npm / handlebars

handlebars

What changed in handlebars 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.

2 breaking14 security1 tooling2 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

handlebars 419 changes

Special properties on context data are no longer trusted.
4.7.10release notes security advisory
Iteration is lazy, like for...of, rather than copying iterables into an array; values added while the block renders are visited too. Whitespace is also stripped in linear time.
4.7.10release notes

AST values are validated in the compiler instead of the parser.
4.7.10release notes security advisory
The Compiler and Visitor dispatch only known node types.
4.7.10release notes
Only partials that are template strings are compiled.
4.7.10release notes
Precompiled output escapes <!-- and <script.
4.7.10release notes security advisory
The source map URL is sanitized when minifying.
4.7.10release notes
Fixes security issues documented in the linked advisories.
4.7.9release notes
Handlebars.js has a Property Access Validation Bypass in container.lookup
4.7.9security advisory
Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry
4.7.9security advisory
Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
4.7.9security advisory
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
4.7.9security advisory
Handlebars.js has JavaScript Injection via AST Type Confusion
4.7.9security advisory
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
4.7.9security advisory
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
4.7.9security advisory
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
4.7.9security advisory