express-hbs 3.0.0 → 4.0.0

package/README.md

@@ -10,8 +10,8 @@ layout inheritance and block-style content regions while keeping the familiar
 
 ## Requirements
 
-- Node.js 20 or later
-- pnpm 10 when working on this repository
+- Node.js 22 or later
+- the pinned pnpm version when working on this repository
 
 ## v2.0.0
 

package/lib/hbs.js

@@ -99,7 +99,13 @@ ExpressHbs.prototype.cacheLayout = function (layoutFile, useCache, cb) {
   var self = this;
 
   if (this.restrictLayoutsTo) {
-    if (!layoutFile.startsWith(this.restrictLayoutsTo)) {
+    var relativePath = path.relative(this.restrictLayoutsTo, layoutFile);
+    var outside =
+      relativePath === '..' ||
+      relativePath.startsWith('..' + path.sep) ||
+      path.isAbsolute(relativePath);
+
+    if (outside) {
       var err = new Error(
         'Cannot read ' + layoutFile + ' it does not reside in ' + this.restrictLayoutsTo,
       );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "express-hbs",
-  "version": "3.0.0",
+  "version": "4.0.0",
   "description": "Express handlebars template engine complete with multiple layouts, partials and blocks.",
   "keywords": [
     "express4",
@@ -10,8 +10,12 @@
     "partials"
   ],
   "main": "index.js",
+  "files": [
+    "index.js",
+    "lib"
+  ],
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "directories": {
     "example": "example"
@@ -24,21 +28,21 @@
   "author": "Mario Gutierrez <mario@barc.com>",
   "license": "MIT",
   "devDependencies": {
+    "@tryghost/pro-ship": "2.0.1",
     "cookie-parser": "1.4.7",
-    "express": "5.2.1",
-    "i18n": "0.15.3",
-    "mocha": "11.7.6",
+    "express": "5.3.0",
+    "i18n": "0.15.4",
+    "mocha": "12.0.3",
     "nyc": "18.0.0",
-    "oxfmt": "0.57.0",
-    "oxlint": "1.72.0",
+    "oxfmt": "0.76.0",
+    "oxlint": "1.91.0",
     "rewire": "9.0.1",
-    "supertest": "7.2.2"
+    "supertest": "7.3.2"
   },
   "dependencies": {
-    "@tryghost/pro-ship": "1.1.5",
-    "handlebars": "4.7.9",
-    "lodash": "4.18.1",
-    "readdirp": "3.6.0"
+    "handlebars": "^4.7.10",
+    "lodash": "^4.18.1",
+    "readdirp": "^3.6.0"
   },
   "optionalDependencies": {
     "js-beautify": "^2.0.0"

package/.editorconfig

@@ -1,8 +0,0 @@
-; indicate this is the root of the project
-
-[*]
-indent_style = space
-end_of_line = lf
-
-[*.js]
-indent_size = 2

package/.github/workflows/publish.yml

@@ -1,73 +0,0 @@
-name: Publish
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - 'package.json'
-  workflow_dispatch:
-    inputs:
-      dry-run:
-        description: 'Preview what would be published without actually publishing'
-        required: false
-        type: boolean
-        default: true
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-
-jobs:
-  publish:
-    name: Publish to npm
-    runs-on: ubuntu-latest
-
-    permissions:
-      # OIDC trusted publishing to npm. Provenance is enabled because this
-      # repository is public; public repos can generate a provenance
-      # attestation at publish time.
-      id-token: write
-      contents: read
-
-    env:
-      FORCE_COLOR: 1
-      CI: true
-      NPM_CONFIG_PROVENANCE: true
-      NPM_CONFIG_REGISTRY: 'https://registry.npmjs.org'
-
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          persist-credentials: false
-
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
-        with:
-          node-version: '24.14.1'
-          registry-url: 'https://registry.npmjs.org'
-
-      - name: Install Corepack
-        run: npm install --global corepack@0.34.6
-      - name: Enable corepack
-        run: corepack enable
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile --prefer-offline
-
-      - name: Determine whether to publish
-        id: pub
-        run: |
-          name=$(jq -r .name package.json)
-          version=$(jq -r .version package.json)
-          if [ -n "$(npm view "$name@$version" version 2>/dev/null)" ]; then
-            echo "$name@$version is already published; nothing to do"
-            echo "publish=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "queueing $name@$version"
-            echo "publish=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Publish to npm
-        if: steps.pub.outputs.publish == 'true'
-        # --no-git-checks is required because actions/checkout leaves the repo on
-        # a detached HEAD, which pnpm's default publish branch check rejects.
-        run: pnpm publish --no-git-checks ${{ (github.event.inputs['dry-run'] == 'true' && '--dry-run') || '' }}

