats/handlebars.js/pull/1090) - grammar fixes in 4.0.0 release notes ([@nikolas](https://api.github.com/users/nikolas))
+- [#1099](https://github.com/wycats/handlebars.js/issues/1099) - @partial-block is overridden ([@btmorex](https://github.com/btmorex))
+- [#1093](https://github.com/wycats/handlebars.js/issues/1093) - #each skips iteration on undefined values ([@florianpilz](https://github.com/florianpilz))
+- [#1092](https://github.com/wycats/handlebars.js/issues/1092) - Square braces in key name ([@distantnative](https://github.com/distantnative))
+- [#1091](https://github.com/wycats/handlebars.js/pull/1091) - fix typo in release notes ([@nikolas](https://github.com/nikolas))
+- [#1090](https://github.com/wycats/handlebars.js/pull/1090) - grammar fixes in 4.0.0 release notes ([@nikolas](https://github.com/nikolas))

 Compatibility notes:
 - `each` iteration with `undefined` values has been restored to the 3.0 behaviors. Helper calls with undefined context values will now execute against an arbitrary empty object to avoid executing against global object in non-strict mode.
@@ -111,7 +256,7 @@ Compatibility notes:
 [Commits](https://github.com/wycats/handlebars.js/compare/v4.0.2...v4.0.3)

 ## v4.0.2 - September 4th, 2015
- [#1089](https://github.com/wycats/handlebars.js/issues/1089) - "Failover content" not working in multiple levels of inline partials ([@michaellopez](https://api.github.com/users/michaellopez))
+- [#1089](https://github.com/wycats/handlebars.js/issues/1089) - "Failover content" not working in multiple levels of inline partials ([@michaellopez](https://github.com/michaellopez))

 [Commits](https://github.com/wycats/handlebars.js/compare/v4.0.1...v4.0.2)

@@ -121,17 +266,17 @@ Compatibility notes:
 [Commits](https://github.com/wycats/handlebars.js/compare/v4.0.0...v4.0.1)

 ## v4.0.0 - September 1st, 2015
- [#1082](https://github.com/wycats/handlebars.js/pull/1082) - Decorators and Inline Partials ([@kpdecker](https://api.github.com/users/kpdecker))
- [#1076](https://github.com/wycats/handlebars.js/pull/1076) - Implement partial blocks ([@kpdecker](https://api.github.com/users/kpdecker))
- [#1087](https://github.com/wycats/handlebars.js/pull/1087) - Fix #each when last object entry has empty key ([@denniskuczynski](https://api.github.com/users/denniskuczynski))
- [#1084](https://github.com/wycats/handlebars.js/pull/1084) - Bump uglify version to fix vulnerability ([@John-Steidley](https://api.github.com/users/John-Steidley))
- [#1068](https://github.com/wycats/handlebars.js/pull/1068) - Fix typo ([@0xack13](https://api.github.com/users/0xack13))
- [#1060](https://github.com/wycats/handlebars.js/pull/1060) - #1056 Fixed grammar for nested raw blocks ([@ericbn](https://api.github.com/users/ericbn))
- [#1052](https://github.com/wycats/handlebars.js/pull/1052) - Updated year in License ([@maqnouch](https://api.github.com/users/maqnouch))
- [#1037](https://github.com/wycats/handlebars.js/pull/1037) - Fix minor typos in README ([@tomxtobin](https://api.github.com/users/tomxtobin))
- [#1032](https://github.com/wycats/handlebars.js/issues/1032) - Is it possible to render a partial without the parent scope? ([@aputinski](https://api.github.com/users/aputinski))
- [#1019](https://github.com/wycats/handlebars.js/pull/1019) - Fixes typo in tests ([@aymerick](https://api.github.com/users/aymerick))
- [#1016](https://github.com/wycats/handlebars.js/issues/1016) - Version mis-match ([@mayankdedhia](https://api.github.com/users/mayankdedhia))
+- [#1082](https://github.com/wycats/handlebars.js/pull/1082) - Decorators and Inline Partials ([@kpdecker](https://github.com/kpdecker))
+- [#1076](https://github.com/wycats/handlebars.js/pull/1076) - Implement partial blocks ([@kpdecker](https://github.com/kpdecker))
+- [#1087](https://github.com/wycats/handlebars.js/pull/1087) - Fix #each when last object entry has empty key ([@denniskuczynski](https://github.com/denniskuczynski))
+- [#1084](https://github.com/wycats/handlebars.js/pull/1084) - Bump uglify version to fix vulnerability ([@John-Steidley](https://github.com/John-Steidley))
+- [#1068](https://github.com/wycats/handlebars.js/pull/1068) - Fix typo ([@0xack13](https://github.com/0xack13))
+- [#1060](https://github.com/wycats/handlebars.js/pull/1060) - #1056 Fixed grammar for nested raw blocks ([@ericbn](https://github.com/ericbn))
+- [#1052](https://github.com/wycats/handlebars.js/pull/1052) - Updated year in License ([@maqnouch](https://github.com/maqnouch))
+- [#1037](https://github.com/wycats/handlebars.js/pull/1037) - Fix minor typos in README ([@tomxtobin](https://github.com/tomxtobin))
+- [#1032](https://github.com/wycats/handlebars.js/issues/1032) - Is it possible to render a partial without the parent scope? ([@aputinski](https://github.com/aputinski))
+- [#1019](https://github.com/wycats/handlebars.js/pull/1019) - Fixes typo in tests ([@aymerick](https://github.com/aymerick))
+- [#1016](https://github.com/wycats/handlebars.js/issues/1016) - Version mis-match ([@mayankdedhia](https://github.com/mayankdedhia))
 - [#1023](https://github.com/wycats/handlebars.js/issues/1023) - is it possible for nested custom helpers to communicate between each other?
 - [#893](https://github.com/wycats/handlebars.js/issues/893) - [Proposal] Section blocks.
 - [#792](https://github.com/wycats/handlebars.js/issues/792) - feature request: inline partial definitions
@@ -164,55 +309,55 @@ Compatibility notes:
 [Commits](https://github.com/wycats/handlebars.js/compare/v3.0.3...v4.0.0)

 ## v3.0.3 - April 28th, 2015
- [#1004](https://github.com/wycats/handlebars.js/issues/1004) - Latest version breaks with RequireJS (global is undefined) ([@boskee](https://api.github.com/users/boskee))
+- [#1004](https://github.com/wycats/handlebars.js/issues/1004) - Latest version breaks with RequireJS (global is undefined) ([@boskee](https://github.com/boskee))

 [Commits](https://github.com/wycats/handlebars.js/compare/v3.0.2...v3.0.3)

 ## v3.0.2 - April 20th, 2015
- [#998](https://github.com/wycats/handlebars.js/pull/998) - Add full support for es6 ([@kpdecker](https://api.github.com/users/kpdecker))
- [#994](https://github.com/wycats/handlebars.js/issues/994) - Access Handlebars.Visitor in browser ([@tamlyn](https://api.github.com/users/tamlyn))
- [#990](https://github.com/wycats/handlebars.js/issues/990) - Allow passing null/undefined literals subexpressions ([@blimmer](https://api.github.com/users/blimmer))
- [#989](https://github.com/wycats/handlebars.js/issues/989) - Source-map error with requirejs ([@SteppeEagle](https://api.github.com/users/SteppeEagle))
- [#967](https://github.com/wycats/handlebars.js/issues/967) - can't access "this" property  ([@75lb](https://api.github.com/users/75lb))
+- [#998](https://github.com/wycats/handlebars.js/pull/998) - Add full support for es6 ([@kpdecker](https://github.com/kpdecker))
+- [#994](https://github.com/wycats/handlebars.js/issues/994) - Access Handlebars.Visitor in browser ([@tamlyn](https://github.com/tamlyn))
+- [#990](https://github.com/wycats/handlebars.js/issues/990) - Allow passing null/undefined literals subexpressions ([@blimmer](https://github.com/blimmer))
+- [#989](https://github.com/wycats/handlebars.js/issues/989) - Source-map error with requirejs ([@SteppeEagle](https://github.com/SteppeEagle))
+- [#967](https://github.com/wycats/handlebars.js/issues/967) - can't access "this" property  ([@75lb](https://github.com/75lb))
 - Use captureStackTrace for error handler - a009a97
 - Ignore branches tested without coverage monitoring - 37a664b

