Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade to latest handlebars.js (4.7.7) #855

Merged
merged 1 commit into from Sep 25, 2021

Conversation

loganrosen
Copy link
Contributor

Fixes #848. There's a critical vulnerability in handlebars.js < 4.7.7, so it's important that we upgrade the Java library/publish a new version as soon as possible.

mvn clean install succeeds.

@coveralls
Copy link

Coverage Status

Coverage remained the same at 91.458% when pulling c21e68a on loganrosen:handlebars-4.7.7 into 1d44be3 on jknack:master.

@Sachpat
Copy link

Sachpat commented Jun 18, 2021

Hi, can we have this merged soon and have the next version of handlebars which has updated handlebars.js? As our security scans continue to report CVE-2021-23369 against the latest version of handlebars.

@loganrosen
Copy link
Contributor Author

@jknack Would you be able to merge this and cut a new version to address the security concerns?

@benwaxway
Copy link

What are the options, except building our own (really not wanted) to get out of this ? Won't also be unable to defer security for too long... Kinda worried as no new commit in more than a year... is it possible to reclaim the project or fork it and "declare" the fork new source of truth (a bit pushy maybe...;-))

@Sachpat
Copy link

Sachpat commented Jul 12, 2021

Hi guys @jknack It would be really helpful if we merge this PR and release the new version soon. If needed I can offer some help regarding the same :) . As stated here #855 (comment), our security scans continue to report CVE-2021-23369 against the latest version of handlebars.

@Rob-Conan
Copy link

Can this MR be merged please? I have multiple security scans failing as a result of this issue.

@ghost
Copy link

ghost commented Sep 23, 2021

Hi, another request for this to be merged. Our scans are currently reporting 4.7.6 as a vulnerability

@jknack jknack added this to the 4.2.1 milestone Sep 25, 2021
@jknack jknack merged commit 8f36cae into jknack:master Sep 25, 2021
@loganrosen loganrosen deleted the handlebars-4.7.7 branch September 29, 2021 19:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4.2 release is vulnerable to CVE-2021-23369 should update to handlebars 4.7.7
7 participants