package/.github/workflows/test.yml

@@ -1,48 +0,0 @@
-name: Test
-
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    strategy:
-      fail-fast: false
-      matrix:
-        node: [20, 22, 24]
-    name: Node ${{ matrix.node }}
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: ${{ matrix.node }}
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm lint
-      - name: Run tests with coverage
-        run: pnpm coverage
-
-  required-checks-pass:
-    name: Required checks pass
-    if: always()
-    needs: [build]
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - name: Verify all required jobs succeeded
-        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
-        run: exit 1

package/.jsbeautifyrc

@@ -1,17 +0,0 @@
-{
-    "indent_size": 2,
-    "indent_char": " ",
-    "indent_level": 0,
-    "indent_with_tabs": false,
-    "preserve_newlines": true,
-    "max_preserve_newlines": 10,
-    "jslint_happy": false,
-    "brace_style": "collapse",
-    "keep_array_indentation": false,
-    "keep_function_indentation": false,
-    "space_before_conditional": true,
-    "break_chained_methods": false,
-    "eval_code": false,
-    "unescape_strings": false,
-    "wrap_line_length": 0
-}

package/.nvmrc

@@ -1 +0,0 @@
-20

package/.nycrc.json

@@ -1,16 +0,0 @@
-{
-  "all": true,
-  "include": [
-    "index.js",
-    "lib/**/*.js"
-  ],
-  "branches": 80,
-  "functions": 80,
-  "lines": 80,
-  "statements": 80,
-  "reporter": [
-    "text",
-    "json-summary",
-    "lcov"
-  ]
-}

package/.oxfmtrc.json

@@ -1,19 +0,0 @@
-{
-  "$schema": "./node_modules/oxfmt/configuration_schema.json",
-  "singleQuote": true,
-  "tabWidth": 2,
-  "sortPackageJson": false,
-  "ignorePatterns": [
-    "**/node_modules/**",
-    "**/coverage/**",
-    "pnpm-lock.yaml",
-    "**/*.json",
-    "**/*.jsonc",
-    "**/*.yml",
-    "**/*.yaml",
-    "**/*.md",
-    "**/*.hbs",
-    "**/*.html",
-    "**/*.css"
-  ]
-}

package/.oxlintrc.json

@@ -1,32 +0,0 @@
-{
-  "$schema": "./node_modules/oxlint/configuration_schema.json",
-  "categories": {
-    "correctness": "error",
-    "suspicious": "warn"
-  },
-  "env": {
-    "node": true,
-    "es2024": true
-  },
-  "rules": {
-    "no-console": "error"
-  },
-  "overrides": [
-    {
-      "files": ["test/**/*.js"],
-      "env": {
-        "mocha": true
-      },
-      "rules": {
-        "no-console": "off",
-        "no-unused-vars": "off"
-      }
-    },
-    {
-      "files": ["lib/hbs.js", "example/**/*.js"],
-      "rules": {
-        "no-console": "off"
-      }
-    }
-  ]
-}

package/AGENTS.md

@@ -1,40 +0,0 @@
-# express-hbs agent notes
-
-`express-hbs` is a CommonJS Express view-engine library. Read `README.md` for
-the public API and usage examples before changing behavior.
-
-## Commands
-
-Use pnpm 10 on Node.js 20 or later.
-
-```sh
-pnpm install --frozen-lockfile
-pnpm lint
-pnpm test
-pnpm coverage
-```
-
-`pnpm test` runs `mocha` and then `pnpm lint` through the `posttest` script.
-`pnpm coverage` runs the same test suite under `nyc` and enforces the coverage
-thresholds in `package.json`.
-
-## Boundaries
-
-- Do not edit `pnpm-lock.yaml` by hand. Regenerate it with `pnpm install`.
-- Keep `lib/hbs.js` and `lib/resolver.js` CommonJS; this package does not use
-  ESM.
-- Treat files under `test/views/**`, `test/issues/**`, and `example/views/**`
-  as rendering fixtures. Seemingly odd whitespace, malformed markup, or partial
-  names may be intentional test coverage.
-- Keep the security warning around user-controlled `layout` values and
-  `restrictLayoutsTo` in sync with behavior.
-
-## Style notes
-
-- Formatting is enforced by `oxfmt`; run `pnpm lint:fix` rather than doing large
-  manual formatting sweeps.
-- The formatter intentionally ignores Handlebars, HTML, CSS, lockfile, and
-  fixture data files. Preserve their existing shape unless the test expectation
-  itself is being changed.
-- Add or update tests for layout resolution, partial loading, async helpers,
-  template options, and caching changes.

