Skip to content

Bump handlebars from 4.0.12 to 4.1.2 in /examples/team - #14

Merged
jaapbakker88 merged 1 commit into
masterfrom
dependabot/npm_and_yarn/examples/team/handlebars-4.1.2
Jul 4, 2019
Merged

jaapbakker88 merged 1 commit into
masterfrom
dependabot/npm_and_yarn/examples/team/handlebars-4.1.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 6, 2019 •

Copy link
Copy Markdown
Contributor

Bumps handlebars from 4.0.12 to 4.1.2.

Changelog

Sourced from handlebars's changelog.

v4.1.2 - April 13th, 2019

Chore/Test:

  • #1515 - Port over linting and test for typings (@​zimmi88)
  • chore: add missing typescript dependency, add package-lock.json - 594f1e3
  • test: remove safari from saucelabs - 871accc

Bugfixes:

  • fix: prevent RCE through the "lookup"-helper - cd38583

Compatibility notes:

Access to the constructor of a class thought {{lookup obj "constructor" }} is now prohibited. This closes
a leak that only half closed in versions 4.0.13 and 4.1.0, but it is a slight incompatibility.

This kind of access is not the intended use of Handlebars and leads to the vulnerability described
in #1495. We will not increase the major version, because such use is not intended or documented,
and because of the potential impact of the issue (we fear that most people won't use a new major version
and the issue may not be resolved on many systems).

Commits

v4.1.1 - March 16th, 2019

Bugfixes:

  • fix: add "runtime.d.ts" to allow "require('handlebars/runtime')" in TypeScript - 5cedd62

Refactorings:

  • replace "async" with "neo-async" - 048f2ce
  • use "substring"-function instead of "substr" - 445ae12

Compatibility notes:

  • This is a bugfix release. There are no breaking change and no new features.

Commits

v4.1.0 - February 7th, 2019

New Features

  • import TypeScript typings - 27ac1ee

Security fixes:

  • disallow access to the constructor in templates to prevent RCE - 42841c4, #1495

Housekeeping

  • chore: fix components/handlebars package.json and auto-update on release - bacd473
  • chore: Use node 10 to build handlebars - 78dd89c
  • chore/doc: Add more release docs - 6b87c21
... (truncated)
Commits
  • 10b5fcf v4.1.2
  • dd0144c Update release notes
  • 594f1e3 chore: add missing typescript dependency, add package-lock.json
  • 871accc test: remove safari from saucelabs
  • cd38583 fix: prevent RCE through the "lookup"-helper
  • c454d94 Merge pull request #1515 from zimmi88/4.x-typings-lint
  • 9cfb5dd Merge pull request #1516 from phil-davis/revert-double-release-notes
  • be44246 Remove triplicate of v4.0.12 release notes
  • 002561b Revert "Update release notes"
  • 3fb6687 Port over linting and test for typings
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 6, 2019
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/examples/team/handlebars-4.1.2 branch from fe66e37 to e42b348 Compare July 4, 2019 09:14
@jaapbakker88
jaapbakker88 merged commit 90b2b1b into master Jul 4, 2019
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/examples/team/handlebars-4.1.2 branch July 4, 2019 09:17
oliverlaz added a commit that referenced this pull request Nov 4, 2026
…79..BC-084 (#3377)

Ticket: https://linear.app/stream/issue/REACT-1307

## Goal

Make the v14 → v15 guide the input of a prebuilt migration prompt: a
coding agent gets one URL plus the user's repo and has to migrate
accurately.

## Implementation details

**`ai-docs/ai-migration-v14-v15.md`, restructured for agents.** Section
numbers and existing anchors are unchanged.
- Rules for the agent, and companion documents with raw URLs: the new
stream-chat v9 → v10 agent guide, the JS reference, this reference and
the i18n guide.
- A phased workflow, a definition of done and a report template.
- A detection block keyed on v14 names. It searches the whole repo,
including CSS, `package.json`, CI files and `.nvmrc`.
- A quick reference of about 80 rows.
- A Detect column on all rows of the "Breaks that do not fail to
compile" table, plus 6 new rows.
- A closing Verification section, placed before the index:
- a leftover-identifier grep over about 150 v14 names, plus a CSS grep;
- single-copy checks for `stream-chat`, `@stream-io/state-store` and
`dayjs`;
  - a runtime smoke list.

**`ai-docs/v15-breaking-changes.md`: missed changes added since #3346**
(numbered from BC-079: master's BC-078 is the `CustomCommandData` /
`DefaultCommandData` removal)
- BC-079: `useUserRole().canEdit` is now the permission alone.
- BC-080: edit, copy and download rules moved onto
`defaultMessageActionSet` items as `isVisible`.
- BC-081: the quote renders above a poll; poll messages get the
`--has-poll` class.
- BC-082: custom preview slots mount only while their preview is
visible.
- BC-083: message action handlers reject on failure (#3360, #3362).
- BC-084: the first-message padding is removed (#3370).
- Explicit `bc-NNN` anchors; the index's links did not resolve before.

The guide's index and the reference now hold the same 84 IDs.

**Corrections**
- Reconnect: `client.connectionRecovery` reloads the active channels and
threads. The guide now warns that reloading again on
`connection.recovered` reloads twice.
- The §9 typing slice is `Record<string, EventPayload<'typing.start'>>`,
so the type guard is gone.
- rc pins and rc history are removed.

**Other files**
- `ai-docs/ai-migration.md` (v13 → v14) has a one-line banner pointing
to the v14 → v15 guide.
- `AGENTS.md`: the stale "Per-component request-handler props removed"
reference now links to `#14-request-handlers`.

## How it was checked
- Every identifier in the guide was checked against `src`,
stream-chat-js `release-v10` and `@stream-io/i18n` / `state-store`. No
stale or invented name remains on the "after" side.
- All links resolve: 99 internal links in the guide, 84 in the
reference, and the 5 links to stream-chat-js anchors.
- The detection and leftover greps were run on a synthetic v14 app and
on `examples/`.
- The new snippets type-check, and prettier passes.

## Notes
- The raw link to the stream-chat-js guide resolves once its PR is
merged into `release-v10`.
- The local `node_modules/stream-chat` is rc.28, while `package.json`
wants rc.29.

## UI Changes

None (docs only).


## Related PRs

The three guides link to each other; review together:
- stream-chat-js: GetStream/stream-chat-js#1984
(merge first: the React and RN guides link to its raw URL)
- stream-chat-react:
#3377
- stream-chat-react-native:
GetStream/stream-chat-react-native#3918


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
<!-- coderabbit-ai-generated:v1 -->

## Summary by CodeRabbit

* **Documentation**
* Clarified which version upgrades are covered by the migration guide
and linked readers to the guide for upgrading from v14 to v15.
* Updated the breaking-changes reference with newly documented changes
and clarified that active channels reload through the client after
reconnect.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant