projen-pipelines 0.3.26 → 0.3.27

package/node_modules/handlebars/lib/handlebars/helpers/each.js

@@ -7,6 +7,26 @@ import {
 } from '../utils';
 import Exception from '../exception';
 
+/**
+ * Close an unfinished iterator after the block body threw, like for...of does,
+ * so that generators can run their cleanup code.
+ *
+ * Errors thrown while closing, including by a `return` getter, are ignored:
+ * the block's error is the cause and is the one the caller must see.
+ *
+ * @param {Iterator} iterator the iterator that was being consumed
+ */
+function closeIterator(iterator) {
+  try {
+    let close = iterator.return;
+    if (isFunction(close)) {
+      close.call(iterator);
+    }
+  } catch (closeError) {
+    // NOP
+  }
+}
+
 export default function(instance) {
   instance.registerHelper('each', function(context, options) {
     if (!options) {
@@ -33,7 +53,7 @@ export default function(instance) {
       data = createFrame(options.data);
     }
 
-    function execIteration(field, index, last) {
+    function execIteration(field, index, last, value) {
       if (data) {
         data.key = field;
         data.index = index;
@@ -47,12 +67,9 @@ export default function(instance) {
 
       ret =
         ret +
-        fn(context[field], {
+        fn(value, {
           data: data,
-          blockParams: blockParams(
-            [context[field], field],
-            [contextPath + field, null]
-          )
+          blockParams: blockParams([value, field], [contextPath + field, null])
         });
     }
 
@@ -60,18 +77,24 @@ export default function(instance) {
       if (isArray(context)) {
         for (let j = context.length; i < j; i++) {
           if (i in context) {
-            execIteration(i, i, i === context.length - 1);
+            execIteration(i, i, i === context.length - 1, context[i]);
           }
         }
       } else if (typeof Symbol === 'function' && context[Symbol.iterator]) {
-        const newContext = [];
         const iterator = context[Symbol.iterator]();
-        for (let it = iterator.next(); !it.done; it = iterator.next()) {
-          newContext.push(it.value);
-        }
-        context = newContext;
-        for (let j = context.length; i < j; i++) {
-          execIteration(i, i, i === context.length - 1);
+        let current = iterator.next();
+        while (!current.done) {
+          let next = iterator.next();
+          try {
+            execIteration(i, i, next.done, current.value);
+          } catch (e) {
+            if (!next.done) {
+              closeIterator(iterator);
+            }
+            throw e;
+          }
+          current = next;
+          i++;
         }
       } else {
         let priorKey;
@@ -81,13 +104,13 @@ export default function(instance) {
           // the last iteration without have to scan the object twice and create
           // an itermediate keys array.
           if (priorKey !== undefined) {
-            execIteration(priorKey, i - 1);
+            execIteration(priorKey, i - 1, false, context[priorKey]);
           }
           priorKey = key;
           i++;
         });
         if (priorKey !== undefined) {
-          execIteration(priorKey, i - 1, true);
+          execIteration(priorKey, i - 1, true, context[priorKey]);
         }
       }
     }

package/node_modules/handlebars/lib/handlebars/internal/proto-access.js

@@ -39,6 +39,28 @@ export function resultIsAllowed(result, protoAccessControl, propertyName) {
   }
 }
 
+/**
+ * Detect a prototype object's own "constructor" back-reference, e.g.
+ * `Function.prototype.constructor === Function`. Because "constructor" is an
+ * "own" property of such objects, it would otherwise bypass the prototype-access
+ * checks and expose dangerous constructors (allowing arbitrary code execution).
+ *
+ * Only functions can be constructors, so other values are never treated as one
+ * and their `prototype` is never read.
+ *
+ * @param {*} parent the object the property is being read from
+ * @param {string} propertyName the property being looked up
+ * @param {*} result the already-resolved value of `parent[propertyName]`
+ * @returns {boolean} true if the lookup resolves `parent`'s own constructor
+ */
+export function isPrototypeConstructor(parent, propertyName, result) {
+  return (
+    propertyName === 'constructor' &&
+    typeof result === 'function' &&
+    parent === result.prototype
+  );
+}
+
 function checkWhiteList(protoAccessControlForType, propertyName) {
   if (protoAccessControlForType.whitelist[propertyName] !== undefined) {
     return protoAccessControlForType.whitelist[propertyName] === true;

package/node_modules/handlebars/lib/handlebars/runtime.js

@@ -10,7 +10,8 @@ import { moveHelperToHooks } from './helpers';
 import { wrapHelper } from './internal/wrapHelper';
 import {
   createProtoAccessControl,
-  resultIsAllowed
+  resultIsAllowed,
+  isPrototypeConstructor
 } from './internal/proto-access';
 
 export function checkRevision(compilerInfo) {
@@ -79,7 +80,27 @@ export function template(templateSpec, env) {
 
     let result = env.VM.invokePartial.call(this, partial, context, options);
 
+    // An empty result normally means the partial is template source that still
+    // has to be compiled. A function partial has already been invoked, so an
+    // empty result from it is a bug in that partial.
+    if (result == null && Utils.isFunction(partial)) {
+      throw new Exception(
+        'The partial ' +
+          options.name +
+          ' returned no output: partials must return a string'
+      );
+    }
+
     if (result == null && env.compile) {
+      // Only template source registered as a partial may be compiled here.
+      // Anything else (e.g. an AST-shaped object) must not become code.
+      if (typeof partial !== 'string') {
+        throw new Exception(
+          'The partial ' +
+            options.name +
+            ' could not be compiled: partials must be strings or functions returning strings'
+        );
+      }
       options.partials[options.name] = env.compile(
         partial,
         templateSpec.compilerOptions,
@@ -124,7 +145,15 @@ export function template(templateSpec, env) {
       if (result == null) {
         return result;
       }
-      if (Object.prototype.hasOwnProperty.call(parent, propertyName)) {
+      // Own properties are trusted context data and returned as-is, except for
+      // a prototype's own "constructor" back-reference (e.g.
+      // Function.prototype.constructor === Function): that must still pass the
+      // prototype-access deny list, otherwise the Function constructor becomes
+      // reachable and arbitrary code can be executed.
+      if (
+        Object.prototype.hasOwnProperty.call(parent, propertyName) &&
+        !isPrototypeConstructor(parent, propertyName, result)
+      ) {
         return result;
       }
 
@@ -353,8 +382,11 @@ export function resolvePartial(partial, context, options) {
     } else {
       partial = lookupOwnProperty(options.partials, options.name);
     }
-  } else if (!partial.call && !options.name) {
-    // This is a dynamic partial that returned a string
+  } else if (typeof partial !== 'function' && !options.name) {
+    // This is a dynamic partial that returned a name rather than a compiled
+    // partial. Only functions are accepted as partials here; any other value
+    // (including an object with a "call" property) is treated as a name, so
+    // that context data can never be compiled as a template.
     options.name = partial;
     partial = lookupOwnProperty(options.partials, partial);
   }

package/node_modules/handlebars/lib/handlebars/utils.js

@@ -69,8 +69,9 @@ export function indexOf(array, value) {
 
 export function escapeExpression(string) {
   if (typeof string !== 'string') {
-    // don't escape SafeStrings, since they're already safe
-    if (string && string.toHTML) {
+    // don't escape SafeStrings, since they're already safe. Other values with a
+    // "toHTML" key, e.g. from JSON context data, are escaped like any object.
+    if (string && typeof string.toHTML === 'function') {
       return string.toHTML();
     } else if (string == null) {
       return '';

package/node_modules/handlebars/lib/precompiler.js

@@ -3,6 +3,7 @@
 import Async from 'neo-async';
 import fs from 'fs';
 import * as Handlebars from './handlebars';
+import { safeJsonLiteral } from './handlebars/compiler/code-gen';
 import { basename } from 'path';
 import { SourceMapConsumer, SourceNode } from 'source-map';
 
