Update Handlebars dependency to version 4

[jaswilli]

• Handlebars < 4.0 shipped with a version of uglify-js that has some issues. Upgrading to 4 brings in a fixed version of uglify-js.

[ErisDS]

I'm actually holding off from doing this on purpose as there's a breaking change in 4 that I haven't properly thought through the consequences of yet.

Instead, I'm going to be pushing a few changes back to the v3 branch of handlebars short term, publish a new version of express-hbs to use that, then also do v4.

S'been on my todo list for the past week, will try to get to it asap!

[ErisDS]

a few changes back

For clarity, there's a fix for a vulnerability in handlebars + the need to update uglify-js

[jaswilli]

Awesome--will close this.

Out of curiosity, what's the breaking change? The tests pass and nothing really jumped out of from changelog from v3 -> v4.

[ErisDS]

Ha, it's actually a change I requested (and am very happy about) however it has the potential to cause weird bugs in old themes for sure: handlebars-lang/handlebars.js#1028

From the 4.0 compat notes:

Depthed paths are now conditionally pushed on to the stack. If the helper uses the same context, then a new stack is not created. This leads to behavior that better matches expectations for helpers like if that do not seem to alter the context. Any instances of ../ in templates will need to be checked for the correct behavior under 4.0.0. In general templates will either reduce the number of ../ instances or leave them as is. See #1028.

I think in all likelihood that this will only a affect very, very small number of people, because it was easier to workaround this weirdness than to understand and use it in templates. Casper has some inconsistencies between the author.hbs and tag.hbs templates which I have never cleaned up for this exact reason.

However, I figure it's safer to update v3 to be secure for now, and then do a bit of data mining on popular themes to see if any of them are affected before making the breaking change, possibly as the part of the 0.8 release for Ghost. That also gives anyone else depending on express-hbs the same opportunity = a secure upgrade and then a breaking one.

[ErisDS]

Turns out trying to publish a security fix to v3 of handlebars is not easy enough to warrant doing it - can you reopen this?

[jaswilli]

I didn't expect it to come back so I deleted the branch. I opened a new PR #92.