Skip to content

Commit e47b236

Browse files
author
handlebars-lang
committed
Update release notes
1 parent f37c599 commit e47b236

1 file changed

Lines changed: 20 additions & 1 deletion

File tree

‎release-notes.md‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,26 @@
22

33
## Development
44

5-
[Commits](https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...master)
5+
[Commits](https://github.com/handlebars-lang/handlebars.js/compare/v4.7.10...master)
6+
7+
## v4.7.10 - October 5th, 2026
8+
- security: Sanitize the source map URL when minifying - f37c599
9+
- security: Iterate lazily in #each and strip whitespace in linear time - 812c226
10+
- security: Escape `<!--` and `<script` in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7
11+
- security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f
12+
- security: Only compile partials that are template strings - c28ee7a
13+
- security: Only dispatch known node types in the Compiler and Visitor - 7d501a5
14+
- security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj
15+
- Clarify that --root does not restrict filesystem access - 0fcf25c
16+
- Bump minimist to ^1.2.8 - ea8ed82
17+
- Fix Ruby component publishing documentation - d069c1c
18+
- Fix Composer component definition - 6714e07
19+
20+
Compatibility notes:
21+
- `{{#each}}` iterates iterables such as `Map`, `Set` and generators lazily, like `for...of`, instead of
22+
copying them into an array first. Values added to the iterable while the block renders are now visited too.
23+
24+
[Commits](https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...v4.7.10)
625

726
## v4.7.9 - March 26th, 2026
827
- fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2

0 commit comments

Comments
 (0)