 [Commits](https://github.com/wycats/handlebars.js/compare/v3.0.1...v3.0.2)

 ## v3.0.1 - March 24th, 2015
- [#984](https://github.com/wycats/handlebars.js/pull/984) - Adding documentation for passing arguments into partials ([@johneke](https://api.github.com/users/johneke))
- [#973](https://github.com/wycats/handlebars.js/issues/973) - version 3 is slower than version 2 ([@elover](https://api.github.com/users/elover))
- [#966](https://github.com/wycats/handlebars.js/issues/966) - "handlebars --version" does not work with v3.0.0 ([@abloomston](https://api.github.com/users/abloomston))
- [#964](https://github.com/wycats/handlebars.js/pull/964) - default is a reserved word ([@grassick](https://api.github.com/users/grassick))
- [#962](https://github.com/wycats/handlebars.js/pull/962) - Add dashbars' link on README. ([@pismute](https://api.github.com/users/pismute))
+- [#984](https://github.com/wycats/handlebars.js/pull/984) - Adding documentation for passing arguments into partials ([@johneke](https://github.com/johneke))
+- [#973](https://github.com/wycats/handlebars.js/issues/973) - version 3 is slower than version 2 ([@elover](https://github.com/elover))
+- [#966](https://github.com/wycats/handlebars.js/issues/966) - "handlebars --version" does not work with v3.0.0 ([@abloomston](https://github.com/abloomston))
+- [#964](https://github.com/wycats/handlebars.js/pull/964) - default is a reserved word ([@grassick](https://github.com/grassick))
+- [#962](https://github.com/wycats/handlebars.js/pull/962) - Add dashbars' link on README. ([@pismute](https://github.com/pismute))

 [Commits](https://github.com/wycats/handlebars.js/compare/v3.0.0...v3.0.1)

 ## v3.0.0 - February 10th, 2015
- [#941](https://github.com/wycats/handlebars.js/pull/941) - Add support for dynamic partial names ([@kpdecker](https://api.github.com/users/kpdecker))
- [#940](https://github.com/wycats/handlebars.js/pull/940) - Add missing reserved words so compiler knows to use array syntax: ([@mattflaschen](https://api.github.com/users/mattflaschen))
- [#938](https://github.com/wycats/handlebars.js/pull/938) - Fix example using #with helper ([@diwo](https://api.github.com/users/diwo))
- [#930](https://github.com/wycats/handlebars.js/pull/930) - Add parent tracking and mutation to AST visitors ([@kpdecker](https://api.github.com/users/kpdecker))
- [#926](https://github.com/wycats/handlebars.js/issues/926) - Depthed lookups fail when program duplicator runs ([@kpdecker](https://api.github.com/users/kpdecker))
- [#918](https://github.com/wycats/handlebars.js/pull/918) - Add instructions for 'spec/mustache' to CONTRIBUTING.md, fix a few typos ([@oneeman](https://api.github.com/users/oneeman))
- [#915](https://github.com/wycats/handlebars.js/pull/915) - Ast update ([@kpdecker](https://api.github.com/users/kpdecker))
- [#910](https://github.com/wycats/handlebars.js/issues/910) - Different behavior of {{@last}} when {{#each}} in {{#each}} ([@zordius](https://api.github.com/users/zordius))
- [#907](https://github.com/wycats/handlebars.js/issues/907) - Implement named helper variable references ([@kpdecker](https://api.github.com/users/kpdecker))
- [#906](https://github.com/wycats/handlebars.js/pull/906) - Add parser support for block params ([@mmun](https://api.github.com/users/mmun))
- [#903](https://github.com/wycats/handlebars.js/issues/903) - Only provide aliases for multiple use calls ([@kpdecker](https://api.github.com/users/kpdecker))
- [#902](https://github.com/wycats/handlebars.js/pull/902) - Generate Source Maps ([@kpdecker](https://api.github.com/users/kpdecker))
- [#901](https://github.com/wycats/handlebars.js/issues/901) - Still escapes with noEscape enabled on isolated Handlebars environment ([@zedknight](https://api.github.com/users/zedknight))
- [#896](https://github.com/wycats/handlebars.js/pull/896) - Simplify BlockNode by removing intermediate MustacheNode ([@mmun](https://api.github.com/users/mmun))
- [#892](https://github.com/wycats/handlebars.js/pull/892) - Implement parser for else chaining of helpers ([@kpdecker](https://api.github.com/users/kpdecker))
- [#889](https://github.com/wycats/handlebars.js/issues/889) - Consider extensible parser API ([@kpdecker](https://api.github.com/users/kpdecker))
- [#887](https://github.com/wycats/handlebars.js/issues/887) - Handlebars.noConflict() option? ([@bradvogel](https://api.github.com/users/bradvogel))
- [#886](https://github.com/wycats/handlebars.js/issues/886) - Add SafeString to context (or use duck-typing) ([@dominicbarnes](https://api.github.com/users/dominicbarnes))
- [#870](https://github.com/wycats/handlebars.js/pull/870) - Registering undefined partial throws exception. ([@max-b](https://api.github.com/users/max-b))
- [#866](https://github.com/wycats/handlebars.js/issues/866) - comments don't respect whitespace control ([@75lb](https://api.github.com/users/75lb))
- [#863](https://github.com/wycats/handlebars.js/pull/863) - + jsDelivr CDN info ([@tomByrer](https://api.github.com/users/tomByrer))
- [#858](https://github.com/wycats/handlebars.js/issues/858) - Disable new default auto-indent at included partials ([@majodev](https://api.github.com/users/majodev))
- [#856](https://github.com/wycats/handlebars.js/pull/856) - jspm compatibility ([@MajorBreakfast](https://api.github.com/users/MajorBreakfast))
- [#805](https://github.com/wycats/handlebars.js/issues/805) - Request: "strict" lookups ([@nzakas](https://api.github.com/users/nzakas))
+- [#941](https://github.com/wycats/handlebars.js/pull/941) - Add support for dynamic partial names ([@kpdecker](https://github.com/kpdecker))
+- [#940](https://github.com/wycats/handlebars.js/pull/940) - Add missing reserved words so compiler knows to use array syntax: ([@mattflaschen](https://github.com/mattflaschen))
+- [#938](https://github.com/wycats/handlebars.js/pull/938) - Fix example using #with helper ([@diwo](https://github.com/diwo))
+- [#930](https://github.com/wycats/handlebars.js/pull/930) - Add parent tracking and mutation to AST visitors ([@kpdecker](https://github.com/kpdecker))
+- [#926](https://github.com/wycats/handlebars.js/issues/926) - Depthed lookups fail when program duplicator runs ([@kpdecker](https://github.com/kpdecker))
+- [#918](https://github.com/wycats/handlebars.js/pull/918) - Add instructions for 'spec/mustache' to CONTRIBUTING.md, fix a few typos ([@oneeman](https://github.com/oneeman))
+- [#915](https://github.com/wycats/handlebars.js/pull/915) - Ast update ([@kpdecker](https://github.com/kpdecker))
+- [#910](https://github.com/wycats/handlebars.js/issues/910) - Different behavior of {{@last}} when {{#each}} in {{#each}} ([@zordius](https://github.com/zordius))
+- [#907](https://github.com/wycats/handlebars.js/issues/907) - Implement named helper variable references ([@kpdecker](https://github.com/kpdecker))
+- [#906](https://github.com/wycats/handlebars.js/pull/906) - Add parser support for block params ([@mmun](https://github.com/mmun))
+- [#903](https://github.com/wycats/handlebars.js/issues/903) - Only provide aliases for multiple use calls ([@kpdecker](https://github.com/kpdecker))
+- [#902](https://github.com/wycats/handlebars.js/pull/902) - Generate Source Maps ([@kpdecker](https://github.com/kpdecker))
+- [#901](https://github.com/wycats/handlebars.js/issues/901) - Still escapes with noEscape enabled on isolated Handlebars environment ([@zedknight](https://github.com/zedknight))
+- [#896](https://github.com/wycats/handlebars.js/pull/896) - Simplify BlockNode by removing intermediate MustacheNode ([@mmun](https://github.com/mmun))
+- [#892](https://github.com/wycats/handlebars.js/pull/892) - Implement parser for else chaining of helpers ([@kpdecker](https://github.com/kpdecker))
+- [#889](https://github.com/wycats/handlebars.js/issues/889) - Consider extensible parser API ([@kpdecker](https://github.com/kpdecker))
+- [#887](https://github.com/wycats/handlebars.js/issues/887) - Handlebars.noConflict() option? ([@bradvogel](https://github.com/bradvogel))
+- [#886](https://github.com/wycats/handlebars.js/issues/886) - Add SafeString to context (or use duck-typing) ([@dominicbarnes](https://github.com/dominicbarnes))
+- [#870](https://github.com/wycats/handlebars.js/pull/870) - Registering undefined partial throws exception. ([@max-b](https://github.com/max-b))
+- [#866](https://github.com/wycats/handlebars.js/issues/866) - comments don't respect whitespace control ([@75lb](https://github.com/75lb))
+- [#863](https://github.com/wycats/handlebars.js/pull/863) - + jsDelivr CDN info ([@tomByrer](https://github.com/tomByrer))
+- [#858](https://github.com/wycats/handlebars.js/issues/858) - Disable new default auto-indent at included partials ([@majodev](https://github.com/majodev))
+- [#856](https://github.com/wycats/handlebars.js/pull/856) - jspm compatibility ([@MajorBreakfast](https://github.com/MajorBreakfast))
+- [#805](https://github.com/wycats/handlebars.js/issues/805) - Request: "strict" lookups ([@nzakas](https://github.com/nzakas))

 - Export the default object for handlebars/runtime - 5594416
 - Lookup partials when undefined - 617dd57
@@ -246,21 +391,21 @@ New Features:
 [Commits](https://github.com/wycats/handlebars.js/compare/v2.0.0-beta.1...v2.0.0)

 ## v2.0.0-beta.1 - August 26th, 2014
- [#787](https://github.com/wycats/handlebars.js/pull/787) - Remove whitespace surrounding standalone statements ([@kpdecker](https://api.github.com/users/kpdecker))
- [#827](https://github.com/wycats/handlebars.js/issues/827) - Render false literal as “false” ([@scoot557](https://api.github.com/users/scoot557))
- [#767](https://github.com/wycats/handlebars.js/issues/767) - Subexpressions bug with hash and context ([@evensoul](https://api.github.com/users/evensoul))
+- [#787](https://github.com/wycats/handlebars.js/pull/787) - Remove whitespace surrounding standalone statements ([@kpdecker](https://github.com/kpdecker))
+- [#827](https://github.com/wycats/handlebars.js/issues/827) - Render false literal as “false” ([@scoot557](https://github.com/scoot557))
+- [#767](https://github.com/wycats/handlebars.js/issues/767) - Subexpressions bug with hash and context ([@evensoul](https://github.com/evensoul))
 - Changes to 0/undefined handling
-  - [#731](https://github.com/wycats/handlebars.js/pull/731) - Strange behavior for {{#foo}} {{bar}} {{/foo}} when foo is 0 ([@kpdecker](https://api.github.com/users/kpdecker))
-  - [#820](https://github.com/wycats/handlebars.js/issues/820) - strange behavior for {{foo.bar}} when foo is 0 or null or false ([@zordius](https://api.github.com/users/zordius))
-  - [#837](https://github.com/wycats/handlebars.js/issues/837) - Strange input for custom helper ( foo.bar == false when foo is undefined ) ([@zordius](https://api.github.com/users/zordius))
- [#819](https://github.com/wycats/handlebars.js/pull/819) - Implement recursive field lookup ([@kpdecker](https://api.github.com/users/kpdecker))
- [#764](https://github.com/wycats/handlebars.js/issues/764) - This reference not working for helpers ([@kpdecker](https://api.github.com/users/kpdecker))
- [#773](https://github.com/wycats/handlebars.js/issues/773) - Implicit parameters in {{#each}} introduces a peculiarity in helpers calling convention  ([@Bertrand](https://api.github.com/users/Bertrand))
- [#783](https://github.com/wycats/handlebars.js/issues/783) - helperMissing and consistency for different expression types ([@ErisDS](https://api.github.com/users/ErisDS))
- [#795](https://github.com/wycats/handlebars.js/pull/795) - Turn the precompile script into a wrapper around a module. ([@jwietelmann](https://api.github.com/users/jwietelmann))
- [#823](https://github.com/wycats/handlebars.js/pull/823) - Support inverse sections on the with helper ([@dan-manges](https://api.github.com/users/dan-manges))
- [#834](https://github.com/wycats/handlebars.js/pull/834) - Refactor blocks, programs and inverses ([@mmun](https://api.github.com/users/mmun))
- [#852](https://github.com/wycats/handlebars.js/issues/852) - {{foo~}} space control behavior is different from older version ([@zordius](https://api.github.com/users/zordius))
+  - [#731](https://github.com/wycats/handlebars.js/pull/731) - Strange behavior for {{#foo}} {{bar}} {{/foo}} when foo is 0 ([@kpdecker](https://github.com/kpdecker))
+  - [#820](https://github.com/wycats/handlebars.js/issues/820) - strange behavior for {{foo.bar}} when foo is 0 or null or false ([@zordius](https://github.com/zordius))
+  - [#837](https://github.com/wycats/handlebars.js/issues/837) - Strange input for custom helper ( foo.bar == false when foo is undefined ) ([@zordius](https://github.com/zordius))
+- [#819](https://github.com/wycats/handlebars.js/pull/819) - Implement recursive field lookup ([@kpdecker](https://github.com/kpdecker))
+- [#764](https://github.com/wycats/handlebars.js/issues/764) - This reference not working for helpers ([@kpdecker](https://github.com/kpdecker))
+- [#773](https://github.com/wycats/handlebars.js/issues/773) - Implicit parameters in {{#each}} introduces a peculiarity in helpers calling convention  ([@Bertrand](https://github.com/Bertrand))
+- [#783](https://github.com/wycats/handlebars.js/issues/783) - helperMissing and consistency for different expression types ([@ErisDS](https://github.com/ErisDS))
+- [#795](https://github.com/wycats/handlebars.js/pull/795) - Turn the precompile script into a wrapper around a module. ([@jwietelmann](https://github.com/jwietelmann))
+- [#823](https://github.com/wycats/handlebars.js/pull/823) - Support inverse sections on the with helper ([@dan-manges](https://github.com/dan-manges))
+- [#834](https://github.com/wycats/handlebars.js/pull/834) - Refactor blocks, programs and inverses ([@mmun](https://github.com/mmun))
+- [#852](https://github.com/wycats/handlebars.js/issues/852) - {{foo~}} space control behavior is different from older version ([@zordius](https://github.com/zordius))
 - [#835](https://github.com/wycats/handlebars.js/issues/835) - Templates overwritten if file is loaded twice

 - Expose escapeExpression on the root object - 980c38c
@@ -294,18 +439,18 @@ Compatibility notes:
 [Commits](https://github.com/wycats/handlebars.js/compare/v2.0.0-alpha.3...v2.0.0-alpha.4)

 ## v2.0.0-alpha.3 - May 19th, 2014
- [#797](https://github.com/wycats/handlebars.js/pull/797) - Pass full helper ID to helperMissing when options are provided ([@tomdale](https://api.github.com/users/tomdale))
- [#793](https://github.com/wycats/handlebars.js/pull/793) - Ensure isHelper is coerced to a boolean ([@mmun](https://api.github.com/users/mmun))
+- [#797](https://github.com/wycats/handlebars.js/pull/797) - Pass full helper ID to helperMissing when options are provided ([@tomdale](https://github.com/tomdale))
+- [#793](https://github.com/wycats/handlebars.js/pull/793) - Ensure isHelper is coerced to a boolean ([@mmun](https://github.com/mmun))
 - Refactor template init logic - 085e5e1

 [Commits](https://github.com/wycats/handlebars.js/compare/v2.0.0-alpha.2...v2.0.0-alpha.3)

 ## v2.0.0-alpha.2 - March 6th, 2014
- [#756](https://github.com/wycats/handlebars.js/pull/756) - fix bug in IE<=8 (no Array::map), closes #751 ([@jenseng](https://api.github.com/users/jenseng))
- [#749](https://github.com/wycats/handlebars.js/pull/749) - properly handle multiple subexpressions in the same hash, fixes #748 ([@jenseng](https://api.github.com/users/jenseng))
- [#743](https://github.com/wycats/handlebars.js/issues/743) - subexpression confusion/problem? ([@waynedpj](https://api.github.com/users/waynedpj))
- [#746](https://github.com/wycats/handlebars.js/issues/746) - [CLI] support `handlebars --version` ([@apfelbox](https://api.github.com/users/apfelbox))
- [#747](https://github.com/wycats/handlebars.js/pull/747) - updated grunt-saucelabs, failing tests revealed ([@Jonahss](https://api.github.com/users/Jonahss))
+- [#756](https://github.com/wycats/handlebars.js/pull/756) - fix bug in IE<=8 (no Array::map), closes #751 ([@jenseng](https://github.com/jenseng))
+- [#749](https://github.com/wycats/handlebars.js/pull/749) - properly handle multiple subexpressions in the same hash, fixes #748 ([@jenseng](https://github.com/jenseng))
+- [#743](https://github.com/wycats/handlebars.js/issues/743) - subexpression confusion/problem? ([@waynedpj](https://github.com/waynedpj))
+- [#746](https://github.com/wycats/handlebars.js/issues/746) - [CLI] support `handlebars --version` ([@apfelbox](https://github.com/apfelbox))
+- [#747](https://github.com/wycats/handlebars.js/pull/747) - updated grunt-saucelabs, failing tests revealed ([@Jonahss](https://github.com/Jonahss))
 - Make JSON a requirement for the compiler. - 058c0fb
 - Temporarily kill the AWS publish CI step - 8347ee2

@@ -315,26 +460,26 @@ Compatibility notes:
 [Commits](https://github.com/wycats/handlebars.js/compare/v2.0.0-alpha.1...v2.0.0-alpha.2)

 ## v2.0.0-alpha.1 - February 10th, 2014
- [#182](https://github.com/wycats/handlebars.js/pull/182) - Allow passing hash parameters to partials ([@kpdecker](https://api.github.com/users/kpdecker))
- [#392](https://github.com/wycats/handlebars.js/pull/392) - Access to root context in partials and helpers ([@kpdecker](https://api.github.com/users/kpdecker))
- [#472](https://github.com/wycats/handlebars.js/issues/472) - Helpers cannot have decimal parameters ([@kayleg](https://api.github.com/users/kayleg))
- [#569](https://github.com/wycats/handlebars.js/pull/569) - Unable to lookup array values using @index ([@kpdecker](https://api.github.com/users/kpdecker))
- [#491](https://github.com/wycats/handlebars.js/pull/491) - For nested helpers: get the @ variables of the outer helper from the inner one ([@kpdecker](https://api.github.com/users/kpdecker))
- [#669](https://github.com/wycats/handlebars.js/issues/669) - Ability to unregister a helper ([@dbachrach](https://api.github.com/users/dbachrach))
- [#730](https://github.com/wycats/handlebars.js/pull/730) - Raw block helpers ([@kpdecker](https://api.github.com/users/kpdecker))
- [#634](https://github.com/wycats/handlebars.js/pull/634) - It would be great to have the helper name passed to `blockHelperMissing` ([@kpdecker](https://api.github.com/users/kpdecker))
- [#729](https://github.com/wycats/handlebars.js/pull/729) - Convert template spec to object literal ([@kpdecker](https://api.github.com/users/kpdecker))
+- [#182](https://github.com/wycats/handlebars.js/pull/182) - Allow passing hash parameters to partials ([@kpdecker](https://github.com/kpdecker))
+- [#392](https://github.com/wycats/handlebars.js/pull/392) - Access to root context in partials and helpers ([@kpdecker](https://github.com/kpdecker))
+- [#472](https://github.com/wycats/handlebars.js/issues/472) - Helpers cannot have decimal parameters ([@kayleg](https://github.com/kayleg))
+- [#569](https://github.com/wycats/handlebars.js/pull/569) - Unable to lookup array values using @index ([@kpdecker](https://github.com/kpdecker))
+- [#491](https://github.com/wycats/handlebars.js/pull/491) - For nested helpers: get the @ variables of the outer helper from the inner one ([@kpdecker](https://github.com/kpdecker))
+- [#669](https://github.com/wycats/handlebars.js/issues/669) - Ability to unregister a helper ([@dbachrach](https://github.com/dbachrach))
+- [#730](https://github.com/wycats/handlebars.js/pull/730) - Raw block helpers ([@kpdecker](https://github.com/kpdecker))
+- [#634](https://github.com/wycats/handlebars.js/pull/634) - It would be great to have the helper name passed to `blockHelperMissing` ([@kpdecker](https://github.com/kpdecker))
+- [#729](https://github.com/wycats/handlebars.js/pull/729) - Convert template spec to object literal ([@kpdecker](https://github.com/kpdecker))

