Fix Ruby component publishing documentation

Docker images has to use root because it tries
to write to `/.local` which would fail otherwise.

.editorconfig

@@ -0,0 +1,11 @@
+root = true
+
+[*.js]
+indent_size = 2
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.yml]
+indent_size = 2
+insert_final_newline = true
+trim_trailing_whitespace = true

.eslintignore

@@ -4,7 +4,6 @@
 *.sublime-project
 *.sublime-workspace
 npm-debug.log
-sauce_connect.log*
 .idea
 yarn-error.log
 node_modules
@@ -15,7 +14,7 @@ node_modules
 lib/handlebars/compiler/parser.js
 /coverage/
 /dist/
-/integration-testing/*/dist/
+/tests/integration/*/dist/
 
 # Third-party or files that must remain unchanged
 /spec/expected/

.github/dependabot.yml

@@ -0,0 +1,9 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    open-pull-requests-limit: 0
+    schedule:
+      interval: weekly
+    allow:
+      - dependency-type: production

.github/workflows/ci.yml

@@ -0,0 +1,89 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - master
+  pull_request: {}
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: 'ubuntu-latest'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '16'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Lint
+        run: npm run lint
+
+  test:
+    name: Test (Node)
+    runs-on: ${{ matrix.operating-system }}
+    strategy:
+      fail-fast: false
+      matrix:
+        operating-system: ['ubuntu-latest', 'windows-latest']
+        # https://nodejs.org/en/about/releases/
+        node-version: ['16', '18', '20', '22']
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          submodules: true
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Test
+        run: npm run test
+
+      - name: Test (Integration)
+        # https://github.com/webpack/webpack/issues/14532
+        if: ${{ matrix.node-version == '16' }}
+        run: |
+          cd ./tests/integration/rollup-test && ./test.sh && cd -
+          cd ./tests/integration/webpack-babel-test && ./test.sh && cd -
+          cd ./tests/integration/webpack-test && ./test.sh && cd -
+
+  browser:
+    name: Test (Browser)
+    runs-on: 'ubuntu-22.04'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          submodules: true
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '16'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Install Playwright
+        run: |
+          npx playwright install-deps
+          npx playwright install
+
+      - name: Build
+        run: npx grunt prepare
+
+      - name: Test
+        run: npm run test:browser

.github/workflows/release.yml

@@ -0,0 +1,38 @@
+name: Release
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - master
+    tags:
+      - '*'
+
+jobs:
+  publish-aws-s3:
+    name: Publish to AWS S3
+    runs-on: 'ubuntu-latest'
+    environment: 'builds.handlebarsjs.com.s3.amazonaws.com'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+        with:
+          submodules: true
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v2
+        with:
+          node-version: '16'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Publish
+        run: |
+          git config --global user.email "release@handlebarsjs.com"
+          git config --global user.name "handlebars-lang"
+          npm run publish:aws
+        env:
+          S3_BUCKET_NAME: "builds.handlebarsjs.com"
+          S3_ACCESS_KEY_ID: ${{ secrets.S3_ACCESS_KEY_ID }}
+          S3_SECRET_ACCESS_KEY: ${{ secrets.S3_SECRET_ACCESS_KEY }}

.gitignore

@@ -4,7 +4,6 @@
 *.sublime-project
 *.sublime-workspace
 npm-debug.log
-sauce_connect.log*
 .idea
 /yarn-error.log
 /yarn.lock
@@ -16,5 +15,6 @@ node_modules
 lib/handlebars/compiler/parser.js
 /coverage/
 /dist/
-/integration-testing/*/dist/
-/spec/tmp/*
+/test-results/
+/tests/integration/*/dist/
+/spec/tmp/*

.gitmodules

@@ -1,3 +1,3 @@
 [submodule "spec/mustache"]
 	path = spec/mustache
-	url = git://github.com/mustache/spec.git
+	url = https://github.com/mustache/spec.git

.prettierignore

@@ -15,7 +15,7 @@ node_modules
 lib/handlebars/compiler/parser.js
 /coverage/
 /dist/
-/integration-testing/*/dist/
+/tests/integration/*/dist/
 
 # Third-party or files that must remain unchanged
 /spec/expected/

.travis.yml

@@ -1,39 +0,0 @@
-language: node_js
-jobs:
-  include:
-  - stage: test
-    name: check javascript (eslint)
-    node_js: lts/*
-    script: npm run lint
-  - stage: test
-    name: check formatting (prettier)
-    node_js: lts/*
-    script: npm run check-format
-  - stage: test
-    name: check typescript definitions (dtslint)
-    node_js: lts/*
-    script: npm run dtslint
-  - stage: test
-    name: extensive tests and publish to aws
-    script: npm run extensive-tests-and-publish-to-aws
-    env:
-    - S3_BUCKET_NAME=builds.handlebarsjs.com
-    - secure: ckyEe5dzjdFDjmZ6wIrhGm0CFBEnKq8c1dYptfgVV/Q5/nJFGzu8T0yTjouS/ERxzdT2H327/63VCxhFnLCRHrsh4rlW/rCy4XI3O/0TeMLgFPa4TXkO8359qZ4CB44TBb3NsJyQXNMYdJpPLTCVTMpuiqqkFFOr+6OeggR7ufA=
-    - secure: Nm4AgSfsgNB21kgKrF9Tl7qVZU8YYREhouQunFracTcZZh2NZ2XH5aHuSiXCj88B13Cr/jGbJKsZ4T3QS3wWYtz6lkyVOx3H3iI+TMtqhD9RM3a7A4O+4vVN8IioB2YjhEu0OKjwgX5gp+0uF+pLEi7Hpj6fupD3AbbL5uYcKg8=
-    - SAUCE_USERNAME=handlebars
-    - secure: 1VkLQhbsEug4ZMQ52tTOus/WLvW3Etqe7GbCzZfzsI8d2ygJPjFfzU8fNm4pVVwoTI21MaM5AQq7SVPu8DWN1YbDjJycMdY1zO3DsB9aZBxTal98fIB7ZIUce9r5z2EP6mETrsbYjZkeckzIBI0A4UVa+F2BO4KbRDXP1Db3u3I=
-    node_js: '10'
-  - stage: test
-    name: test with latest nodejs-lts
-    node_js: lts/*
-    script: npm run test
-  - stage: test
-    name: test with active nodejs
-    node_js: node
-    script: npm run test
-cache: npm
-email:
-  on_failure: change
-  on_success: never
-git:
-  depth: 100

CONTRIBUTING.md

@@ -2,13 +2,13 @@
 
 ## Reporting Issues
 
-Please see our [FAQ](https://github.com/wycats/handlebars.js/blob/master/FAQ.md) for common issues that people run into.
+Please see our [FAQ](https://github.com/handlebars-lang/handlebars.js/blob/master/FAQ.md) for common issues that people run into.
 
 Should you run into other issues with the project, please don't hesitate to let us know by filing an [issue][issue]! In general we are going to ask for an example of the problem failing, which can be as simple as a jsfiddle/jsbin/etc. We've put together a jsfiddle [template][jsfiddle] to ease this. (We will keep this link up to date as new releases occur, so feel free to check back here)
 
 Pull requests containing only failing tests demonstrating the issue are welcomed and this also helps ensure that your issue won't regress in the future once it's fixed.
 
-Documentation issues on the handlebarsjs.com site should be reported on [handlebars-site](https://github.com/wycats/handlebars-site).
+Documentation issues on the [handlebarsjs.com](https://handlebarsjs.com) site should be reported on [handlebars-lang/docs](https://github.com/handlebars-lang/docs).
 
 ## Branches
 
@@ -47,9 +47,9 @@ You can also run our set of benchmarks with `grunt bench`.
 The `grunt dev` implements watching for tests and allows for in browser testing at `http://localhost:9999/spec/`.
 
 If you notice any problems, please report them to the GitHub issue tracker at
-[http://github.com/wycats/handlebars.js/issues](http://github.com/wycats/handlebars.js/issues).
+[http://github.com/handlebars-lang/handlebars.js/issues](http://github.com/handlebars-lang/handlebars.js/issues).
 
-##Running Tests
+## Running Tests
 
 To run tests locally, first install all dependencies.
 
@@ -78,43 +78,111 @@ We do linting and formatting in two phases:
 
 - Committed files are linted and formatted in a pre-commit hook. In this stage eslint-errors are forbidden,
   while warnings are allowed.
-- The travis-ci job also lints all files and checks if they are formatted correctly. In this stage, warnings
+- The GitHub CI job also lints all files and checks if they are formatted correctly. In this stage, warnings
   are forbidden.
 
-You can use the following scripts to make sure that the travis-job does not fail:
+You can use the following scripts to make sure that the CI job does not fail:
 
 - **npm run lint** will run `eslint` and fail on warnings
 - **npm run format** will run `prettier` on all files
-- **npm run check-before-pull-request** will perform all most checks that travis does in its build-job, excluding the "integration-test".
-- **npm run integration-test** will run integration tests (using old NodeJS versions and integrations with webpack, babel and so on)
+- **npm run check-before-pull-request** will perform all most checks that our CI job does in its build-job, excluding the "integration-test".
+- **npm run test:integration** will run integration tests (using old NodeJS versions and integrations with webpack, babel and so on)
   These tests only work on a Linux-machine with `nvm` installed (for running tests in multiple versions of NodeJS).
 
 ## Releasing the latest version
 
 Before attempting the release Handlebars, please make sure that you have the following authorizations:
 
-- Push-access to `wycats/handlebars.js`
-- Publishing rights on npmjs.com for the `handlebars` package
-- Publishing rights on gemfury for the `handlebars-source` package
-- Push-access to the repo for legacy package managers: `components/handlebars`
-- Push-access to the production-repo of the handlebars site: `handlebars-lang/handlebarsjs.com-github-pages`
+- Push-access to [handlebars-lang/handlebars.js](https://github.com/handlebars-lang/handlebars.js/)
+- Publishing rights on npmjs.com for the [handlebars](https://www.npmjs.com/package/handlebars) package
+- Publishing rights on rubygems for the [handlebars-source](https://rubygems.org/gems/handlebars-source) package
+- Push-access to the repo for legacy package managers: [components/handlebars.js](https://github.com/components/handlebars.js)
+- Push-access to the production-repo of the handlebars site: [handlebars-lang/docs](https://github.com/handlebars-lang/docs)
 
 _When releasing a previous version of Handlebars, please look into the CONTRIBUNG.md in the corresponding branch._
 
-Handlebars utilizes the [release yeoman generator][generator-release] to perform most release tasks.
+A full release via Docker may be completed with the following:
 
