Update dependency express-handlebars to v5 [SECURITY] - abandoned

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
express-handlebars	^3.1.0 -> ^5.0.0

GitHub Vulnerability Alerts

CVE-2021-32820

Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability is somewhat restricted in that only files with existing extentions (i.e. file.extension) can be included, files that lack an extension will have .handlebars appended to them. For complete details refer to the referenced GHSL-2021-018 report. Notes in documentation have been added to help users avoid this potential information exposure vulnerability.

A fix is discussed in https://github.com/express-handlebars/express-handlebars/pull/163

---

Release Notes

express-handlebars/express-handlebars

v5.3.1

Compare Source

Bug Fixes

• add note about security (78c47a2)

v5.3.0

Compare Source

Features

• Add partialsDir.rename option (#​151) (1a6771b)

5.2.1 (2021-02-16)

Bug Fixes

• deps: update dependency handlebars to ^4.7.7 (1930523)

v5.2.1

Compare Source

Bug Fixes

• deps: update dependency handlebars to ^4.7.7 (1930523)

v5.2.0

Compare Source

Features

• allow views to be an array (a9f4aaa)

v5.1.0

Compare Source

Features

• add encoding option (9e516c3)

v5.0.0

Compare Source

Bug Fixes

• update code to es2015+ (e5a08ee)
• update node support (ea30d53)

BREAKING CHANGES

• Drop support for node versions below v10

4.0.6 (2020-07-06)

Bug Fixes

• add runtimeOptions (b64284f)

4.0.5 (2020-07-03)

Bug Fixes

• overwrite past settings.views (c27f1b0)
• renderView returns promise when no callback given (c39ed87)

4.0.4 (2020-04-29)

Bug Fixes

• deps: update dependency graceful-fs to ^4.2.4 (c01661b)

4.0.3 (2020-04-05)

Bug Fixes

• deps: update dependency handlebars to ^4.7.6 (2aa29ab)

4.0.2 (2020-04-03)

Bug Fixes

• deps: update dependency handlebars to ^4.7.5 (#​6) (e597254)

v4.0.6

Compare Source

Bug Fixes

• add runtimeOptions (b64284f)

v4.0.5

Compare Source

Bug Fixes

• overwrite past settings.views (c27f1b0)
• renderView returns promise when no callback given (c39ed87)

v4.0.4

Compare Source

Bug Fixes

• deps: update dependency graceful-fs to ^4.2.4 (c01661b)

v4.0.3

Compare Source

Bug Fixes

• deps: update dependency handlebars to ^4.7.6 (2aa29ab)

v4.0.2

Compare Source

Bug Fixes

• deps: update dependency handlebars to ^4.7.5 (#​6) (e597254)

v4.0.1

Compare Source

v4.0.0

Compare Source

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[renovate]

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.