- [#658](https://github.com/wycats/handlebars.js/issues/658) - Depthed helpers do not work after an upgrade from 1.0.0 ([@xibxor](https://api.github.com/users/xibxor))
- [#671](https://github.com/wycats/handlebars.js/issues/671) - Crashes on no-parameter {{#each}} ([@stepancheg](https://api.github.com/users/stepancheg))
- [#689](https://github.com/wycats/handlebars.js/issues/689) - broken template precompilation ([@AAS](https://api.github.com/users/AAS))
- [#698](https://github.com/wycats/handlebars.js/pull/698) - Fix parser generation under windows ([@osiris43](https://api.github.com/users/osiris43))
- [#699](https://github.com/wycats/handlebars.js/issues/699) - @DATA not compiles to invalid JS in stringParams mode ([@kpdecker](https://api.github.com/users/kpdecker))
- [#705](https://github.com/wycats/handlebars.js/issues/705) - 1.3.0 can not be wrapped in an IIFE ([@craigteegarden](https://api.github.com/users/craigteegarden))
- [#706](https://github.com/wycats/handlebars.js/pull/706) - README: Use with helper instead of relying on blockHelperMissing ([@scottgonzalez](https://api.github.com/users/scottgonzalez))
+- [#658](https://github.com/wycats/handlebars.js/issues/658) - Depthed helpers do not work after an upgrade from 1.0.0 ([@xibxor](https://github.com/xibxor))
+- [#671](https://github.com/wycats/handlebars.js/issues/671) - Crashes on no-parameter {{#each}} ([@stepancheg](https://github.com/stepancheg))
+- [#689](https://github.com/wycats/handlebars.js/issues/689) - broken template precompilation ([@AAS](https://github.com/AAS))
+- [#698](https://github.com/wycats/handlebars.js/pull/698) - Fix parser generation under windows ([@osiris43](https://github.com/osiris43))
+- [#699](https://github.com/wycats/handlebars.js/issues/699) - @DATA not compiles to invalid JS in stringParams mode ([@kpdecker](https://github.com/kpdecker))
+- [#705](https://github.com/wycats/handlebars.js/issues/705) - 1.3.0 can not be wrapped in an IIFE ([@craigteegarden](https://github.com/craigteegarden))
+- [#706](https://github.com/wycats/handlebars.js/pull/706) - README: Use with helper instead of relying on blockHelperMissing ([@scottgonzalez](https://github.com/scottgonzalez))

- [#700](https://github.com/wycats/handlebars.js/pull/700) - Remove redundant conditions ([@blakeembrey](https://api.github.com/users/blakeembrey))
- [#704](https://github.com/wycats/handlebars.js/pull/704) - JavaScript Compiler Cleanup ([@blakeembrey](https://api.github.com/users/blakeembrey))
+- [#700](https://github.com/wycats/handlebars.js/pull/700) - Remove redundant conditions ([@blakeembrey](https://github.com/blakeembrey))
+- [#704](https://github.com/wycats/handlebars.js/pull/704) - JavaScript Compiler Cleanup ([@blakeembrey](https://github.com/blakeembrey))

 Compatibility notes:
 - `helperMissing` helper no longer has the indexed name argument. Helper name is now available via `options.name`.
@@ -349,12 +494,12 @@ Compatibility notes:
 [Commits](https://github.com/wycats/handlebars.js/compare/v1.3.0...v2.0.0-alpha.1)

 ## v1.3.0 - January 1st, 2014
- [#690](https://github.com/wycats/handlebars.js/pull/690) - Added support for subexpressions ([@machty](https://api.github.com/users/machty))
- [#696](https://github.com/wycats/handlebars.js/pull/696) - Fix for reserved keyword "default" ([@nateirwin](https://api.github.com/users/nateirwin))
- [#692](https://github.com/wycats/handlebars.js/pull/692) - add line numbers to nodes when parsing ([@fivetanley](https://api.github.com/users/fivetanley))
- [#695](https://github.com/wycats/handlebars.js/pull/695) - Pull options out from param setup to allow easier extension ([@blakeembrey](https://api.github.com/users/blakeembrey))
- [#694](https://github.com/wycats/handlebars.js/pull/694) - Make the environment reusable ([@blakeembrey](https://api.github.com/users/blakeembrey))
- [#636](https://github.com/wycats/handlebars.js/issues/636) - Print line and column of errors ([@sgronblo](https://api.github.com/users/sgronblo))
+- [#690](https://github.com/wycats/handlebars.js/pull/690) - Added support for subexpressions ([@machty](https://github.com/machty))
+- [#696](https://github.com/wycats/handlebars.js/pull/696) - Fix for reserved keyword "default" ([@nateirwin](https://github.com/nateirwin))
+- [#692](https://github.com/wycats/handlebars.js/pull/692) - add line numbers to nodes when parsing ([@fivetanley](https://github.com/fivetanley))
+- [#695](https://github.com/wycats/handlebars.js/pull/695) - Pull options out from param setup to allow easier extension ([@blakeembrey](https://github.com/blakeembrey))
+- [#694](https://github.com/wycats/handlebars.js/pull/694) - Make the environment reusable ([@blakeembrey](https://github.com/blakeembrey))
+- [#636](https://github.com/wycats/handlebars.js/issues/636) - Print line and column of errors ([@sgronblo](https://github.com/sgronblo))
 - Use literal for data lookup - c1a93d3
 - Add stack handling sanity checks - cd885bf
 - Fix stack id "leak" on replaceStack - ddfe457
@@ -363,25 +508,25 @@ Compatibility notes:
 [Commits](https://github.com/wycats/handlebars.js/compare/v1.2.1...v1.3.0)

 ## v1.2.1 - December 26th, 2013
- [#684](https://github.com/wycats/handlebars.js/pull/684) - Allow any number of trailing characters for valid JavaScript variable ([@blakeembrey](https://api.github.com/users/blakeembrey))
- [#686](https://github.com/wycats/handlebars.js/pull/686) - Falsy AMD module names in version 1.2.0 ([@kpdecker](https://api.github.com/users/kpdecker))
+- [#684](https://github.com/wycats/handlebars.js/pull/684) - Allow any number of trailing characters for valid JavaScript variable ([@blakeembrey](https://github.com/blakeembrey))
+- [#686](https://github.com/wycats/handlebars.js/pull/686) - Falsy AMD module names in version 1.2.0 ([@kpdecker](https://github.com/kpdecker))

 [Commits](https://github.com/wycats/handlebars.js/compare/v1.2.0...v1.2.1)