-A full release may be completed with the following:
+1. Create a `Dockerfile` in this folder for releasing
+    ```Dockerfile
+    FROM node:10-slim
+    
+    ENV EDITOR=vim
+    
+    # Update stretch repositories
+    RUN sed -i -e 's/deb.debian.org/archive.debian.org/g' \
+    -e 's|security.debian.org|archive.debian.org/|g' \
+    -e '/stretch-updates/d' /etc/apt/sources.list
+    
+    # Install release dependencies
+    RUN apt-get update
+    RUN apt-get install -y git vim
+    
+    # Work around deprecated npm dependency install via unauthenticated git-protocol:
+    # https://github.com/kpdecker/generator-release/blob/87aab9b84c9f083635c3fcc822f18acce1f48736/package.json#L31
+    RUN git config --system url."https://github.com/".insteadOf git://github.com/
+    
+    # Configure git
+    RUN git config --system user.email "release@handlebarsjs.com"
+    RUN git config --system user.name "handlebars-lang"
+    
+    RUN mkdir /home/node/.config
+    RUN mkdir /home/node/.ssh
+    RUN mkdir /home/node/tmp
+    
+    # Generate config for yo generator-release:
+    # https://github.com/kpdecker/generator-release#example
+    # You have to add a valid GitHub access token! (Used for reading issues and pull requests.)
+    RUN echo "module.exports = {\n  auth: 'oauth',\n  token: 'GitHub personal access token'\n};" > /home/node/.config/generator-release
+    RUN chown -R node:node /home/node/.config
+    RUN chown -R node:node /home/node/.ssh
+    RUN chown -R node:node /home/node/tmp
+    
+    # Add the generated key to GitHub: https://github.com/settings/keys
+    RUN ssh-keygen -q -t ed25519 -N '' -f /home/node/.ssh/id_ed25519 -C "release@handlebarsjs.com"
+    RUN chmod 0600 /home/node/.ssh/id_ed25519*
+    RUN chown node:node /home/node/.ssh/id_ed25519*
+    ```
+2. Build and run the Docker image
+    ```bash
+    docker build --tag handlebars:release .
+    docker run --rm --interactive --tty \
+      --volume $PWD:/app \
+      --workdir /app \
+      --user $(id -u):$(id -g) \
+      --env NPM_CONFIG_PREFIX=/home/node/.npm-global \
+      handlebars:release bash -c 'export PATH=$PATH:/home/node/.npm-global/bin; bash'
+    ```
+   * Add SSH key to GitHub: `cat /home/node/.ssh/id_ed25519.pub` (https://github.com/settings/keys)
+   * Add GitHub API token: `vi /home/node/.config/generator-release`
+   * Execute the following steps:
+     ```bash
+     npm install
+     npm install -g yo@1 grunt@1 generator-release
+     npm run release
+     # Warning! This step will collect data from GitHub, bump the version,
+     # create a new commit, create a new tag and push it to GitHub.
+     # https://github.com/kpdecker/generator-release?tab=readme-ov-file#usage
+     yo release
+     npm login
+     npm publish
+     yo release:publish components handlebars.js dist/components/
+     ```
+6. Publish Ruby `handlebars-source` gem:
+    ```bash
+    docker run --rm --interactive --tty \
+     --volume $PWD:/app \
+     --workdir /app \
+     ruby:3.2-slim bash
+    ```
+   * Execute the following steps:
+     ```bash
+     cd dist/components/
+     gem build handlebars-source.gemspec
+     gem push handlebars-source-*.gem
+     ```
 
-```
-npm ci
-yo release
-npm publish
-yo release:publish components handlebars.js dist/components/
-
-cd dist/components/
-gem build handlebars-source.gemspec
-gem push handlebars-source-*.gem
-```
+### After the release
 
 After the release, you should check that all places have really been updated. Especially verify that the `latest`-tags
 in those places still point to the latest version
@@ -126,13 +194,13 @@ in those places still point to the latest version
 
 When everything is OK, the **handlebars site** needs to be updated.
 
-Go to the master branch of the repo [handlebars-lang/handlebarsjs.com-github-pages](https://github.com/handlebars-lang/handlebarsjs.com-github-pages/tree/master)
+Go to the master branch of the repo [handlebars-lang/docs](https://github.com/handlebars-lang/docs/tree/master)
 and make a minimal change to the README. This will invoke a github-action that redeploys
 the site, fetching the latest version-number from the npm-registry.
 (note that the default-branch of this repo is not the master and regular changes are done
 in the `handlebars-lang/docs`-repo).
 
 [generator-release]: https://github.com/walmartlabs/generator-release
-[pull-request]: https://github.com/wycats/handlebars.js/pull/new/master
-[issue]: https://github.com/wycats/handlebars.js/issues/new
+[pull-request]: https://github.com/handlebars-lang/handlebars.js/pull/new/master
+[issue]: https://github.com/handlebars-lang/handlebars.js/issues/new
 [jsfiddle]: https://jsfiddle.net/9D88g/180/

FAQ.md

@@ -2,11 +2,11 @@
 
 1. How can I file a bug report:
 
-  See our guidelines on [reporting issues](https://github.com/wycats/handlebars.js/blob/master/CONTRIBUTING.md#reporting-issues).
+  See our guidelines on [reporting issues](https://github.com/handlebars-lang/handlebars.js/blob/master/CONTRIBUTING.md#reporting-issues).
 
 1. Why isn't my Mustache template working?
 
-  Handlebars deviates from Mustache slightly on a few behaviors. These variations are documented in our [readme](https://github.com/wycats/handlebars.js#differences-between-handlebarsjs-and-mustache).
+  Handlebars deviates from Mustache slightly on a few behaviors. These variations are documented in our [readme](https://github.com/handlebars-lang/handlebars.js#differences-between-handlebarsjs-and-mustache).
 
 1. Why is it slower when compiling?
 
@@ -36,16 +36,18 @@
   ```sh
   handlebars --version
   ```
+
   If using the integrated precompiler and
 
   ```javascript
   console.log(Handlebars.VERSION);
   ```
+
   On the client side.
 
   We include the built client libraries in the npm package for those who want to be certain that they are using the same client libraries as the compiler.
 
-  Should these match, please file an issue with us, per our [issue filing guidelines](https://github.com/wycats/handlebars.js/blob/master/CONTRIBUTING.md#reporting-issues).
+  Should these match, please file an issue with us, per our [issue filing guidelines](https://github.com/handlebars-lang/handlebars.js/blob/master/CONTRIBUTING.md#reporting-issues).
 
 1. Why doesn't IE like the `default` name in the AMD module?
 
@@ -53,8 +55,8 @@
 
 1. How do I load the runtime library when using AMD?
 
-  There are two options for loading under AMD environments. The first is to use the `handlebars.runtime.amd.js` file. This may require a [path mapping](https://github.com/wycats/handlebars.js/blob/master/spec/amd-runtime.html#L31) as well as access via the `default` field.
+  There are two options for loading under AMD environments. The first is to use the `handlebars.runtime.amd.js` file. This may require a [path mapping](https://github.com/handlebars-lang/handlebars.js/blob/master/spec/amd-runtime.html#L31) as well as access via the `default` field.
 
-  The other option is to load the `handlebars.runtime.js` UMD build, which might not require path configuration and exposes the library as both the module root and the `default` field for compatibility. 
+  The other option is to load the `handlebars.runtime.js` UMD build, which might not require path configuration and exposes the library as both the module root and the `default` field for compatibility.
 
   If not using ES6 transpilers or accessing submodules in the build the former option should be sufficient for most use cases.

Gruntfile.js

@@ -7,7 +7,7 @@ module.exports = function(grunt) {
       'tmp',
       'dist',
       'lib/handlebars/compiler/parser.js',
-      'integration-testing/**/node_modules'
+      '/tests/integration/**/node_modules'
     ],
 
     copy: {
@@ -165,54 +165,10 @@ module.exports = function(grunt) {
         }
       }
     },
-    'saucelabs-mocha': {
-      all: {
-        options: {
-          build: process.env.TRAVIS_JOB_ID,
-          urls: [
-            'http://localhost:9999/spec/?headless=true',
-            'http://localhost:9999/spec/amd.html?headless=true'
-          ],
-          detailedError: true,
-          concurrency: 4,
-          browsers: [
-            { browserName: 'chrome' },
-            { browserName: 'firefox', platform: 'Linux' }
-            // {browserName: 'safari', version: 9, platform: 'OS X 10.11'},
-            // {browserName: 'safari', version: 8, platform: 'OS X 10.10'},
-            // {
-            //   browserName: 'internet explorer',
-            //   version: 11,
-            //   platform: 'Windows 8.1'
-            // },
-            // {
-            //   browserName: 'internet explorer',
-            //   version: 10,
-            //   platform: 'Windows 8'
-            // }
-          ]
-        }
-      },
-      sanity: {
-        options: {
-          build: process.env.TRAVIS_JOB_ID,
-          urls: [
-            'http://localhost:9999/spec/umd.html?headless=true',
-            'http://localhost:9999/spec/amd-runtime.html?headless=true',
-            'http://localhost:9999/spec/umd-runtime.html?headless=true'
-          ],
-          detailedError: true,
-          concurrency: 2,
-          browsers: [{ browserName: 'chrome' }]
-        }
-      }
-    },
 
-    bgShell: {
+    shell: {
       integrationTests: {
-        cmd: './integration-testing/run-integration-tests.sh',
-        bg: false,
-        fail: true
+        command: './tests/integration/run-integration-tests.sh'
       }
     },
 
@@ -237,23 +193,15 @@ module.exports = function(grunt) {
   grunt.loadNpmTasks('grunt-contrib-uglify');
   grunt.loadNpmTasks('grunt-contrib-watch');
   grunt.loadNpmTasks('grunt-babel');
-  grunt.loadNpmTasks('grunt-bg-shell');
-  grunt.loadNpmTasks('@knappi/grunt-saucelabs');
+  grunt.loadNpmTasks('grunt-shell');
   grunt.loadNpmTasks('grunt-webpack');
 
   grunt.task.loadTasks('tasks');
 
-  this.registerTask(
-    'build',
-    'Builds a distributable version of the current project',
-    ['parser', 'node', 'globals']
-  );
-
-  this.registerTask('node', ['babel:cjs']);
-  this.registerTask('globals', ['webpack']);
-
-  this.registerTask('release', 'Build final packages', [
-    'amd',
+  grunt.registerTask('node', ['babel:cjs']);
+  grunt.registerTask('amd', ['babel:amd', 'requirejs']);
+  grunt.registerTask('globals', ['webpack']);
+  grunt.registerTask('release', 'Build final packages', [
     'uglify',
     'test:min',
     'copy:dist',
@@ -261,38 +209,29 @@ module.exports = function(grunt) {
     'copy:cdnjs'
   ]);
 
-  this.registerTask('amd', ['babel:amd', 'requirejs']);
-
-  this.registerTask('test', ['test:bin', 'test:cov']);
-
-  grunt.registerTask('bench', ['metrics']);
-
-  if (process.env.SAUCE_ACCESS_KEY) {
-    grunt.registerTask('sauce', ['concat:tests', 'connect', 'saucelabs-mocha']);
-  } else {
-    grunt.registerTask('sauce', []);
-  }
-
-  // Requires secret properties (saucelabs-credentials etc.) from .travis.yaml
+  // Requires secret properties from .travis.yaml
   grunt.registerTask('extensive-tests-and-publish-to-aws', [
     'default',
-    'bgShell:integrationTests',
-    'sauce',
+    'shell:integrationTests',
     'metrics',
     'publish-to-aws'
   ]);
-  grunt.registerTask('on-file-change', [
-    'build',
-    'amd',
-    'concat:tests',
-    'test'
-  ]);
+
+  grunt.registerTask('on-file-change', ['build', 'concat:tests', 'test']);
 
   // === Primary tasks ===
   grunt.registerTask('dev', ['clean', 'connect', 'watch']);
   grunt.registerTask('default', ['clean', 'build', 'test', 'release']);
+  grunt.registerTask('test', ['test:bin', 'test:cov']);
+  grunt.registerTask('bench', ['metrics']);
+  grunt.registerTask('prepare', ['build', 'concat:tests']);
+  grunt.registerTask(
+    'build',
+    'Builds a distributable version of the current project',
+    ['parser', 'node', 'amd', 'globals']
+  );
   grunt.registerTask('integration-tests', [
     'default',
-    'bgShell:integrationTests'
+    'shell:integrationTests'
   ]);
 };

README.markdown

@@ -1,17 +1,18 @@
-[![Travis Build Status](https://img.shields.io/travis/wycats/handlebars.js/master.svg)](https://travis-ci.org/wycats/handlebars.js)
-[![Appveyor Build Status](https://ci.appveyor.com/api/projects/status/github/wycats/handlebars.js?branch=master&svg=true)](https://ci.appveyor.com/project/wycats/handlebars-js)
-[![Selenium Test Status](https://saucelabs.com/buildstatus/handlebars)](https://saucelabs.com/u/handlebars)
+[![CI Build Status](https://github.com/handlebars-lang/handlebars.js/actions/workflows/ci.yml/badge.svg)](https://github.com/handlebars-lang/handlebars.js/actions/workflows/ci.yml)
+[![jsDelivr Hits](https://data.jsdelivr.com/v1/package/npm/handlebars/badge?style=rounded)](https://www.jsdelivr.com/package/npm/handlebars)
+[![npm downloads](https://badgen.net/npm/dm/handlebars)](https://www.npmjs.com/package/handlebars)
+[![npm version](https://badgen.net/npm/v/handlebars)](https://www.npmjs.com/package/handlebars)
+[![Bundle size](https://badgen.net/bundlephobia/minzip/handlebars?label=minified%20%2B%20gzipped)](https://bundlephobia.com/package/handlebars)
+[![Install size](https://packagephobia.com/badge?p=handlebars)](https://packagephobia.com/result?p=handlebars)
 
 Handlebars.js
 =============
 
-Handlebars.js is an extension to the [Mustache templating
-language](http://mustache.github.com/) created by Chris Wanstrath.
-Handlebars.js and Mustache are both logicless templating languages that
-keep the view and the code separated like we all know they should be.
+Handlebars provides the power necessary to let you build **semantic templates** effectively with no frustration.
+Handlebars is largely compatible with Mustache templates. In most cases it is possible to swap out Mustache with Handlebars and continue using your current templates.
 
 Checkout the official Handlebars docs site at
-[https://handlebarsjs.com/](https://handlebarsjs.com) and the live demo at [http://tryhandlebarsjs.com/](http://tryhandlebarsjs.com/).
+[handlebarsjs.com](https://handlebarsjs.com) and try our [live demo](https://handlebarsjs.com/playground.html).
 
 Installing
 ----------
@@ -22,7 +23,7 @@ Usage
 -----
 In general, the syntax of Handlebars.js templates is a superset
 of Mustache templates. For basic syntax, check out the [Mustache
-manpage](http://mustache.github.com/mustache.5.html).
+manpage](https://mustache.github.io/mustache.5.html).
 
 Once you have a template, use the `Handlebars.compile` method to compile
 the template into a function. The generated function takes a context
@@ -64,7 +65,7 @@ templates easier and also changes a tiny detail of how partials work.
 - [Literal Values](https://handlebarsjs.com/guide/expressions.html#literal-segments)
 - [Delimited Comments](https://handlebarsjs.com/guide/#template-comments)
 
-Block expressions have the same syntax as mustache sections but should not be confused with one another. Sections are akin to an implicit `each` or `with` statement depending on the input data and helpers are explicit pieces of code that are free to implement whatever behavior they like. The [mustache spec](http://mustache.github.io/mustache.5.html) defines the exact behavior of sections. In the case of name conflicts, helpers are given priority.
+Block expressions have the same syntax as mustache sections but should not be confused with one another. Sections are akin to an implicit `each` or `with` statement depending on the input data and helpers are explicit pieces of code that are free to implement whatever behavior they like. The [mustache spec](https://mustache.github.io/mustache.5.html) defines the exact behavior of sections. In the case of name conflicts, helpers are given priority.
 
 ### Compatibility
 
@@ -89,8 +90,6 @@ Handlebars has been designed to work in any ECMAScript 3 environment. This inclu
 Older versions and other runtimes are likely to work but have not been formally
 tested. The compiler requires `JSON.stringify` to be implemented natively or via a polyfill. If using the precompiler this is not necessary.
 
-[![Selenium Test Status](https://saucelabs.com/browser-matrix/handlebars.svg)](https://saucelabs.com/u/handlebars)
-
 Performance
 -----------
 
@@ -102,18 +101,18 @@ does have some big performance advantages. Justin Marney, a.k.a.
 [gotascii](http://github.com/gotascii), confirmed that with an
 [independent test](http://sorescode.com/2010/09/12/benchmarks.html). The
 rewritten Handlebars (current version) is faster than the old version,
-with many [performance tests](https://travis-ci.org/wycats/handlebars.js/builds/33392182#L538) being 5 to 7 times faster than the Mustache equivalent.
+with many performance tests being 5 to 7 times faster than the Mustache equivalent.
 
 
 Upgrading
 ---------
 
-See [release-notes.md](https://github.com/wycats/handlebars.js/blob/master/release-notes.md) for upgrade notes.
+See [release-notes.md](https://github.com/handlebars-lang/handlebars.js/blob/master/release-notes.md) for upgrade notes.
 
 Known Issues
 ------------
 
-See [FAQ.md](https://github.com/wycats/handlebars.js/blob/master/FAQ.md) for known issues and common pitfalls.
+See [FAQ.md](https://github.com/handlebars-lang/handlebars.js/blob/master/FAQ.md) for known issues and common pitfalls.
 
 
 Handlebars in the Wild
@@ -165,4 +164,4 @@ License
 -------
 Handlebars.js is released under the MIT license.
 
-[pull-request]: https://github.com/wycats/handlebars.js/pull/new/master
+[pull-request]: https://github.com/handlebars-lang/handlebars.js/pull/new/master

appveyor.yml

@@ -1,36 +0,0 @@
-# Test against these versions of Node.js
-environment:
-  matrix:
-    - nodejs_version: "10"
-
-platform:
-  - x64
-
-# Install scripts (runs after repo cloning)
-install:
-  # Get the latest stable version of Node.js
-  - ps: Install-Product node $env:nodejs_version $env:platform
-  # Clone submodules (mustache spec)
-  - cmd: git submodule update --init --recursive
-  # Install modules
-  - cmd: npm ci
-
-
-# Post-install test scripts
-test_script:
-  # Output useful info for debugging
-  - cmd: node --version
-  - cmd: npm --version
-  # Run tests
-  - cmd: npm run test
-
-# Don't actually build
-build: off
-
-on_failure:
-  - cmd: 7z a coverage.zip coverage
-  - cmd: appveyor PushArtifact coverage.zip
-
-
-# Set build version format here instead of in the admin panel
-version: "{build}"

bench/.eslintrc

@@ -1,15 +0,0 @@
-{
-  "extends": "prettier",
-  "globals": {
-    "require": true
-  },
-  "rules": {
-    // Disabling for tests, for now.
-    "no-path-concat": 0,
-
-    "no-var": 0,
-    "no-shadow": 0,
-    "handle-callback-err": 0,
-    "no-console": 0
-  }
-}

components/bower.json

@@ -1,6 +1,6 @@
 {
   "name": "handlebars",
-  "version": "4.7.7",
+  "version": "4.7.9",
   "main": "handlebars.js",
   "license": "MIT",
   "dependencies": {}

components/composer.json

@@ -1,7 +1,7 @@
 {
     "name": "components/handlebars.js",
     "description": "Handlebars.js and Mustache are both logicless templating languages that keep the view and the code separated like we all know they should be.",
-    "homepage": "http://handlebarsjs.com",
+    "homepage": "https://handlebarsjs.com",
     "license": "MIT",
     "type": "component",
     "keywords": [
@@ -11,13 +11,9 @@
     ],
     "authors": [
         {
-            "name": "Chris Wanstrath",
-            "homepage": "http://chriswanstrath.com"
+            "name": "Chris Wanstrath"
         }
     ],
-    "require": {
-        "robloach/component-installer": "*"
-    },
     "extra": {
         "component": {
             "name": "handlebars",

components/handlebars-source.gemspec

@@ -10,7 +10,7 @@ Gem::Specification.new do |gem|
   gem.date          = Time.now.strftime("%Y-%m-%d")
   gem.description   = %q{Handlebars.js source code wrapper for (pre)compilation gems.}
   gem.summary       = %q{Handlebars.js source code wrapper}
-  gem.homepage      = "https://github.com/wycats/handlebars.js/"
+  gem.homepage      = "https://github.com/handlebars-lang/handlebars.js/"
   gem.version       = package["version"].sub "-", "."
   gem.license       = "MIT"
 

components/handlebars.js.nuspec

@@ -2,10 +2,10 @@
 <package>
 	<metadata>
 		<id>handlebars.js</id>
-		<version>4.7.7</version>
+		<version>4.7.9</version>
 		<authors>handlebars.js Authors</authors>
-		<licenseUrl>https://github.com/wycats/handlebars.js/blob/master/LICENSE</licenseUrl>
-		<projectUrl>https://github.com/wycats/handlebars.js/</projectUrl>
+		<licenseUrl>https://github.com/handlebars-lang/handlebars.js/blob/master/LICENSE</licenseUrl>
+		<projectUrl>https://github.com/handlebars-lang/handlebars.js/</projectUrl>
 		<requireLicenseAcceptance>false</requireLicenseAcceptance>
 		<description>Extension of the Mustache logicless template language</description>
 		<releaseNotes></releaseNotes>

components/package.json

@@ -1,6 +1,6 @@
 {
   "name": "handlebars",
-  "version": "4.7.7",
+  "version": "4.7.9",
   "license": "MIT",
   "jspm": {
     "main": "handlebars",

docs/decorators-api.md

@@ -16,4 +16,4 @@ Decorators are executed when the block program is instantiated and are passed `(
 
 Decorators may set values on `props` or return a modified function that wraps `program` in particular behaviors. If the decorator returns nothing, then `program` is left unaltered.
 