package/SECURITY.md

@@ -1,9 +0,0 @@
-# Reporting Security Vulnerabilities
-
-Potential security vulnerabilities can be reported directly us at `security@ghost.org`. The Ghost Security Team communicates privately and works in a secured, isolated repository for tracking, testing, and resolving security-related issues.
-
-The full, up-to-date details of our security policy and procedure can always be found in our documentation:
-
-https://ghost.org/docs/security/
-
-Please refer to this before emailing us. Thanks for helping make Ghost safe for everyone 🙏.

package/example/app-layoutsDir.js

@@ -1,99 +0,0 @@
-// pnpm add express express-hbs
-
-'use strict';
-
-var express = require('express');
-var app = express();
-var hbs = require('..'); // should be `require('express-hbs')` outside of this example
-var fs = require('fs');
-var fp = require('path');
-
-function relative(path) {
-  return fp.join(__dirname, path);
-}
-var viewsDir = relative('views');
-
-app.use(express.static(relative('public')));
-
-// Hook in express-hbs and tell it where known directories reside
-app.engine(
-  'hbs',
-  hbs.express4({
-    partialsDir: [relative('views/partials'), relative('views/partials-other')],
-    layoutsDir: relative('views/layout'),
-    defaultLayout: relative('views/layout/default.hbs'),
-    restrictLayoutsTo: relative('views/layout'),
-  }),
-);
-app.set('view engine', 'hbs');
-app.set('views', relative('views'));
-
-// Register sync helper
-hbs.registerHelper('link', function (text, options) {
-  var attrs = [];
-  for (var prop in options.hash) {
-    attrs.push(prop + '="' + options.hash[prop] + '"');
-  }
-  return new hbs.SafeString('<a ' + attrs.join(' ') + '>' + text + '</a>');
-});
-
-// Register Async helpers
-hbs.registerAsyncHelper('readFile', function (filename, cb) {
-  fs.readFile(fp.join(viewsDir, filename), 'utf8', function (err, content) {
-    if (err) console.error(err);
-    cb(new hbs.SafeString(content));
-  });
-});
-
-var fruits = [{ name: 'apple' }, { name: 'orange' }, { name: 'pear' }];
-
-var veggies = [{ name: 'asparagus' }, { name: 'carrot' }, { name: 'spinach' }];
-
-app.get('/', function (req, res) {
-  res.render('index', {
-    title: 'express-hbs example',
-  });
-});
-
-app.get('/fruits', function (req, res) {
-  res.render('fruits/index-layoutsDir', {
-    title: 'My favorite fruits',
-    fruits: fruits,
-  });
-});
-
-app.get('/fruits/:name', function (req, res) {
-  res.render('fruits/details-layoutsDir', {
-    fruit: req.params.name,
-  });
-});
-
-app.get('/veggies', function (req, res) {
-  res.render('veggies', {
-    title: 'My favorite veggies',
-    veggies: veggies,
-    layout: 'veggie',
-  });
-});
-
-app.get('/veggies/explicit-dir', function (req, res) {
-  res.render('veggies', {
-    title: 'My favorite veggies',
-    veggies: veggies,
-    layout: relative('views/layout/veggie'),
-  });
-});
-
-app.get('/veggies/:name', function (req, res) {
-  res.render('veggies/details', {
-    veggie: req.params.name,
-    layout: 'veggie-details',
-  });
-});
-
-if (require.main === module) {
-  app.listen(3000);
-  console.log('Express server listening on port 3000');
-} else {
-  module.exports = app;
-}