 ## v1.2.0 - December 23rd, 2013
- [#675](https://github.com/wycats/handlebars.js/issues/675) - Cannot compile empty template for partial ([@erwinw](https://api.github.com/users/erwinw))
- [#677](https://github.com/wycats/handlebars.js/issues/677) - Triple brace statements fail under IE ([@hamzaCM](https://api.github.com/users/hamzaCM))
- [#655](https://github.com/wycats/handlebars.js/issues/655) - Loading Handlebars using bower ([@niki4810](https://api.github.com/users/niki4810))
- [#657](https://github.com/wycats/handlebars.js/pull/657) - Fixes issue where cli compiles non handlebars templates ([@chrishoage](https://api.github.com/users/chrishoage))
- [#681](https://github.com/wycats/handlebars.js/pull/681) - Adds in-browser testing and Saucelabs CI ([@kpdecker](https://api.github.com/users/kpdecker))
- [#661](https://github.com/wycats/handlebars.js/pull/661) - Add @first and @index to #each object iteration ([@cgp](https://api.github.com/users/cgp))
- [#650](https://github.com/wycats/handlebars.js/pull/650) - Handlebars is MIT-licensed ([@thomasboyt](https://api.github.com/users/thomasboyt))
- [#641](https://github.com/wycats/handlebars.js/pull/641) - Document ember testing process ([@kpdecker](https://api.github.com/users/kpdecker))
+- [#675](https://github.com/wycats/handlebars.js/issues/675) - Cannot compile empty template for partial ([@erwinw](https://github.com/erwinw))
+- [#677](https://github.com/wycats/handlebars.js/issues/677) - Triple brace statements fail under IE ([@hamzaCM](https://github.com/hamzaCM))
+- [#655](https://github.com/wycats/handlebars.js/issues/655) - Loading Handlebars using bower ([@niki4810](https://github.com/niki4810))
+- [#657](https://github.com/wycats/handlebars.js/pull/657) - Fixes issue where cli compiles non handlebars templates ([@chrishoage](https://github.com/chrishoage))
+- [#681](https://github.com/wycats/handlebars.js/pull/681) - Adds in-browser testing and Saucelabs CI ([@kpdecker](https://github.com/kpdecker))
+- [#661](https://github.com/wycats/handlebars.js/pull/661) - Add @first and @index to #each object iteration ([@cgp](https://github.com/cgp))
+- [#650](https://github.com/wycats/handlebars.js/pull/650) - Handlebars is MIT-licensed ([@thomasboyt](https://github.com/thomasboyt))
+- [#641](https://github.com/wycats/handlebars.js/pull/641) - Document ember testing process ([@kpdecker](https://github.com/kpdecker))
 - [#662](https://github.com/wycats/handlebars.js/issues/662) - handlebars-source 1.1.2 is missing from RubyGems.
- [#656](https://github.com/wycats/handlebars.js/issues/656) - Expose COMPILER_REVISION checks as a hook ([@machty](https://api.github.com/users/machty))
- [#668](https://github.com/wycats/handlebars.js/issues/668) - Consider publishing handlebars-runtime as a separate module on npm ([@dlmanning](https://api.github.com/users/dlmanning))
- [#679](https://github.com/wycats/handlebars.js/issues/679) - Unable to override invokePartial ([@mattbrailsford](https://api.github.com/users/mattbrailsford))
- [#646](https://github.com/wycats/handlebars.js/pull/646) - Fix "\\{{" immediately following "\{{" ([@dmarcotte](https://api.github.com/users/dmarcotte))
+- [#656](https://github.com/wycats/handlebars.js/issues/656) - Expose COMPILER_REVISION checks as a hook ([@machty](https://github.com/machty))
+- [#668](https://github.com/wycats/handlebars.js/issues/668) - Consider publishing handlebars-runtime as a separate module on npm ([@dlmanning](https://github.com/dlmanning))
+- [#679](https://github.com/wycats/handlebars.js/issues/679) - Unable to override invokePartial ([@mattbrailsford](https://github.com/mattbrailsford))
+- [#646](https://github.com/wycats/handlebars.js/pull/646) - Fix "\\{{" immediately following "\{{" ([@dmarcotte](https://github.com/dmarcotte))
 - Allow extend to work with non-prototyped objects - eb53f2e
 - Add JavascriptCompiler public API tests - 1a751b2
 - Add AST test coverage for more complex paths - ddea5be
@@ -396,8 +541,8 @@ Compatibility notes:

 ## v1.1.2 - November 5th, 2013

- [#645](https://github.com/wycats/handlebars.js/issues/645) - 1.1.1 fails under IE8 ([@kpdecker](https://api.github.com/users/kpdecker))
- [#644](https://github.com/wycats/handlebars.js/issues/644) - Using precompiled templates (AMD mode) with handlebars.runtime 1.1.1 ([@fddima](https://api.github.com/users/fddima))
+- [#645](https://github.com/wycats/handlebars.js/issues/645) - 1.1.1 fails under IE8 ([@kpdecker](https://github.com/kpdecker))
+- [#644](https://github.com/wycats/handlebars.js/issues/644) - Using precompiled templates (AMD mode) with handlebars.runtime 1.1.1 ([@fddima](https://github.com/fddima))

 - Add simple binary utility tests - 96a45a4
 - Fix empty string compilation - eea708a
@@ -414,13 +559,13 @@ Compatibility notes:

 ## v1.1.0 - November 3rd, 2013

- [#628](https://github.com/wycats/handlebars.js/pull/628) - Convert code to ES6 modules ([@kpdecker](https://api.github.com/users/kpdecker))
- [#336](https://github.com/wycats/handlebars.js/pull/336) - Add whitespace control syntax ([@kpdecker](https://api.github.com/users/kpdecker))
- [#535](https://github.com/wycats/handlebars.js/pull/535) - Fix for probable JIT error under Safari ([@sorentwo](https://api.github.com/users/sorentwo))
- [#483](https://github.com/wycats/handlebars.js/issues/483) - Add first and last @ vars to each helper ([@denniskuczynski](https://api.github.com/users/denniskuczynski))
- [#557](https://github.com/wycats/handlebars.js/pull/557) - `\\{{foo}}` escaping only works in some situations ([@dmarcotte](https://api.github.com/users/dmarcotte))
- [#552](https://github.com/wycats/handlebars.js/pull/552) - Added BOM removal flag. ([@blessenm](https://api.github.com/users/blessenm))
- [#543](https://github.com/wycats/handlebars.js/pull/543) - publish passing master builds to s3 ([@fivetanley](https://api.github.com/users/fivetanley))
+- [#628](https://github.com/wycats/handlebars.js/pull/628) - Convert code to ES6 modules ([@kpdecker](https://github.com/kpdecker))
+- [#336](https://github.com/wycats/handlebars.js/pull/336) - Add whitespace control syntax ([@kpdecker](https://github.com/kpdecker))
+- [#535](https://github.com/wycats/handlebars.js/pull/535) - Fix for probable JIT error under Safari ([@sorentwo](https://github.com/sorentwo))
+- [#483](https://github.com/wycats/handlebars.js/issues/483) - Add first and last @ vars to each helper ([@denniskuczynski](https://github.com/denniskuczynski))
+- [#557](https://github.com/wycats/handlebars.js/pull/557) - `\\{{foo}}` escaping only works in some situations ([@dmarcotte](https://github.com/dmarcotte))
+- [#552](https://github.com/wycats/handlebars.js/pull/552) - Added BOM removal flag. ([@blessenm](https://github.com/blessenm))
+- [#543](https://github.com/wycats/handlebars.js/pull/543) - publish passing master builds to s3 ([@fivetanley](https://github.com/fivetanley))

 - [#608](https://github.com/wycats/handlebars.js/issues/608) - Add `includeZero` flag to `if` conditional
 - [#498](https://github.com/wycats/handlebars.js/issues/498) - `Handlebars.compile` fails on empty string although a single blank works fine
@@ -59,6 +59,7 @@ describe('ast', function() {
      equals(node.loc.end.column, lastColumn);
    }

+    /* eslint-disable no-multi-spaces */
    ast = Handlebars.parse(
              'line 1 {{line1Token}}\n'             // 1
            + ' line 2 {{line2token}}\n'            // 2
@@ -71,6 +72,7 @@ describe('ast', function() {
            + '{{else inverse}}\n'                  // 9
            + '{{else}}\n'                          // 10
            + '{{/open}}');                         // 11
+    /* eslint-enable no-multi-spaces */
    body = ast.body;

    it('gets ContentNode line numbers', function() {
@@ -312,10 +312,14 @@ describe('builtin helpers', function() {
      console.info = function(info) {
        equals('whee', info);
        called = true;
+        console.info = $info;
+        console.log = $log;
      };
      console.log = function(log) {
        equals('whee', log);
        called = true;
+        console.info = $info;
+        console.log = $log;
      };

      shouldCompileTo(string, hash, '');
@@ -329,6 +333,7 @@ describe('builtin helpers', function() {
      console.error = function(log) {
        equals('whee', log);
        called = true;
+        console.error = $error;
      };

      shouldCompileTo(string, [hash,,,, {level: '03'}], '');
@@ -343,6 +348,7 @@ describe('builtin helpers', function() {
      console.log = function(log) {
        equals('whee', log);
        called = true;
+        console.log = $log;
      };

      shouldCompileTo(string, [hash,,,, {level: '03'}], '');
@@ -385,9 +391,9 @@ describe('builtin helpers', function() {
      var hash = { blah: 'whee' };
      var called = false;