-The [inline partial](https://github.com/wycats/handlebars.js/blob/master/lib/handlebars/decorators/inline.js) implementation provides an example of decorators being used for both metadata and wrapping behaviors.
+The [inline partial](https://github.com/handlebars-lang/handlebars.js/blob/master/lib/handlebars/decorators/inline.js) implementation provides an example of decorators being used for both metadata and wrapping behaviors.

integration-testing/webpack-test/package.json

@@ -1,21 +0,0 @@
-{
-  "name": "webpack-test",
-  "description": "Various tests with Handlebars and Webpack",
-  "version": "1.0.0",
-  "main": "index.js",
-  "scripts": {
-    "build": "webpack --config webpack.config.js",
-    "test": "node dist/main.js"
-  },
-  "private": true,
-  "keywords": [],
-  "author": "",
-  "license": "ISC",
-  "dependencies": {},
-  "devDependencies": {
-    "handlebars": "file:../..",
-    "handlebars-loader": "^1.7.1",
-    "webpack": "^4.39.3",
-    "webpack-cli": "^3.3.7"
-  }
-}

lib/.eslintrc.js

@@ -0,0 +1,8 @@
+module.exports = {
+  env: {
+    // Handlebars should not use node or browser-specific APIs
+    'shared-node-browser': true,
+    node: false,
+    browser: false
+  }
+};

lib/handlebars/base.js

@@ -5,7 +5,7 @@ import { registerDefaultDecorators } from './decorators';
 import logger from './logger';
 import { resetLoggedProperties } from './internal/proto-access';
 
-export const VERSION = '4.7.7';
+export const VERSION = '4.7.9';
 export const COMPILER_REVISION = 8;
 export const LAST_COMPATIBLE_COMPILER_REVISION = 7;
 

lib/handlebars/compiler/base.js

@@ -1,6 +1,7 @@
 import parser from './parser';
 import WhitespaceControl from './whitespace-control';
 import * as Helpers from './helpers';
+import Exception from '../exception';
 import { extend } from '../utils';
 
 export { parser };
@@ -11,6 +12,9 @@ extend(yy, Helpers);
 export function parseWithoutProcessing(input, options) {
   // Just return if an already-compiled AST was passed in.
   if (input.type === 'Program') {
+    // When a pre-parsed AST is passed in, validate all node values to prevent
+    // code injection via type-confused literals.
+    validateInputAst(input);
     return input;
   }
 
@@ -32,3 +36,66 @@ export function parse(input, options) {
 
   return strip.accept(ast);
 }
+
+function validateInputAst(ast) {
+  validateAstNode(ast);
+}
+
+function validateAstNode(node) {
+  if (node == null) {
+    return;
+  }
+
+  if (Array.isArray(node)) {
+    node.forEach(validateAstNode);
+    return;
+  }
+
+  if (typeof node !== 'object') {
+    return;
+  }
+
+  if (node.type === 'PathExpression') {
+    if (!isValidDepth(node.depth)) {
+      throw new Exception(
+        'Invalid AST: PathExpression.depth must be an integer'
+      );
+    }
+    if (!Array.isArray(node.parts)) {
+      throw new Exception('Invalid AST: PathExpression.parts must be an array');
+    }
+    for (let i = 0; i < node.parts.length; i++) {
+      if (typeof node.parts[i] !== 'string') {
+        throw new Exception(
+          'Invalid AST: PathExpression.parts must only contain strings'
+        );
+      }
+    }
+  } else if (node.type === 'NumberLiteral') {
+    if (typeof node.value !== 'number' || !isFinite(node.value)) {
+      throw new Exception('Invalid AST: NumberLiteral.value must be a number');
+    }
+  } else if (node.type === 'BooleanLiteral') {
+    if (typeof node.value !== 'boolean') {
+      throw new Exception(
+        'Invalid AST: BooleanLiteral.value must be a boolean'
+      );
+    }
+  }
+
+  Object.keys(node).forEach(propertyName => {
+    if (propertyName === 'loc') {
+      return;
+    }
+    validateAstNode(node[propertyName]);
+  });
+}
+
+function isValidDepth(depth) {
+  return (
+    typeof depth === 'number' &&
+    isFinite(depth) &&
+    Math.floor(depth) === depth &&
+    depth >= 0
+  );
+}

lib/handlebars/compiler/code-gen.js

@@ -1,4 +1,4 @@
-/* global define */
+/* global define, require */
 import { isArray } from '../utils';
 
 let SourceNode;
@@ -6,7 +6,7 @@ let SourceNode;
 try {
   /* istanbul ignore next */
   if (typeof define !== 'function' || !define.amd) {
-    // We don't support this in AMD environments. For these environments, we asusme that
+    // We don't support this in AMD environments. For these environments, we assume that
     // they are running on the browser and thus have no need for the source-map library.
     let SourceMap = require('source-map');
     SourceNode = SourceMap.SourceNode;

lib/handlebars/compiler/javascript-compiler.js

@@ -165,12 +165,10 @@ JavaScriptCompiler.prototype = {
 
       let { programs, decorators } = this.context;
       for (i = 0, l = programs.length; i < l; i++) {
-        if (programs[i]) {
-          ret[i] = programs[i];
-          if (decorators[i]) {
-            ret[i + '_d'] = decorators[i];
-            ret.useDecorators = true;
-          }
+        ret[i] = programs[i];
+        if (decorators[i]) {
+          ret[i + '_d'] = decorators[i];
+          ret.useDecorators = true;
         }
       }
 
@@ -535,14 +533,22 @@ JavaScriptCompiler.prototype = {
     this.resolvePath('data', parts, 0, true, strict);
   },
 
-  resolvePath: function(type, parts, i, falsy, strict) {
+  resolvePath: function(type, parts, startPartIndex, falsy, strict) {
     if (this.options.strict || this.options.assumeObjects) {
-      this.push(strictLookup(this.options.strict && strict, this, parts, type));
+      this.push(
+        strictLookup(
+          this.options.strict && strict,
+          this,
+          parts,
+          startPartIndex,
+          type
+        )
+      );
       return;
     }
 
     let len = parts.length;
-    for (; i < len; i++) {
+    for (let i = startPartIndex; i < len; i++) {
       /* eslint-disable no-loop-func */
       this.replaceStack(current => {
         let lookup = this.nameLookup(current, parts[i], type);
@@ -680,9 +686,18 @@ JavaScriptCompiler.prototype = {
     let foundDecorator = this.nameLookup('decorators', name, 'decorator'),
       options = this.setupHelperArgs(name, paramSize);
 
+    // Store the resolved decorator in a variable and verify it is a function before
+    // calling it. Without this, unregistered decorators can cause an unhandled TypeError
+    // (calling undefined), which crashes the process — enabling Denial of Service.
+    this.decorators.push(['var decorator = ', foundDecorator, ';']);
+    this.decorators.push([
+      'if (typeof decorator !== "function") { throw new Error(',
+      this.quotedString('Missing decorator: "' + name + '"'),
+      '); }'
+    ]);
     this.decorators.push([
       'fn = ',
-      this.decorators.functionCall(foundDecorator, '', [
+      this.decorators.functionCall('decorator', '', [
         'fn',
         'props',
         'container',
@@ -906,8 +921,8 @@ JavaScriptCompiler.prototype = {
       let existing = this.matchExistingProgram(child);
 
       if (existing == null) {
-        this.context.programs.push(''); // Placeholder to prevent name conflicts for nested children
-        let index = this.context.programs.length;
+        // Placeholder to prevent name conflicts for nested children
+        let index = this.context.programs.push('') - 1;
         child.index = index;
         child.name = 'program' + index;
         this.context.programs[index] = compiler.compile(
@@ -1261,15 +1276,14 @@ JavaScriptCompiler.isValidJavaScriptVariableName = function(name) {
   );
 };
 
-function strictLookup(requireTerminal, compiler, parts, type) {
+function strictLookup(requireTerminal, compiler, parts, startPartIndex, type) {
   let stack = compiler.popStack(),
-    i = 0,
     len = parts.length;
   if (requireTerminal) {
     len--;
   }
 
-  for (; i < len; i++) {
+  for (let i = startPartIndex; i < len; i++) {
     stack = compiler.nameLookup(stack, parts[i], type);
   }
 
@@ -1279,7 +1293,7 @@ function strictLookup(requireTerminal, compiler, parts, type) {
       '(',
       stack,
       ', ',
-      compiler.quotedString(parts[i]),
+      compiler.quotedString(parts[len]),
       ', ',
       JSON.stringify(compiler.source.currentLocation),
       ' )'

lib/handlebars/helpers.js

@@ -20,7 +20,8 @@ export function moveHelperToHooks(instance, helperName, keepHelper) {
   if (instance.helpers[helperName]) {
     instance.hooks[helperName] = instance.helpers[helperName];
     if (!keepHelper) {
-      delete instance.helpers[helperName];
+      // Using delete is slow
+      instance.helpers[helperName] = undefined;
     }
   }
 }

lib/handlebars/helpers/each.js

@@ -63,9 +63,9 @@ export default function(instance) {
             execIteration(i, i, i === context.length - 1);
           }
         }
-      } else if (global.Symbol && context[global.Symbol.iterator]) {
+      } else if (typeof Symbol === 'function' && context[Symbol.iterator]) {
         const newContext = [];
-        const iterator = context[global.Symbol.iterator]();
+        const iterator = context[Symbol.iterator]();
         for (let it = iterator.next(); !it.done; it = iterator.next()) {
           newContext.push(it.value);
         }

lib/handlebars/internal/create-new-lookup-object.js

@@ -1,11 +0,0 @@
-import { extend } from '../utils';
-
-/**
- * Create a new object with "null"-prototype to avoid truthy results on prototype properties.
- * The resulting object can be used with "object[property]" to check if a property exists
- * @param {...object} sources a varargs parameter of source objects that will be merged
- * @returns {object}
- */
-export function createNewLookupObject(...sources) {
-  return extend(Object.create(null), ...sources);
-}

lib/handlebars/internal/proto-access.js

@@ -1,32 +1,31 @@
-import { createNewLookupObject } from './create-new-lookup-object';
-import * as logger from '../logger';
+import { extend } from '../utils';
+import logger from '../logger';
 
 const loggedProperties = Object.create(null);
 
 export function createProtoAccessControl(runtimeOptions) {
-  let defaultMethodWhiteList = Object.create(null);
-  defaultMethodWhiteList['constructor'] = false;
-  defaultMethodWhiteList['__defineGetter__'] = false;
-  defaultMethodWhiteList['__defineSetter__'] = false;
-  defaultMethodWhiteList['__lookupGetter__'] = false;
-
-  let defaultPropertyWhiteList = Object.create(null);
+  // Create an object with "null"-prototype to avoid truthy results on
+  // prototype properties.
+  const propertyWhiteList = Object.create(null);
   // eslint-disable-next-line no-proto
-  defaultPropertyWhiteList['__proto__'] = false;
+  propertyWhiteList['__proto__'] = false;
+  extend(propertyWhiteList, runtimeOptions.allowedProtoProperties);
+
+  const methodWhiteList = Object.create(null);
+  methodWhiteList['constructor'] = false;
+  methodWhiteList['__defineGetter__'] = false;
+  methodWhiteList['__defineSetter__'] = false;
+  methodWhiteList['__lookupGetter__'] = false;
+  methodWhiteList['__lookupSetter__'] = false;
+  extend(methodWhiteList, runtimeOptions.allowedProtoMethods);
 
   return {
     properties: {
-      whitelist: createNewLookupObject(
-        defaultPropertyWhiteList,
-        runtimeOptions.allowedProtoProperties
-      ),
+      whitelist: propertyWhiteList,
       defaultValue: runtimeOptions.allowProtoPropertiesByDefault
     },
     methods: {
-      whitelist: createNewLookupObject(
-        defaultMethodWhiteList,
-        runtimeOptions.allowedProtoMethods
-      ),
+      whitelist: methodWhiteList,
       defaultValue: runtimeOptions.allowProtoMethodsByDefault
     }
   };

lib/handlebars/no-conflict.js

@@ -1,11 +1,22 @@
+/* global globalThis */
 export default function(Handlebars) {
   /* istanbul ignore next */
-  let root = typeof global !== 'undefined' ? global : window,
-    $Handlebars = root.Handlebars;
+  // https://mathiasbynens.be/notes/globalthis
+  (function() {
+    if (typeof globalThis === 'object') return;
+    Object.prototype.__defineGetter__('__magic__', function() {
+      return this;
+    });
+    __magic__.globalThis = __magic__; // eslint-disable-line no-undef
+    delete Object.prototype.__magic__;
+  })();
+
+  const $Handlebars = globalThis.Handlebars;
+
   /* istanbul ignore next */
   Handlebars.noConflict = function() {
-    if (root.Handlebars === Handlebars) {
-      root.Handlebars = $Handlebars;
+    if (globalThis.Handlebars === Handlebars) {
+      globalThis.Handlebars = $Handlebars;
     }
     return Handlebars;
   };

lib/handlebars/runtime.js

@@ -74,17 +74,10 @@ export function template(templateSpec, env) {
     }
     partial = env.VM.resolvePartial.call(this, partial, context, options);
 
