# What changed in handlebars

> 19 changes in handlebars 4 from its official release notes, upgrade guides and advisories: 2 breaking, 14 security. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/handlebars/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## handlebars 4

### Breaking changes

- Special properties on context data are no longer trusted. (4.7.10) — [release notes](https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10), [security advisory](https://github.com/advisories/GHSA-P8WG-VRV2-V86F)
- Iteration is lazy, like for...of, rather than copying iterables into an array; values added while the block renders are visited too. Whitespace is also stripped in linear time. (4.7.10) — [release notes](https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10)

### Security

- AST values are validated in the compiler instead of the parser. (4.7.10) — [release notes](https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10), [security advisory](https://github.com/advisories/GHSA-8R5X-FM3F-WHWJ)
- The Compiler and Visitor dispatch only known node types. (4.7.10) — [release notes](https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10)
- Only partials that are template strings are compiled. (4.7.10) — [release notes](https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10)
- Precompiled output escapes `<!--` and `<script`. (4.7.10) — [release notes](https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10), [security advisory](https://github.com/advisories/GHSA-XW65-4HP5-5HC7)
- The source map URL is sanitized when minifying. (4.7.10) — [release notes](https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.10)
- Fixes security issues documented in the linked advisories. (4.7.9) — [release notes](https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9)
- Handlebars.js has a Property Access Validation Bypass in container.lookup (4.7.9) — [security advisory](https://github.com/advisories/GHSA-442J-39WM-28R2)
- Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry (4.7.9) — [security advisory](https://github.com/advisories/GHSA-7RX3-28CR-V5WH)
- Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation (4.7.9) — [security advisory](https://github.com/advisories/GHSA-9CX6-37PM-9JFF)
- Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options (4.7.9) — [security advisory](https://github.com/advisories/GHSA-XJPJ-3MR7-GCPF)
- Handlebars.js has JavaScript Injection via AST Type Confusion (4.7.9) — [security advisory](https://github.com/advisories/GHSA-2W6W-674Q-4C4Q)
- Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block (4.7.9) — [security advisory](https://github.com/advisories/GHSA-3MFM-83XF-C92R)
- Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial (4.7.9) — [security advisory](https://github.com/advisories/GHSA-XHPV-HC6G-R9C6)
- Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection (4.7.9) — [security advisory](https://github.com/advisories/GHSA-2QVQ-RJWJ-GVW9)

### Tooling

- The type of hash is now Record<string, any>. (4.7.9) — [release notes](https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9)

### Fixes and other changes

- Fixes handling of non-contiguous program indices. (4.7.9) — [release notes](https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9)
- RuntimeOptions now also accepts string partials. (4.7.9) — [release notes](https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9)