-      console.info = console.log = console.error = console.debug = function(log) {
-        equals('whee', log);
+      console.info = console.log = console.error = console.debug = function() {
        called = true;
+        console.info = console.log = console.error = console.debug = $log;
      };

      shouldCompileTo(string, hash, '');
@@ -403,6 +409,7 @@ describe('builtin helpers', function() {
        equals('foo', log2);
        equals(1, log3);
        called = true;
+        console.log = $log;
      };

      shouldCompileTo(string, hash, '');
@@ -1,3 +1,5 @@
+var global = (function() { return this; }());
+
 var AssertError;
 if (Error.captureStackTrace) {
  AssertError = function AssertError(message, caller) {
@@ -113,7 +113,7 @@ describe('helpers', function() {
      { 'name': 'Yehuda', 'id': 2 }
    ]};

-    shouldCompileTo(source, [data, {link: link}], '<ul><li><a href=\"/people/1\">Alan</a></li><li><a href=\"/people/2\">Yehuda</a></li></ul>');
+    shouldCompileTo(source, [data, {link: link}], '<ul><li><a href="/people/1">Alan</a></li><li><a href="/people/2">Yehuda</a></li></ul>');
  });

  it('block helper for undefined value', function() {
@@ -51,7 +51,7 @@ describe('parser', function() {
  });

  it('parses mustaches with string parameters', function() {
-    equals(astFor('{{foo bar \"baz\" }}'), '{{ PATH:foo [PATH:bar, "baz"] }}\n');
+    equals(astFor('{{foo bar "baz" }}'), '{{ PATH:foo [PATH:bar, "baz"] }}\n');
  });

  it('parses mustaches with NUMBER parameters', function() {
@@ -87,10 +87,10 @@ describe('parser', function() {

    equals(astFor("{{foo bat='bam'}}"), '{{ PATH:foo [] HASH{bat="bam"} }}\n');

-    equals(astFor('{{foo omg bar=baz bat=\"bam\"}}'), '{{ PATH:foo [PATH:omg] HASH{bar=PATH:baz, bat="bam"} }}\n');
-    equals(astFor('{{foo omg bar=baz bat=\"bam\" baz=1}}'), '{{ PATH:foo [PATH:omg] HASH{bar=PATH:baz, bat="bam", baz=NUMBER{1}} }}\n');
-    equals(astFor('{{foo omg bar=baz bat=\"bam\" baz=true}}'), '{{ PATH:foo [PATH:omg] HASH{bar=PATH:baz, bat="bam", baz=BOOLEAN{true}} }}\n');
-    equals(astFor('{{foo omg bar=baz bat=\"bam\" baz=false}}'), '{{ PATH:foo [PATH:omg] HASH{bar=PATH:baz, bat="bam", baz=BOOLEAN{false}} }}\n');
+    equals(astFor('{{foo omg bar=baz bat="bam"}}'), '{{ PATH:foo [PATH:omg] HASH{bar=PATH:baz, bat="bam"} }}\n');
+    equals(astFor('{{foo omg bar=baz bat="bam" baz=1}}'), '{{ PATH:foo [PATH:omg] HASH{bar=PATH:baz, bat="bam", baz=NUMBER{1}} }}\n');
+    equals(astFor('{{foo omg bar=baz bat="bam" baz=true}}'), '{{ PATH:foo [PATH:omg] HASH{bar=PATH:baz, bat="bam", baz=BOOLEAN{true}} }}\n');
+    equals(astFor('{{foo omg bar=baz bat="bam" baz=false}}'), '{{ PATH:foo [PATH:omg] HASH{bar=PATH:baz, bat="bam", baz=BOOLEAN{false}} }}\n');
  });

  it('parses contents followed by a mustache', function() {
@@ -136,7 +136,7 @@ describe('parser', function() {
  });

  it('parses a multi-line comment', function() {
-    equals(astFor('{{!\nthis is a multi-line comment\n}}'), "{{! \'\nthis is a multi-line comment\n\' }}\n");
+    equals(astFor('{{!\nthis is a multi-line comment\n}}'), "{{! '\nthis is a multi-line comment\n' }}\n");
  });

  it('parses an inverse section', function() {
@@ -263,6 +263,15 @@ describe('partials', function() {
        true,
        'success');
    });
+
+    it('should be able to access the @data frame from a partial-block', function() {
+      shouldCompileToWithPartials(
+        '{{#> dude}}in-block: {{@root/value}}{{/dude}}',
+        [{value: 'success'}, {}, {dude: '<code>before-block: {{@root/value}} {{>   @partial-block }}</code>'}],
+        true,
+        '<code>before-block: success in-block: success</code>');
+    });
+
    it('should allow the #each-helper to be used along with partial-blocks', function() {
      shouldCompileToWithPartials(
        '<template>{{#> list value}}value = {{.}}{{/list}}</template>',
@@ -0,0 +1,35 @@
+describe('security issues', function() {
+    describe('GH-1495: Prevent Remote Code Execution via constructor', function() {
+        it('should not allow constructors to be accessed', function() {
+            shouldCompileTo('{{constructor.name}}', {}, '');
+            shouldCompileTo('{{lookup (lookup this "constructor") "name"}}', {}, '');
+        });
+
+        it('should allow the "constructor" property to be accessed if it is enumerable', function() {
+            shouldCompileTo('{{constructor.name}}', {'constructor': {
+                'name': 'here we go'
+            }}, 'here we go');
+            shouldCompileTo('{{lookup (lookup this "constructor") "name"}}', {'constructor': {
+                'name': 'here we go'
+            }}, 'here we go');
+        });
+
+        it('should allow prototype properties that are not constructors', function() {
+            function TestClass() {
+            }
+
+            Object.defineProperty(TestClass.prototype, 'abc', {
+                get: function() {
+                    return 'xyz';
+                }
+
+            });
+
+            shouldCompileTo('{{#with this as |obj|}}{{obj.abc}}{{/with}}',
+                new TestClass(), 'xyz');
+            shouldCompileTo('{{#with this as |obj|}}{{lookup obj "abc"}}{{/with}}',
+                new TestClass(), 'xyz');
+
+        });
+    });
+});
@@ -25,8 +25,8 @@ describe('spec', function() {
          // We nest the entire response from partials, not just the literals
          || (name === 'partials.json' && test.name === 'Standalone Indentation')

-          || (/\{\{\=/).test(test.template)
-          || _.any(test.partials, function(partial) { return (/\{\{\=/).test(partial); })) {
+          || (/\{\{=/).test(test.template)
+          || _.any(test.partials, function(partial) { return (/\{\{=/).test(partial); })) {
        it.skip(name + ' - ' + test.name);
        return;
      }
@@ -282,13 +282,13 @@ describe('Tokenizer', function() {
  });

  it('tokenizes mustaches with String params as "OPEN ID ID STRING CLOSE"', function() {
-    var result = tokenize('{{ foo bar \"baz\" }}');
+    var result = tokenize('{{ foo bar "baz" }}');
    shouldMatchTokens(result, ['OPEN', 'ID', 'ID', 'STRING', 'CLOSE']);
    shouldBeToken(result[3], 'STRING', 'baz');
  });

  it('tokenizes mustaches with String params using single quotes as "OPEN ID ID STRING CLOSE"', function() {
-    var result = tokenize("{{ foo bar \'baz\' }}");
+    var result = tokenize("{{ foo bar 'baz' }}");
    shouldMatchTokens(result, ['OPEN', 'ID', 'ID', 'STRING', 'CLOSE']);
    shouldBeToken(result[3], 'STRING', 'baz');
  });
@@ -365,13 +365,13 @@ describe('Tokenizer', function() {
    result = tokenize('{{ foo bar\n  baz=bat }}');
    shouldMatchTokens(result, ['OPEN', 'ID', 'ID', 'ID', 'EQUALS', 'ID', 'CLOSE']);