-    let extendedOptions = Utils.extend({}, options, {
-      hooks: this.hooks,
-      protoAccessControl: this.protoAccessControl
-    });
+    options.hooks = this.hooks;
+    options.protoAccessControl = this.protoAccessControl;
 
-    let result = env.VM.invokePartial.call(
-      this,
-      partial,
-      context,
-      extendedOptions
-    );
+    let result = env.VM.invokePartial.call(this, partial, context, options);
 
     if (result == null && env.compile) {
       options.partials[options.name] = env.compile(
@@ -92,7 +85,7 @@ export function template(templateSpec, env) {
         templateSpec.compilerOptions,
         env
       );
-      result = options.partials[options.name](context, extendedOptions);
+      result = options.partials[options.name](context, options);
     }
     if (result != null) {
       if (options.indent) {
@@ -145,7 +138,7 @@ export function template(templateSpec, env) {
       for (let i = 0; i < len; i++) {
         let result = depths[i] && container.lookupProperty(depths[i], name);
         if (result != null) {
-          return depths[i][name];
+          return result;
         }
       }
     },
@@ -254,8 +247,9 @@ export function template(templateSpec, env) {
 
   ret._setup = function(options) {
     if (!options.partial) {
-      let mergedHelpers = Utils.extend({}, env.helpers, options.helpers);
-      wrapHelpersToPassLookupProperty(mergedHelpers, container);
+      let mergedHelpers = {};
+      addHelpers(mergedHelpers, env.helpers, container);
+      addHelpers(mergedHelpers, options.helpers, container);
       container.helpers = mergedHelpers;
 
       if (templateSpec.usePartial) {
@@ -355,21 +349,21 @@ export function wrapProgram(
 export function resolvePartial(partial, context, options) {
   if (!partial) {
     if (options.name === '@partial-block') {
-      partial = options.data['partial-block'];
+      partial = lookupOwnProperty(options.data, 'partial-block');
     } else {
-      partial = options.partials[options.name];
+      partial = lookupOwnProperty(options.partials, options.name);
     }
   } else if (!partial.call && !options.name) {
     // This is a dynamic partial that returned a string
     options.name = partial;
-    partial = options.partials[partial];
+    partial = lookupOwnProperty(options.partials, partial);
   }
   return partial;
 }
 
 export function invokePartial(partial, context, options) {
   // Use the current closure context to save the partial-block if this partial
-  const currentPartialBlock = options.data && options.data['partial-block'];
+  const currentPartialBlock = lookupOwnProperty(options.data, 'partial-block');
   options.partial = true;
   if (options.ids) {
     options.data.contextPath = options.ids[0] || options.data.contextPath;
@@ -410,6 +404,12 @@ export function noop() {
   return '';
 }
 
+function lookupOwnProperty(obj, name) {
+  if (obj && Object.prototype.hasOwnProperty.call(obj, name)) {
+    return obj[name];
+  }
+}
+
 function initData(context, data) {
   if (!data || !('root' in data)) {
     data = data ? createFrame(data) : {};
@@ -435,9 +435,10 @@ function executeDecorators(fn, prog, container, depths, data, blockParams) {
   return prog;
 }
 
-function wrapHelpersToPassLookupProperty(mergedHelpers, container) {
-  Object.keys(mergedHelpers).forEach(helperName => {
-    let helper = mergedHelpers[helperName];
+function addHelpers(mergedHelpers, helpers, container) {
+  if (!helpers) return;
+  Object.keys(helpers).forEach(helperName => {
+    let helper = helpers[helperName];
     mergedHelpers[helperName] = passLookupPropertyOption(helper, container);
   });
 }
@@ -445,6 +446,7 @@ function wrapHelpersToPassLookupProperty(mergedHelpers, container) {
 function passLookupPropertyOption(helper, container) {
   const lookupProperty = container.lookupProperty;
   return wrapHelper(helper, options => {
-    return Utils.extend({ lookupProperty }, options);
+    options.lookupProperty = lookupProperty;
+    return options;
   });
 }

lib/index.js

@@ -1,5 +1,6 @@
 // USAGE:
 // var handlebars = require('handlebars');
+/* eslint-env node */
 /* eslint-disable no-var */
 
 // var local = handlebars.create();

lib/precompiler.js

@@ -1,3 +1,4 @@
+/* eslint-env node */
 /* eslint-disable no-console */
 import Async from 'neo-async';
 import fs from 'fs';
@@ -195,16 +196,24 @@ module.exports.cli = function(opts) {
 
   const objectName = opts.partial ? 'Handlebars.partials' : 'templates';
 
+  if (opts.namespace && !isValidNamespace(opts.namespace)) {
+    throw new Handlebars.Exception('Invalid namespace format');
+  }
+
   let output = new SourceNode();
   if (!opts.simple) {
     if (opts.amd) {
+      const runtimeModulePath =
+        (opts.handlebarPath || '') + 'handlebars.runtime';
       output.add(
-        "define(['" +
-          opts.handlebarPath +
-          'handlebars.runtime\'], function(Handlebars) {\n  Handlebars = Handlebars["default"];'
+        'define([' +
+          quoteForJavaScript(runtimeModulePath) +
+          '], function(Handlebars) {\n  Handlebars = Handlebars["default"];'
       );
     } else if (opts.commonjs) {
-      output.add('var Handlebars = require("' + opts.commonjs + '");');
+      output.add(
+        'var Handlebars = require(' + quoteForJavaScript(opts.commonjs) + ');'
+      );
     } else {
       output.add('(function() {\n');
     }
@@ -254,9 +263,9 @@ module.exports.cli = function(opts) {
       }
       output.add([
         objectName,
-        "['",
-        template.name,
-        "'] = template(",
+        '[',
+        quoteForJavaScript(template.name),
+        '] = template(',
         precompiled,
         ');\n'
       ]);
@@ -276,7 +285,9 @@ module.exports.cli = function(opts) {
   }
 
   if (opts.map) {
-    output.add('\n//# sourceMappingURL=' + opts.map + '\n');
+    output.add(
+      '\n//# sourceMappingURL=' + sanitizeSourceMapComment(opts.map) + '\n'
+    );
   }
 
   output = output.toStringWithSourceMap();
@@ -306,6 +317,33 @@ function arrayCast(value) {
   return value;
 }
 
+/*
+ * Safely quotes a value for embedding in generated JavaScript strings
+ *
+ * Uses JSON.stringify which handles all special characters.
+ */
+function quoteForJavaScript(value) {
+  return JSON.stringify(String(value));
+}
+
+/**
+ * Validates that a namespace is a legitimate dotted JavaScript identifier
+ * (e.g. "App.templates") to prevent arbitrary code injection
+ */
+function isValidNamespace(namespace) {
+  return /^[A-Za-z_$][A-Za-z0-9_$]*(\.[A-Za-z_$][A-Za-z0-9_$]*)*$/.test(
+    namespace
+  );
+}
+
+/**
+ * Strips line terminators from source map URLs to prevent injection of new
+ * JavaScript lines via the sourceMappingURL comment
+ */
+function sanitizeSourceMapComment(value) {
+  return String(value).replace(/[\r\n\u2028\u2029]/g, '');
+}
+
 /**
  * Run uglify to minify the compiled template, if uglify exists in the dependencies.
  *

package.json

@@ -1,9 +1,9 @@
 {
   "name": "handlebars",
   "barename": "handlebars",
-  "version": "4.7.7",
+  "version": "4.7.9",
   "description": "Handlebars provides the power necessary to let you build semantic templates effectively with no frustration",
-  "homepage": "http://www.handlebarsjs.com/",
+  "homepage": "https://handlebarsjs.com/",
   "keywords": [
     "handlebars",
     "mustache",
@@ -12,7 +12,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "https://github.com/wycats/handlebars.js.git"
+    "url": "https://github.com/handlebars-lang/handlebars.js.git"
   },
   "author": "Yehuda Katz",
   "license": "MIT",
@@ -22,7 +22,7 @@
   },
   "dependencies": {
     "minimist": "^1.2.5",
-    "neo-async": "^2.6.0",
+    "neo-async": "^2.6.2",
     "source-map": "^0.6.1",
     "wordwrap": "^1.0.0"
   },
@@ -30,7 +30,7 @@
     "uglify-js": "^3.1.4"
   },
   "devDependencies": {
-    "@knappi/grunt-saucelabs": "^9.0.2",
+    "@playwright/test": "1.44.1",
     "aws-sdk": "^2.1.49",
     "babel-loader": "^5.0.0",
     "babel-runtime": "^5.1.10",
@@ -39,17 +39,15 @@
     "chai-diff": "^1.0.1",
     "concurrently": "^5.0.0",
     "dirty-chai": "^2.0.1",
-    "dtslint": "^0.5.5",
     "dustjs-linkedin": "^2.0.2",
     "eco": "~1.1.0-rc-3",
     "eslint": "^6.7.2",
     "eslint-config-prettier": "^6.7.0",
-    "eslint-plugin-compat": "^3.3.0",
+    "eslint-plugin-compat": "^3.13.0",
     "eslint-plugin-es5": "^1.4.1",
     "fs-extra": "^8.1.0",
-    "grunt": "^1.0.4",
+    "grunt": "1.5.3",
     "grunt-babel": "^5.0.0",
-    "grunt-bg-shell": "^2.3.3",
     "grunt-cli": "^1",
     "grunt-contrib-clean": "^1",
     "grunt-contrib-concat": "^1",
@@ -58,6 +56,7 @@
     "grunt-contrib-requirejs": "^1",
     "grunt-contrib-uglify": "^1",
     "grunt-contrib-watch": "^1.1.0",
+    "grunt-shell": "^4.0.0",
     "grunt-webpack": "^1.0.8",
     "husky": "^3.1.0",
     "jison": "~0.3.0",
@@ -76,23 +75,26 @@
   },
   "main": "lib/index.js",
   "types": "types/index.d.ts",
-  "browser": {
-    ".": "./dist/cjs/handlebars.js",
-    "./runtime": "./dist/cjs/handlebars.runtime.js"
-  },
+  "browser": "./dist/cjs/handlebars.js",
   "bin": {
     "handlebars": "bin/handlebars"
   },
   "scripts": {
+    "build": "grunt build",
+    "release": "npm run build && grunt release",
     "format": "prettier --write '**/*.js' && eslint --fix .",
-    "check-format": "prettier --check '**/*.js'",
-    "lint": "eslint --max-warnings 0 .",
-    "dtslint": "dtslint types",
-    "test": "grunt",
-    "extensive-tests-and-publish-to-aws": "npx mocha tasks/task-tests/ && grunt --stack extensive-tests-and-publish-to-aws",
-    "integration-test": "grunt integration-tests",
+    "lint": "npm run lint:eslint && npm run lint:prettier && npm run lint:types",
+    "lint:eslint": "eslint --max-warnings 0 .",
+    "lint:prettier": "prettier --check '**/*.js'",
+    "lint:types": "tsc --noEmit --project types",
+    "test": "npm run test:mocha",
+    "test:mocha": "grunt build && grunt test",
+    "test:browser": "playwright test --config tests/browser/playwright.config.js tests/browser/spec.js",
+    "test:integration": "grunt integration-tests",
+    "test:serve": "grunt connect:server:keepalive",
+    "extensive-tests-and-publish-to-aws": "npx mocha tasks/tests/ && grunt --stack extensive-tests-and-publish-to-aws",
     "--- combined tasks ---": "",
-    "check-before-pull-request": "concurrently --kill-others-on-fail npm:lint npm:dtslint npm:check-format npm:test"
+    "check-before-pull-request": "concurrently --kill-others-on-fail npm:lint npm:test"
   },
   "jspm": {
     "main": "handlebars",
@@ -109,7 +111,6 @@
     "dist/amd/**/*.js",
     "dist/cjs/**/*.js",
     "lib",
-    "print-script",
     "release-notes.md",
     "runtime.js",
     "types/*.d.ts",
@@ -121,7 +122,7 @@
     }
   },
   "lint-staged": {
-    "*.{js,css,json,md}": [
+    "*.{js,css,json}": [
       "prettier --write",
       "git add"
     ],

