Skip to content

API Explorer 1.1.19 — official Handlebars security fixes

Latest
Latest

Choose a tag to compare

View all tags
@chen21019 chen21019 released this 20 Oct 02:06
Immutable release. Only release title and notes can be modified.
v1.1.19
This tag was signed with the committer’s verified signature.
chen21019 Cheng-Chen, Chen
SSH Key Fingerprint: nF0fDZ8EQGL+GjPXONcQ9qd4VseNYmcscqwvax867AE
Verified
Learn about vigilant mode.
dda3fe8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This Server-embedded compatibility release updates the build compiler and bundled runtime to official Handlebars 4.7.10, addressing CVE-2026-106444, CVE-2026-106445 and CVE-2026-106446.

Tracked templates and partials are precompiled during the build. The browser continues to receive only the runtime and precompiled functions; remote API data does not enter a compiler. The API, DOM, archive layout and en-US/zh-TW contracts remain compatible.

Producer commit: dda3fe8a806d9736de771d325e3ca98ab4067cd2.
Signed tag: v1.1.19.
Producer CI and exact tested artifact, CodeQL, reviewed change.

All three required checks passed: Analyze (actions), Analyze (javascript-typescript), and build-test-scan. Validation includes 11 security tests, four emitted-bundle/locale tests, and a direct byte comparison of two complete builds. Source and product scans each reported zero secrets, Critical and High findings; runtime and full npm audits reported zero vulnerabilities.

The attached archive is the original artifact retained by this producer CI, with no publication rebuild. Size: 641,957 bytes. SHA256: d1602ab6033512f0b86dc8ceafee2061364ce2fc5da2a9b7119f900d9e0f3c25.

Assets include the package CycloneDX SBOM, source/product scans, npm audits, validation log, source identity, third-party notices and SHA256SUMS. Server adopts this component through its separate coordinated integration gate.

Assets 19
Loading