-    result = tokenize('{{ foo bar baz=\"bat\" }}');
+    result = tokenize('{{ foo bar baz="bat" }}');
    shouldMatchTokens(result, ['OPEN', 'ID', 'ID', 'ID', 'EQUALS', 'STRING', 'CLOSE']);

-    result = tokenize('{{ foo bar baz=\"bat\" bam=wot }}');
+    result = tokenize('{{ foo bar baz="bat" bam=wot }}');
    shouldMatchTokens(result, ['OPEN', 'ID', 'ID', 'ID', 'EQUALS', 'STRING', 'ID', 'EQUALS', 'ID', 'CLOSE']);

-    result = tokenize('{{foo omg bar=baz bat=\"bam\"}}');
+    result = tokenize('{{foo omg bar=baz bat="bam"}}');
    shouldMatchTokens(result, ['OPEN', 'ID', 'ID', 'ID', 'EQUALS', 'ID', 'ID', 'EQUALS', 'STRING', 'CLOSE']);
    shouldBeToken(result[2], 'ID', 'omg');
  });
Author	SHA1	Message	Date
Nils Knappmeier	272362e44c	v4.0.14	2019-04-13 16:39:19 +02:00
Nils Knappmeier	2a5a80110c	Update release notes	2019-04-13 16:38:47 +02:00
Nils Knappmeier	7375da4276	test: remove safari from saucelabs	2019-04-13 16:23:54 +02:00
Nils Knappmeier	d4e64b6bdc	chore: .gitignore more files	2019-04-13 16:23:29 +02:00
Nils Knappmeier	85c8783b34	fix: prevent RCE through the "lookup"-helper - The "lookup" helper could also be used to run a remote code execution by manipulating the template. The same check as for regular path queries now also is done in the "lookup"-helper	2019-04-13 16:22:01 +02:00
Nils Knappmeier	d97a045f6b	chore: reactivate saucelabs-tests	2019-03-15 23:07:01 +01:00
Nils Knappmeier	5f47c4a682	test: make security testcase internet explorer compatible Internet Explorer does not support the 'class Testclass {}' notation, and tests are not compiled using babel. closes #1497	2019-03-15 23:06:50 +01:00
Nils Knappmeier	7c2fbcc9de	chore: Use node 10 to build handlebars Node 10 is LTS now... (cherry picked from commit `78dd89c13a`)	2019-02-07 11:30:31 +01:00
Nils Knappmeier	9d4fff19d4	v4.0.13	2019-02-07 11:26:00 +01:00
Nils Knappmeier	2d49b67a61	Update release notes	2019-02-07 11:25:30 +01:00
Nils Knappmeier	6f93bc53da	chore: make sure that 4.0.x does not get "latest"-tag on npm	2019-02-07 11:21:23 +01:00
Nils Knappmeier	7296b6df72	test: run appveyor tests in Node 10	2019-02-07 11:20:20 +01:00
Nils Knappmeier	836b1bfbf4	chore: disable sauce-labs Related to #1497	2019-02-07 11:20:07 +01:00
Nils Knappmeier	7372d4e9df	fix: disallow access to the constructor in templates to prevent RCE This commit fixes a Remote Code Execution (RCE) reported by npm-security. Access to non-enumerable "constructor"-properties is now prohibited by the compiled template-code, because this the first step on the way to creating and execution arbitrary JavaScript code. The vulnerability affects systems where an attacker is allowed to inject templates into the Handlebars setup. Further details of the attack may be disclosed by npm-security. Closes #1267 Closes #1495	2019-02-07 11:19:54 +01:00
Nils Knappmeier	8d22e6f501	v4.0.12	2018-09-04 20:44:38 +02:00
Nils Knappmeier	3c970cc9c1	Update release notes	2018-09-04 20:44:07 +02:00
Nils Knappmeier	abba3c7526	Update release notes	2018-09-04 20:37:53 +02:00
Nils Knappmeier	4bf1c4ff66	Update release notes	2018-09-04 20:36:06 +02:00
Nils Knappmeier	41b6a11d11	Merge branch '4.x' of github.com:wycats/handlebars.js into 4.x	2018-09-04 20:08:57 +02:00
Nils Knappmeier	2d28f920b0	bump grunt-plugin-dependencies to 1.x versions	2018-09-04 18:53:01 +02:00
Nils Knappmeier	29b174468d	style: omit linting error caused by removing "if"	2018-09-04 18:53:01 +02:00
Nils Knappmeier	d130ed2bc1	chore: bump various dependencies - grunt -> 1 - grunt-contrib-watch -> 1 - mocha -> 5 - in common.js: define "global" , see mochajs/mocha#1159 - in builtins.js: revert "console.log" to old value just after using the mock (in log-helper tests), because mocha calls "console.log" on failure, before "afterEach"	2018-09-04 18:53:01 +02:00
Nils Knappmeier	2145c14994	bump grunt-plugin-dependencies to 1.x versions	2018-09-04 00:18:46 +02:00
Nils Knappmeier	8359722e5d	style: omit linting error caused by removing "if"	2018-09-04 00:16:01 +02:00
Nils Knappmeier	a1d864d4a7	chore: bump various dependencies - grunt -> 1 - grunt-contrib-watch -> 1 - mocha -> 5 - in common.js: define "global" , see mochajs/mocha#1159 - in builtins.js: revert "console.log" to old value just after using the mock (in log-helper tests), because mocha calls "console.log" on failure, before "afterEach"	2018-09-04 00:15:02 +02:00
Qiang Li	0ddff8b388	unnecessary check (cherry picked from commit `e1fa310`)	2018-05-31 23:16:26 +02:00
Nils Knappmeier	288e986161	Docs: Document branches in the CONTRIBUTING guide	2018-05-31 23:15:24 +02:00
Nils Knappmeier	30df8a1ac7	Testcase for accessing @root from a partial-block related to #1445	2018-05-31 23:12:08 +02:00
Nils Knappmeier	cda544bca9	Add package.json to components shim This is an attempt to provide a valid package.json-file to the shim repository for bower, in order to support `bower-away` see components/handlebars.js#24	2017-11-28 22:13:17 +01:00
aaharu	69c6ca528d	Use `files` field	2017-11-26 02:08:20 +09:00
Nils Knappmeier	a4e39bdfd0	Fix release-notes (links to contributors` pages)	2017-11-09 10:46:39 +01:00
Nils Knappmeier	b86b9189fa	Fix release-notes (links to github-repo)	2017-11-09 10:44:20 +01:00
tim	d3d39423a3	upgrade uglify-js	2017-10-21 23:04:23 +02:00
Nils Knappmeier	73d5637564	Update dependencies "async" to 2.5.0 and "source-map" to 0.6.1	2017-10-21 16:09:33 +02:00
Nils Knappmeier	7729aa956b	Update grunt-eslint to 20.1.0	2017-10-21 15:42:27 +02:00
Nils Knappmeier	8947dd077c	Update jsfiddle to 4.0.11	2017-10-17 23:15:53 +02:00