release-notes.md

@@ -2,7 +2,28 @@
 
 ## Development
 
-[Commits](https://github.com/handlebars-lang/handlebars.js/compare/v4.7.7...master)
+[Commits](https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...master)
+
+## v4.7.9 - March 26th, 2026
+- fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2
+- fix type "RuntimeOptions" also accepting string partials - eab1d14
+- feat(types): set `hash` to be a `Record<string, any>` - de4414d
+- fix non-contiguous program indices - 4512766
+- refactor: rename i to startPartIndex - e497a35
+- security: fix security issues - 68d8df5
+
+[Commits](https://github.com/handlebars-lang/handlebars.js/compare/v4.7.8...v4.7.9)
+
+## v4.7.8 - July 27th, 2023
+
+- Make library compatible with workers (#1894) - 3d3796c
+- Don't rely on Node.js global object (#1776) - 2954e7e
+- Fix compiling of each block params in strict mode (#1855) - 30dbf04
+- Fix rollup warning when importing Handlebars as ESM - 03d387b
+- Fix bundler issue with webpack 5 (#1862) - c6c6bbb
+- Use https instead of git for mustache submodule - 88ac068
+
+[Commits](https://github.com/handlebars-lang/handlebars.js/compare/v4.7.7...v4.7.8)
 
 ## v4.7.7 - February 15th, 2021
 

spec/amd-runtime.html

@@ -59,7 +59,7 @@
           }
           var runner = mocha.run();
 
-          //Reporting for saucelabs
+          // Reporting to test-runner
           var failedTests = [];
           runner.on('end', function(){
             window.mochaResults = runner.stats;

spec/amd.html

@@ -79,7 +79,7 @@
             }
             var runner = mocha.run();
 
-            //Reporting for saucelabs
+            // Reporting to test-runner
             var failedTests = [];
             runner.on('end', function(){
               window.mochaResults = runner.stats;

spec/builtins.js

@@ -324,6 +324,15 @@ describe('builtin helpers', function() {
         );
     });
 
+    it('each with block params and strict compilation', function() {
+      expectTemplate(
+        '{{#each goodbyes as |value index|}}{{index}}. {{value.text}}!{{/each}}'
+      )
+        .withCompileOptions({ strict: true })
+        .withInput({ goodbyes: [{ text: 'goodbye' }, { text: 'Goodbye' }] })
+        .toCompileTo('0. goodbye!1. Goodbye!');
+    });
+
     it('each object with @index', function() {
       expectTemplate(
         '{{#each goodbyes}}{{@index}}. {{text}}! {{/each}}cruel {{world}}!'

spec/compiler.js

@@ -128,6 +128,146 @@ describe('compiler', function() {
       );
     });
 
+    it('should reject AST with invalid PathExpression depth', function() {
+      shouldThrow(
+        function() {
+          Handlebars.compile({
+            type: 'Program',
+            body: [
+              {
+                type: 'MustacheStatement',
+                escaped: true,
+                strip: { open: false, close: false },
+                path: {
+                  type: 'PathExpression',
+                  data: false,
+                  depth: '0',
+                  parts: ['this'],
+                  original: 'this'
+                },
+                params: []
+              }
+            ]
+          })();
+        },
+        Error,
+        'Invalid AST: PathExpression.depth must be an integer'
+      );
+    });
+
+    it('should reject AST with non-array PathExpression parts', function() {
+      shouldThrow(
+        function() {
+          Handlebars.compile({
+            type: 'Program',
+            body: [
+              {
+                type: 'MustacheStatement',
+                escaped: true,
+                strip: { open: false, close: false },
+                path: {
+                  type: 'PathExpression',
+                  data: false,
+                  depth: 0,
+                  parts: 'this',
+                  original: 'this'
+                },
+                params: []
+              }
+            ]
+          })();
+        },
+        Error,
+        'Invalid AST: PathExpression.parts must be an array'
+      );
+    });
+
+    it('should reject AST with non-string PathExpression part', function() {
+      shouldThrow(
+        function() {
+          Handlebars.compile({
+            type: 'Program',
+            body: [
+              {
+                type: 'MustacheStatement',
+                escaped: true,
+                strip: { open: false, close: false },
+                path: {
+                  type: 'PathExpression',
+                  data: false,
+                  depth: 0,
+                  parts: [1],
+                  original: 'this'
+                },
+                params: []
+              }
+            ]
+          })();
+        },
+        Error,
+        'Invalid AST: PathExpression.parts must only contain strings'
+      );
+    });
+
+    it('should reject AST with invalid BooleanLiteral value type', function() {
+      shouldThrow(
+        function() {
+          Handlebars.compile({
+            type: 'Program',
+            body: [
+              {
+                type: 'MustacheStatement',
+                escaped: true,
+                strip: { open: false, close: false },
+                path: {
+                  type: 'PathExpression',
+                  data: false,
+                  depth: 0,
+                  parts: ['if'],
+                  original: 'if'
+                },
+                params: [
+                  {
+                    type: 'BooleanLiteral',
+                    value: 'true',
+                    original: true
+                  }
+                ]
+              }
+            ]
+          })();
+        },
+        Error,
+        'Invalid AST: BooleanLiteral.value must be a boolean'
+      );
+    });
+
+    it('should ignore loc metadata while validating AST nodes', function() {
+      equal(
+        Handlebars.compile({
+          type: 'Program',
+          meta: null,
+          loc: { source: 'fake', start: { line: 1, column: 0 } },
+          body: [{ type: 'ContentStatement', value: 'Hello' }]
+        })(),
+        'Hello'
+      );
+    });
+
+    it('should accept AST with valid NumberLiteral values', function() {
+      equal(
+        Handlebars.compile(Handlebars.parse('{{lookup this 1}}'))(['a', 'b']),
+        'b'
+      );
+    });
+
+    it('should accept AST with valid BooleanLiteral values', function() {
+      equal(
+        Handlebars.compile(Handlebars.parse('{{#if true}}ok{{/if}}'))({}),
+        'ok'
+      );
+    });
+
     it('can pass through an empty string', function() {
       equal(Handlebars.compile('')(), '');
     });

spec/expected/bom.amd.js

@@ -1,6 +1,6 @@
-define(['handlebars.runtime'], function(Handlebars) {
+define(["handlebars.runtime"], function(Handlebars) {
     Handlebars = Handlebars["default"];  var template = Handlebars.template, templates = Handlebars.templates = Handlebars.templates || {};
-  return templates['bom'] = template({"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
+  return templates["bom"] = template({"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
       return "a";
   },"useData":true});
   });

spec/expected/empty.amd.js

@@ -1,6 +1,6 @@
-define(['handlebars.runtime'], function(Handlebars) {
+define(["handlebars.runtime"], function(Handlebars) {
   Handlebars = Handlebars["default"];  var template = Handlebars.template, templates = Handlebars.templates = Handlebars.templates || {};
-return templates['empty'] = template({"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
+return templates["empty"] = template({"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
     return "";
 },"useData":true});
 });

spec/expected/empty.amd.namespace.js

@@ -1,6 +1,6 @@
-define(['handlebars.runtime'], function(Handlebars) {
+define(["handlebars.runtime"], function(Handlebars) {
   Handlebars = Handlebars["default"];  var template = Handlebars.template, templates = CustomNamespace.templates = CustomNamespace.templates || {};
-return templates['empty'] = template({"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
+return templates["empty"] = template({"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
     return "";
 },"useData":true});
 });

spec/expected/empty.common.js

@@ -1,6 +1,6 @@
 (function() {
   var template = Handlebars.template, templates = Handlebars.templates = Handlebars.templates || {};
-templates['empty'] = template({"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
+templates["empty"] = template({"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
     return "";
 },"useData":true});
 })();

spec/expected/empty.name.amd.js

@@ -1,9 +1,9 @@
-define(['handlebars.runtime'], function(Handlebars) {
+define(["handlebars.runtime"], function(Handlebars) {
   Handlebars = Handlebars["default"];  var template = Handlebars.template, templates = Handlebars.templates = Handlebars.templates || {};
-templates['firstTemplate'] = template({"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
+templates["firstTemplate"] = template({"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
     return "<div>1</div>";
 },"useData":true});
-templates['secondTemplate'] = template({"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
+templates["secondTemplate"] = template({"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
     return "<div>2</div>";
 },"useData":true});
 return templates;

spec/expected/empty.root.amd.js

@@ -1,6 +1,6 @@
-define(['handlebars.runtime'], function(Handlebars) {
+define(["handlebars.runtime"], function(Handlebars) {
   Handlebars = Handlebars["default"];  var template = Handlebars.template, templates = Handlebars.templates = Handlebars.templates || {};
-return templates['artifacts/partial.template'] = template({"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
+return templates["artifacts/partial.template"] = template({"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
     return "<div>Test Partial</div>";
 },"useData":true});
 });

spec/expected/handlebar.path.amd.js

@@ -1,6 +1,6 @@
-define(['some-path/handlebars.runtime'], function(Handlebars) {
+define(["some-path/handlebars.runtime"], function(Handlebars) {
     Handlebars = Handlebars["default"];  var template = Handlebars.template, templates = Handlebars.templates = Handlebars.templates || {};
-  return templates['empty'] = template({"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
+  return templates["empty"] = template({"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
       return "";
   },"useData":true});
   });

spec/expected/namespace.amd.js

@@ -1,9 +1,9 @@
-define(['handlebars.runtime'], function(Handlebars) {
+define(["handlebars.runtime"], function(Handlebars) {
     Handlebars = Handlebars["default"];  var template = Handlebars.template, templates = someNameSpace = someNameSpace || {};
-  templates['empty'] = template({"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
+  templates["empty"] = template({"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
       return "";
   },"useData":true});
-  templates['empty'] = template({"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
+  templates["empty"] = template({"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
       return "";
   },"useData":true});
   return templates;

spec/expected/non.default.extension.amd.js

@@ -1,6 +1,6 @@
-define(['handlebars.runtime'], function(Handlebars) {
+define(["handlebars.runtime"], function(Handlebars) {
     Handlebars = Handlebars["default"];  var template = Handlebars.template, templates = Handlebars.templates = Handlebars.templates || {};
-  return templates['non.default.extension'] = template({"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
+  return templates["non.default.extension"] = template({"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
       return "<div>This is a test</div>";
   },"useData":true});
   });

spec/expected/non.empty.amd.known.helper.js

@@ -1,6 +1,6 @@
-define(['handlebars.runtime'], function(Handlebars) {
+define(["handlebars.runtime"], function(Handlebars) {
 Handlebars = Handlebars["default"]; var template = Handlebars.template, templates = Handlebars.templates = Handlebars.templates || {};
-return templates['known.helpers'] = template({"1":function(container,depth0,helpers,partials,data) {
+return templates["known.helpers"] = template({"0":function(container,depth0,helpers,partials,data) {
 var stack1, lookupProperty = container.lookupProperty || function(parent, propertyName) {
 if (Object.prototype.hasOwnProperty.call(parent, propertyName)) {
 return parent[propertyName];
@@ -8,8 +8,8 @@ return parent[propertyName];
 return undefined
 };
 return " <div>Some known helper</div>\n" 
-+ ((stack1 = lookupProperty(helpers,"anotherHelper").call(depth0 != null ? depth0 : (container.nullContext || {}),true,{"name":"anotherHelper","hash":{},"fn":container.program(2, data, 0),"inverse":container.noop,"data":data,"loc":{"start":{"line":3,"column":4},"end":{"line":5,"column":22}}})) != null ? stack1 : "");
-},"2":function(container,depth0,helpers,partials,data) {
++ ((stack1 = lookupProperty(helpers,"anotherHelper").call(depth0 != null ? depth0 : (container.nullContext || {}),true,{"name":"anotherHelper","hash":{},"fn":container.program(1, data, 0),"inverse":container.noop,"data":data,"loc":{"start":{"line":3,"column":4},"end":{"line":5,"column":22}}})) != null ? stack1 : "");
+},"1":function(container,depth0,helpers,partials,data) {
 return " <div>Another known helper</div>\n";
 },"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
 var stack1, lookupProperty = container.lookupProperty || function(parent, propertyName) {
@@ -18,7 +18,7 @@ return parent[propertyName];
 }
 return undefined
 };
-return ((stack1 = lookupProperty(helpers,"someHelper").call(depth0 != null ? depth0 : (container.nullContext || {}),true,{"name":"someHelper","hash":{},"fn":container.program(1, data, 0),"inverse":container.noop,"data":data,"loc":{"start":{"line":1,"column":0},"end":{"line":6,"column":15}}})) != null ? stack1 : "");
+return ((stack1 = lookupProperty(helpers,"someHelper").call(depth0 != null ? depth0 : (container.nullContext || {}),true,{"name":"someHelper","hash":{},"fn":container.program(0, data, 0),"inverse":container.noop,"data":data,"loc":{"start":{"line":1,"column":0},"end":{"line":6,"column":15}}})) != null ? stack1 : "");
 },"useData":true});
 });
     

spec/expected/partial.template.js

@@ -1,6 +1,6 @@
-define(['handlebars.runtime'], function(Handlebars) {
+define(["handlebars.runtime"], function(Handlebars) {
     Handlebars = Handlebars["default"];  var template = Handlebars.template, templates = Handlebars.templates = Handlebars.templates || {};
-  return Handlebars.partials['partial.template'] = template({"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
+  return Handlebars.partials["partial.template"] = template({"compiler":[8,">= 4.3.0"],"main":function(container,depth0,helpers,partials,data) {
       return "<div>Test Partial</div>";
   },"useData":true});
   });

spec/index.html

@@ -62,7 +62,7 @@
         }
         var runner = mocha.run();
 
-        //Reporting for saucelabs
+        // Reporting to test-runner
         var failedTests = [];
         runner.on('end', function(){
           window.mochaResults = runner.stats;

spec/precompiler.js

@@ -182,7 +182,7 @@ describe('precompiler', function() {
       return 'amd';
     };
     Precompiler.cli({ templates: [emptyTemplate], amd: true, partial: true });
-    equal(/return Handlebars\.partials\['empty'\]/.test(log), true);
+    equal(/return Handlebars\.partials\["empty"\]/.test(log), true);
     equal(/template\(amd\)/.test(log), true);
   });
   it('should output multiple amd partials', function() {
@@ -405,4 +405,85 @@ describe('precompiler', function() {
       });
     });
   });
+
+  describe('GHSA-xjpj-3mr7-gcpf: precompiler output escaping', function() {
+    var FullHandlebars = require('../dist/cjs/handlebars')['default'];
+
+    function runCliAndCaptureOutput(options) {
+      var output = '';
+      var oldLog = console.log;
+      console.log = function() {
+        output += Array.prototype.join.call(arguments, '');
+      };
+
+      try {
+        Precompiler.cli(options);
+      } finally {
+        console.log = oldLog;
+      }
+
+      return output;
+    }
+
+    it('should not inject raw template names into generated code', function() {
+      var output = runCliAndCaptureOutput({
+        templates: [
+          {
+            name: "evil'];global.__xjpjName=1;//",
+            source: ''
+          }
+        ],
+        amd: true
+      });
+
+      expect(output).to.not.match(/\['evil'\];global\.__xjpjName=1/);
+    });
+
+    it('should not inject raw commonjs option values into generated code', function() {
+      var output = runCliAndCaptureOutput({
+        templates: [{ name: 'safe', source: '' }],
+        commonjs: 'handlebars");global.__xjpjCommon=1;//'
+      });
+
+      expect(output).to.not.match(
+        /require\("handlebars"\);global\.__xjpjCommon=1/
+      );
+    });
+
+    it('should reject invalid namespace expressions', function() {
+      expect(function() {
+        runCliAndCaptureOutput({
+          templates: [{ name: 'safe', source: '' }],
+          namespace: 'App.ns;global.__xjpjNamespace=1;//'
+        });
+      }).to.throw(/Invalid namespace/);
+    });
+
+    it('should sanitize sourceMappingURL comment values', function() {
+      var oldPrecompile = FullHandlebars.precompile;
+      var oldWriteFileSync = fs.writeFileSync;
+      FullHandlebars.precompile = function() {
+        return {
+          code: '""',
+          map: '{"version":3,"sources":[],"names":[],"mappings":""}'
+        };
+      };
+      fs.writeFileSync = function() {};
+
+      var output;
+      try {
+        output = runCliAndCaptureOutput({
+          templates: [{ name: 'safe', source: '' }],
+          map: 'good.js.map\n;global.__xjpjMap=1;//'
+        });
+      } finally {
+        FullHandlebars.precompile = oldPrecompile;
+        fs.writeFileSync = oldWriteFileSync;
+      }
+
+      expect(output).to.not.match(
+        /sourceMappingURL=[^\n]*\n;global\.__xjpjMap=1/
+      );
+    });
+  });
 });

spec/runtime.js

@@ -54,6 +54,13 @@ describe('runtime', function() {
         /Template was precompiled with an older version of Handlebars than the current runtime/
       );
     });
+
+    it('should safely resolve missing partial map entries', function() {
+      equal(
+        Handlebars.VM.resolvePartial(undefined, {}, { name: 'missing' }),
+        undefined
+      );
+    });
   });
 
   describe('#child', function() {
@@ -91,13 +98,13 @@ describe('runtime', function() {
     it('should expose child template', function() {
       var template = Handlebars.compile('{{#foo}}bar{{/foo}}');
       // Calling twice to hit the non-compiled case.
-      equal(template._child(1)(), 'bar');
-      equal(template._child(1)(), 'bar');
+      equal(template._child(0)(), 'bar');
+      equal(template._child(0)(), 'bar');
     });
     it('should render depthed content', function() {
       var template = Handlebars.compile('{{#foo}}{{../bar}}{{/foo}}');
       // Calling twice to hit the non-compiled case.
-      equal(template._child(1, undefined, [], [{ bar: 'baz' }])(), 'baz');
+      equal(template._child(0, undefined, [], [{ bar: 'baz' }])(), 'baz');
     });
   });
 

spec/security.js

@@ -133,11 +133,13 @@ describe('security issues', function() {
       '{{__defineGetter__}}',
       '{{__defineSetter__}}',
       '{{__lookupGetter__}}',
+      '{{__lookupSetter__}}',
       '{{__proto__}}',
       '{{lookup this "constructor"}}',
       '{{lookup this "__defineGetter__"}}',
       '{{lookup this "__defineSetter__"}}',
       '{{lookup this "__lookupGetter__"}}',
+      '{{lookup this "__lookupSetter__"}}',
       '{{lookup this "__proto__"}}'
     ];
 