package/example/app.js

@@ -1,103 +0,0 @@
-'use strict';
-// pnpm add express express-hbs
-
-function create(hbs, env) {
-  if (env) process.env.NODE_ENV = env;
-
-  var express = require('express');
-  var app = express();
-  var fs = require('fs');
-  var fp = require('path');
-
-  function relative(path) {
-    return fp.join(__dirname, path);
-  }
-
-  var viewsDir = relative('views');
-
-  app.use(express.static(relative('public')));
-
-  // Hook in express-hbs and tell it where known directories reside
-  app.engine(
-    'hbs',
-    hbs.express4({
-      partialsDir: [relative('views/partials'), relative('views/partials-other')],
-      defaultLayout: relative('views/layout/default.hbs'),
-      restrictLayoutsTo: viewsDir,
-    }),
-  );
-  app.set('view engine', 'hbs');
-  app.set('views', viewsDir);
-
-  // Register sync helper
-  hbs.registerHelper('link', function (text, options) {
-    var attrs = [];
-    for (var prop in options.hash) {
-      attrs.push(prop + '="' + options.hash[prop] + '"');
-    }
-    return new hbs.SafeString('<a ' + attrs.join(' ') + '>' + text + '</a>');
-  });
-
-  // Register Async helpers
-  hbs.registerAsyncHelper('readFile', function (filename, cb) {
-    fs.readFile(fp.join(viewsDir, filename), 'utf8', function (err, content) {
-      if (err) console.error(err);
-      cb(new hbs.SafeString(content));
-    });
-  });
-
-  var fruits = [{ name: 'apple' }, { name: 'orange' }, { name: 'pear' }];
-
-  var veggies = [{ name: 'asparagus' }, { name: 'carrot' }, { name: 'spinach' }];
-
-  app.get('/', function (req, res) {
-    res.render('index', {
-      title: 'express-hbs example',
-    });
-  });
-
-  app.get('/replace', function (req, res) {
-    res.render('replace', {
-      title: 'express-hbs example',
-    });
-  });
-
-  app.get('/fruits', function (req, res) {
-    res.render('fruits/index', {
-      title: 'My favorite fruits',
-      fruits: fruits,
-    });
-  });
-
-  app.get('/fruits/:name', function (req, res) {
-    res.render('fruits/details', {
-      fruit: req.params.name,
-    });
-  });
-
-  app.get('/veggies', function (req, res) {
-    res.render('veggies', {
-      title: 'My favorite veggies',
-      veggies: veggies,
-      layout: 'layout/veggie',
-    });
-  });
-
-  app.get('/veggies/:name', function (req, res) {
-    res.render('veggies/details', {
-      veggie: req.params.name,
-      layout: 'layout/veggie-details',
-    });
-  });
-
-  return app;
-}
-
-if (require.main === module) {
-  var hbs = require('..');
-  var app = create(hbs);
-  app.listen(3000);
-  console.log('Express server listening on port 3000');
-} else {
-  exports.create = create;
-}

package/example/public/css/style.css

@@ -1,17 +0,0 @@
-* {
-  font-family: Georgia, serif;
-}
-
-h1, h2 {
-  font-family: Helvetica, Arial, sans;
-}
-
-.veggie-details {
-    border: 5px solid green;
-    padding: 10px;
-}
-
-.fruit-details {
-    border: 5px solid red;
-    padding: 10px;
-}

package/example/views/fruits/details-layoutsDir.hbs

@@ -1,3 +0,0 @@
-{{!< fruit-details}}
-
-{{fruit}}

package/example/views/fruits/details.hbs

@@ -1,4 +0,0 @@
-{{!< ../layout/fruit-details}}
-
-{{fruit}}
-

package/example/views/fruits/index-layoutsDir.hbs

@@ -1,20 +0,0 @@
-<!-- name of layout -->
-{{!< fruits}}
-
-{{#contentFor 'pageStyles'}}
-<style>
-  li a {
-    color: #800;
-  }
-</style>
-{{/contentFor}}
-
-
-<h1>{{title}}</h1>
-<ul>
-    {{#each fruits}}
-      <li>
-        <a href="/fruits/{{this.name}}">{{this.name}}</a>
-      </li>
-    {{/each}}
-</ul>

package/example/views/fruits/index.hbs

@@ -1,20 +0,0 @@
-<!-- name of layout -->
-{{!< ../layout/fruits}}
-
-{{#contentFor 'pageStyles'}}
-<style>
-  li a {
-    color: #800;
-  }
-</style>
-{{/contentFor}}
-
-
-<h1>{{title}}</h1>
-<ul>
-    {{#each fruits}}
-    <li>
-      <a href="/fruits/{{this.name}}">{{this.name}}</a>
-    </li>
-    {{/each}}
-</ul>

package/example/views/index.hbs

@@ -1,34 +0,0 @@
-{{#contentFor 'pageStyles'}}
-<style>
-  .clicker {
-    color: blue;
-  };
-</style>
-{{/contentFor}}
-
-
-{{#contentFor 'pageScripts'}}
-<script>
-  $(function() {
-    $('.clicker').click(function() {
-      $(this).text('Hello express-hbs!');
-    });
-  });
-</script>
-{{/contentFor}}
-
-
-<h1>{{title}}</h1>
-<p class='clicker'>Click me!</p>
-<p>
-  <a href='/fruits'>Favorite fruits</a>
-</p>
-<p>
-  <!-- sync helper -->
-  {{{link 'Vegetables' href='/veggies'}}}
-</p>
-
-<!-- async helper -->
-<div>
-{{{readFile 'tos.txt'}}}
-</div>

package/example/views/layout/default.hbs

@@ -1,13 +0,0 @@
-{{!< html-struct}}
-
-<h2>DEFAULT LAYOUT</h2>
-
-{{#block 'default-block'}}
-  Default block content
-{{/block}}
-
-{{#block 'replaced-default-block'}}
-  Default block content
-{{/block}}
-
-{{{body}}}