4.4.0

Highlights

🔒 Security

• Bumped handlebars to 4.7.10, which addresses CVE-2026-106445 (GHSA-p8wg-vrv2-v86f), GHSA-8r5x-fm3f-whwj and GHSA-xw65-4hp5-5hc7. Please upgrade. (#283)

⚙️ Handlebars options per instance

• compileOptions forwards options such as strict, noEscape or preventIndent to handlebars.compile() for every view and layout. (#268)
• runtimeOptions forwards runtime options to the compiled template. Use it to restore handlebars' safer prototype-access defaults by setting allowProtoMethodsByDefault and allowProtoPropertiesByDefault to false. (#284)

var hbs = require('hbs').create(null, {
  compileOptions: { strict: true },
  runtimeOptions: {
    allowProtoMethodsByDefault: false,
    allowProtoPropertiesByDefault: false
  }
});

app.engine('hbs', hbs.__express);

🧩 Clearer errors

• A settings property in the data passed to res.render shadows the reserved settings Express provides to view engines. hbs now fails with a descriptive error pointing at the conflicting key instead of a cryptic Path must be a string. (#291)

📚 Documentation

• New Layouts section covering the automatic layout, {{{body}}}, the layout option per render and app-wide via view options. (#294)
• New Template inheritance section showing nested, reusable layouts with handlebars partial blocks and inline partials, no extra hbs feature needed. (#294)
• New Reserved render data keys section and a Security section summarising the prototype-access and escaping defaults. (#291, #268, #284)

What's Changed

• build(deps): bump handlebars from 4.7.9 to 4.7.10 by @mhassan1 in #283
• build(deps): bump github/codeql-action/init from 4.37.4 to 4.38.2 by @dependabot[bot] in #280
• build(deps): bump github/codeql-action/upload-sarif from 4.37.8 to 4.38.2 by @dependabot[bot] in #281
• build(deps): bump github/codeql-action/autobuild from 4.37.4 to 4.38.2 by @dependabot[bot] in #279
• build(deps): bump github/codeql-action/analyze from 4.37.4 to 4.38.2 by @dependabot[bot] in #278
• feat: add compileOptions to pass options to handlebars.compile() by @UlisesGascon in #268
• feat: add runtimeOptions to set handlebars runtime options by @UlisesGascon in #284
• ci: add Node.js 26 to the test matrix by @UlisesGascon in #293
• docs: document template inheritance via handlebars partial blocks by @UlisesGascon in #294
• fix: clear error when a "settings" render local shadows Express settings by @UlisesGascon in #291
• Release: 4.4.0 by @UlisesGascon in #285

New Contributors

• @mhassan1 made their first contribution in #283

Full Changelog: v4.3.1...v4.4.0