@@ -422,6 +424,159 @@ describe('security issues', function() {
         .toCompileTo('c');
     });
   });
+
+  describe('GHSA-2qvq-rjwj-gvw9: partial resolution must not use polluted prototypes', function() {
+    if (!Handlebars.compile) {
+      return;
+    }
+
+    afterEach(function() {
+      delete Object.prototype.widget;
+    });
+
+    it('should not resolve partial names from Object.prototype', function() {
+      // eslint-disable-next-line no-extend-native
+      Object.prototype.widget = '<img src=x onerror="alert(1)">';
+
+      expect(function() {
+        Handlebars.compile('<div>{{> widget}}</div>')({});
+      }).to.throw(/could not be found/);
+    });
+  });
+
+  describe('GHSA-2w6w-674q-4c4q, GHSA-xhpv-hc6g-r9c6, GHSA-3mfm-83xf-c92r: untrusted AST inputs', function() {
+    if (!Handlebars.compile) {
+      return;
+    }
+
+    function createInjectedProgram() {
+      return {
+        type: 'Program',
+        body: [
+          {
+            type: 'MustacheStatement',
+            escaped: true,
+            strip: {
+              open: false,
+              close: false
+            },
+            path: {
+              type: 'PathExpression',
+              data: false,
+              depth: 0,
+              parts: ['lookup'],
+              original: 'lookup'
+            },
+            params: [
+              {
+                type: 'PathExpression',
+                data: false,
+                depth: 0,
+                parts: [],
+                original: 'this'
+              },
+              {
+                type: 'NumberLiteral',
+                value: '{},{})) + (Function) + (({}',
+                original: 1
+              }
+            ]
+          }
+        ]
+      };
+    }
+
+    it('should reject AST NumberLiteral type confusion in compile()', function() {
+      expect(function() {
+        var template = Handlebars.compile(createInjectedProgram());
+        template({});
+      }).to.throw(/Invalid AST/);
+    });
+
+    it('should reject AST objects passed via dynamic partial lookup', function() {
+      expect(function() {
+        var template = Handlebars.compile('{{> (lookup . "payload")}}');
+        template({
+          payload: createInjectedProgram()
+        });
+      }).to.throw(/Invalid AST|could not be found/);
+    });
+  });
+
+  describe('GHSA-442j-39wm-28r2: lookup must return checked value', function() {
+    it('should use the validated value from lookupProperty() in compat mode', function() {
+      var input = { child: {} };
+      var readCount = 0;
+      Object.defineProperty(input, 'unstable', {
+        enumerable: true,
+        get: function() {
+          readCount++;
+          return readCount === 1 ? 'first-read' : 'second-read';
+        }
+      });
+
+      expectTemplate('{{#with child}}{{unstable}}{{/with}}')
+        .withInput(input)
+        .withCompileOptions({ compat: true })
+        .toCompileTo('first-read');
+    });
+  });
+
+  describe('GHSA-9cx6-37pm-9jff: malformed decorators should fail safely', function() {
+    if (!Handlebars.compile) {
+      return;
+    }
+
+    it('should throw a controlled error for unknown decorators', function() {
+      var template = Handlebars.compile('{{*notRegistered}}');
+      expect(function() {
+        template({});
+      }).to.throw(/Missing decorator|not registered/);
+    });
+  });
+
+  describe('GHSA-new: @partial-block must not resolve from polluted prototype', function() {
+    if (!Handlebars.compile) {
+      return;
+    }
+
+    afterEach(function() {
+      delete Object.prototype['partial-block'];
+    });
+
+    it('should not resolve @partial-block from Object.prototype', function() {
+      // eslint-disable-next-line no-extend-native
+      Object.prototype['partial-block'] = '<img src=x onerror="alert(1)">';
+
+      expect(function() {
+        Handlebars.compile('{{> @partial-block}}')({});
+      }).to.throw(/could not be found/);
+    });
+
+    it('should not resolve @partial-block from Object.prototype inside a partial', function() {
+      // eslint-disable-next-line no-extend-native
+      Object.prototype['partial-block'] = '<img src=x onerror="alert(1)">';
+
+      Handlebars.registerPartial('testPartial', '{{> @partial-block}}');
+      try {
+        expect(function() {
+          Handlebars.compile('{{> testPartial}}')({});
+        }).to.throw(/could not be found/);
+      } finally {
+        Handlebars.unregisterPartial('testPartial');
+      }
+    });
+
+    it('should still render legitimate @partial-block content', function() {
+      Handlebars.registerPartial('wrapper', '<div>{{> @partial-block}}</div>');
+      try {
+        var result = Handlebars.compile('{{#> wrapper}}hello{{/wrapper}}')({});
+        expect(result).to.equal('<div>hello</div>');
+      } finally {
+        Handlebars.unregisterPartial('wrapper');
+      }
+    });
+  });
 });
 
 function wrapToAdjustContainer(precompiledTemplateFunction) {

spec/umd-runtime.html

@@ -54,7 +54,7 @@
           }
           var runner = mocha.run();
 
-          //Reporting for saucelabs
+          // Reporting to test-runner
           var failedTests = [];
           runner.on('end', function(){
             window.mochaResults = runner.stats;

spec/umd.html

@@ -74,7 +74,7 @@
             }
             var runner = mocha.run();
 
-            //Reporting for saucelabs
+            // Reporting to test-runner
             var failedTests = [];
             runner.on('end', function(){
               window.mochaResults = runner.stats;

tasks/metrics.js

@@ -1,4 +1,4 @@
-const metrics = require('../bench');
+const metrics = require('../tests/bench');
 const { createRegisterAsyncTaskFn } = require('./util/async-grunt-task');
 
 module.exports = function(grunt) {

tasks/task-tests/README.md

@@ -1 +0,0 @@
-Use `mocha tasks/task-tests` to run these tests

tasks/tests/README.md

@@ -0,0 +1 @@
+Use `mocha tasks/tests` to run these tests

tasks/util/exec-file.js

@@ -23,7 +23,8 @@ async function execFileWithInheritedOutput(command, args) {
   return new Promise((resolve, reject) => {
     const resolvedCommand = preferLocalDependencies(command);
     const child = childProcess.spawn(resolvedCommand, args, {
-      stdio: 'inherit'
+      stdio: 'inherit',
+      shell: process.platform === 'win32' // Workaround for CVE-2024-27980
     });
     child.on('exit', code => {
       if (code !== 0) {

tests/.eslintrc.js

@@ -0,0 +1,10 @@
+module.exports = {
+  root: true,
+  extends: ['eslint:recommended', 'prettier'],
+  env: {
+    node: true
+  },
+  parserOptions: {
+    ecmaVersion: 6
+  }
+};

tests/bench/precompile-size.js

@@ -3,7 +3,7 @@ var _ = require('underscore'),
 
 module.exports = function(grunt, callback) {
   // Deferring to here in case we have a build for parser, etc as part of this grunt exec
-  var Handlebars = require('../lib');
+  var Handlebars = require('../../lib');
 
   var templateSizes = {};
   _.each(templates, function(info, template) {

tests/bench/throughput.js

@@ -145,7 +145,7 @@ function makeSuite(bench, name, template, handlebarsOnly) {
 
 module.exports = function(grunt, callback) {
   // Deferring load incase we are being run inline with the grunt build
-  Handlebars = require('../lib');
+  Handlebars = require('../../lib');
 
   console.log('Execution Throughput');
   runner(grunt, makeSuite, function(times, scaled) {

tests/bench/util/benchwarmer.js

@@ -11,8 +11,6 @@ function BenchWarmer() {
   this.errors = {};
 }
 
-var print = require('util').print;
-
 BenchWarmer.prototype = {
   winners: function(benches) {
     return Benchmark.filter(benches, 'fastest');
@@ -69,7 +67,7 @@ BenchWarmer.prototype = {
 
         self.startLine('');
 
-        print('\n');
+        console.log('\n');
         self.printHeader('scaled');
         _.each(self.scaled, function(value, name) {
           self.startLine(name);
@@ -78,7 +76,7 @@ BenchWarmer.prototype = {
             self.writeValue(value[lang] || '');
           });
         });
-        print('\n');
+        console.log('\n');
 
         var errors = false,
           prop,
@@ -94,16 +92,16 @@ BenchWarmer.prototype = {
         }
 
         if (errors) {
-          print('\n\nErrors:\n');
+          console.log('\n\nErrors:\n');
           Object.keys(self.errors).forEach(function(prop) {
             if (self.errors[prop].error.message !== 'EWOT') {
               bench = self.errors[prop];
-              print('\n' + bench.name + ':\n');
-              print(bench.error.message);
+              console.log('\n' + bench.name + ':\n');
+              console.log(bench.error.message);
               if (bench.error.stack) {
-                print(bench.error.stack.join('\n'));
+                console.log(bench.error.stack.join('\n'));
               }
-              print('\n');
+              console.log('\n');
             }
           });
         }
@@ -112,7 +110,7 @@ BenchWarmer.prototype = {
       }
     });
 
-    print('\n');
+    console.log('\n');
   },
 
   scaleTimes: function() {
@@ -163,11 +161,11 @@ BenchWarmer.prototype = {
     }
 
     if (winners) {
-      print('WINNER(S)');
+      console.log('WINNER(S)');
       horSize = horSize + 'WINNER(S)'.length;
     }
 
-    print('\n' + new Array(horSize + 1).join('-'));
+    console.log('\n' + new Array(horSize + 1).join('-'));
   },
 
   startLine: function(name) {
@@ -179,8 +177,8 @@ BenchWarmer.prototype = {
 
     this.currentBenches = [];
 
-    print(winners.join(', '));
-    print('\n');
+    console.log(winners.join(', '));
+    console.log('\n');
 
     if (name) {
       this.writeValue(name);
@@ -216,7 +214,7 @@ BenchWarmer.prototype = {
   writeValue: function(out) {
     var padding = this.benchSize - out.length + 1;
     out = out + new Array(padding).join(' ');
-    print(out);
+    console.log(out);
   }
 };
 

tests/browser/.eslintrc.js

@@ -0,0 +1,5 @@
+module.exports = {
+  parserOptions: {
+    ecmaVersion: 2020
+  }
+};

tests/browser/README.md

@@ -0,0 +1,13 @@
+# Browser Tests with Playwright
+
+These tests execute Mocha tests from the `spec`-folder in multiple browsers.
+
+## Using Docker
+
+Execute the following commands in the project root:
+
+```bash
+npm install
+npx grunt prepare
+docker run -it --rm --volume $(pwd):/srv/app --workdir /srv/app --ipc=host mcr.microsoft.com/playwright:v1.44.1-jammy npm run test:browser
+```

tests/browser/playwright.config.js

@@ -0,0 +1,28 @@
+const { devices } = require('@playwright/test');
+
+/** @type {import('@playwright/test').PlaywrightTestConfig} */
+const config = {
+  testMatch: ['spec.js'],
+  projects: [
+    {
+      name: 'chromium',
+      use: { ...devices['Desktop Chrome'] }
+    },
+    {
+      name: 'firefox',
+      use: { ...devices['Desktop Firefox'] }
+    },
+    {
+      name: 'webkit',
+      use: { ...devices['Desktop Safari'] }
+    }
+  ],
+  reporter: 'list',
+  webServer: {
+    command: 'npm run test:serve',
+    port: 9999,
+    reuseExistingServer: false
+  }
+};
+
+module.exports = config;

tests/browser/spec.js

@@ -0,0 +1,33 @@
+const { test, expect } = require('@playwright/test');
+
+async function waitForMochaAndAssertResult(page) {
+  await page.waitForFunction(() => window.mochaResults); // eslint-disable-line no-undef
+  const mochaResults = await page.evaluate('window.mochaResults');
+
+  expect(mochaResults.failures).toBe(0);
+}
+
+test('Spec handlebars.js', async ({ page }) => {
+  await page.goto(`/spec/?headless=true`);
+  await waitForMochaAndAssertResult(page);
+});
+
+test('Spec handlebars.amd.js (AMD)', async ({ page }) => {
+  await page.goto(`/spec/amd.html?headless=true`);
+  await waitForMochaAndAssertResult(page);
+});
+
+test('Spec handlebars.runtime.amd.js (AMD)', async ({ page }) => {
+  await page.goto(`/spec/amd-runtime.html?headless=true`);
+  await waitForMochaAndAssertResult(page);
+});
+
+test('Spec handlebars.js (UMD)', async ({ page }) => {
+  await page.goto(`/spec/umd.html?headless=true`);
+  await waitForMochaAndAssertResult(page);
+});
+
+test('Spec handlebars.runtime.js (UMD)', async ({ page }) => {
+  await page.goto(`/spec/umd-runtime.html?headless=true`);
+  await waitForMochaAndAssertResult(page);
+});

tests/integration/README.md

@@ -1,12 +1,10 @@
 Add a new integration test by creating a new subfolder
 
-Add a file "test.sh" to that runs the test. "test.sh" should exit with a non-zero exit code 
+Add a file "test.sh" to that runs the test. "test.sh" should exit with a non-zero exit code
 and display an error message, if something goes wrong.
 
-* An integration test should reflect real-world setups that use handlebars.
-* It should compile a minimal template and compare the output to an expected output.
-* It should use "../.." as dependency for Handlebars so that the currently built library is used.
+- An integration test should reflect real-world setups that use handlebars.
+- It should compile a minimal template and compare the output to an expected output.
+- It should use "../.." as dependency for Handlebars so that the currently built library is used.
 
-Currently, integration tests are only running on Linux, especially in travis-ci.
-
-  
+Currently, integration tests are only running on Linux, especially in our CI GitHub action.