Broken with handlebars 4.6.0

Handlebars 4.6.0 breaks the templating as far as I can tell.

Presumably because of the breaking change in: https://github.com/wycats/handlebars.js/pull/1633

I have a custom template that extends the spritesheet-template and now it’s compiled to a file of mostly comments:

// SCSS variables are information about icon's compiled state, stored under its original file name
//
// .icon-home {
//   width: $icon-home-width;
// }
//
// The large array-like variables contain all information about a single icon
// $icon-home: x y offset_x offset_y width height total_width total_height image_path;
//
// At the bottom of this section, we provide information about the spritesheet itself
// $spritesheet: width height image $spritesheet-sprites;
$: ;
$: ;
$: '';
$: ();
$: (, , '', $ );
$: ;
$: ;
$: '';
$: ();
$: (, , '', $ );
// These "retina group" variables are mappings for the naming and pairing of normal and retina sprites.
//
// The list formatted variables are intended for mixins like `retina-sprite` and `retina-sprites`.
$: ();

Obviously that’s not great!

I’m not really a node dev so can’t really see what’s going on and how to fix it, but I can confirm that installing handlebars 4.5.3 allows the template to compile fine.

[twolfson]

Alright, that fixed version has been released in 10.4.3. Thanks for the bug report!

[nknapp]

Handlebars 4.7.0 has been release with options to disable prototype restrictions: https://handlebarsjs.com/api-reference/runtime-options.html#options-to-control-prototype-access

Please be aware the you are potentially opening up ways to crash your servers or maybe even remote code execution for people who can inject templates into your system.