@@ -320,10 +321,12 @@ function arrayCast(value) {
 /*
  * Safely quotes a value for embedding in generated JavaScript strings
  *
- * Uses JSON.stringify which handles all special characters.
+ * Uses JSON.stringify which handles all special characters, and also escapes
+ * line separators and the sequences that could end or change the parsing of an
+ * enclosing <script> element.
  */
 function quoteForJavaScript(value) {
-  return JSON.stringify(String(value));
+  return safeJsonLiteral(String(value));
 }
 
 /**
@@ -338,10 +341,14 @@ function isValidNamespace(namespace) {
 
 /**
  * Strips line terminators from source map URLs to prevent injection of new
- * JavaScript lines via the sourceMappingURL comment
+ * JavaScript lines via the sourceMappingURL comment, and percent-encodes "<"
+ * so that the comment cannot end or change the parsing of an enclosing
+ * <script> element.
  */
 function sanitizeSourceMapComment(value) {
-  return String(value).replace(/[\r\n\u2028\u2029]/g, '');
+  return String(value)
+    .replace(/[\r\n\u2028\u2029]/g, '')
+    .replace(/</g, '%3C');
 }
 
 /**
@@ -372,7 +379,9 @@ function minify(output, sourceMapFile) {
   return require('uglify-js').minify(output.code, {
     sourceMap: {
       content: output.map,
-      url: sourceMapFile
+      // uglify writes its own sourceMappingURL comment, so the URL has to be
+      // sanitized here as well.
+      url: sourceMapFile && sanitizeSourceMapComment(sourceMapFile)
     }
   });
 }

package/node_modules/handlebars/package.json

@@ -1,7 +1,7 @@
 {
   "name": "handlebars",
   "barename": "handlebars",
-  "version": "4.7.9",
+  "version": "4.7.10",
   "description": "Handlebars provides the power necessary to let you build semantic templates effectively with no frustration",
   "homepage": "https://handlebarsjs.com/",
   "keywords": [
@@ -21,7 +21,7 @@
     "node": ">=0.4.7"
   },
   "dependencies": {
-    "minimist": "^1.2.5",
+    "minimist": "^1.2.8",
     "neo-async": "^2.6.2",
     "source-map": "^0.6.1",
     "wordwrap": "^1.0.0"

package/node_modules/handlebars/release-notes.md

@@ -2,7 +2,26 @@
 
 ## Development
 
-[Commits](https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...master)
+[Commits](https://github.com/handlebars-lang/handlebars.js/compare/v4.7.10...master)
+
+## v4.7.10 - October 5th, 2026
+- security: Sanitize the source map URL when minifying - f37c599
+- security: Iterate lazily in #each and strip whitespace in linear time - 812c226
+- security: Escape `<!--` and `<script` in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7
+- security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f
+- security: Only compile partials that are template strings - c28ee7a
+- security: Only dispatch known node types in the Compiler and Visitor - 7d501a5
+- security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj
+- Clarify that --root does not restrict filesystem access - 0fcf25c
+- Bump minimist to ^1.2.8 - ea8ed82
+- Fix Ruby component publishing documentation - d069c1c
+- Fix Composer component definition - 6714e07
+
+Compatibility notes:
+- `{{#each}}` iterates iterables such as `Map`, `Set` and generators lazily, like `for...of`, instead of
+  copying them into an array first. Values added to the iterable while the block renders are now visited too.
+
+[Commits](https://github.com/handlebars-lang/handlebars.js/compare/v4.7.9...v4.7.10)
 
 ## v4.7.9 - March 26th, 2026
 - fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2

package/node_modules/handlebars/types/index.d.ts

@@ -73,7 +73,15 @@ declare namespace Handlebars {
   export function log(level: number, obj: any): void;
   export function parse(input: string, options?: ParseOptions): hbs.AST.Program;
   export function parseWithoutProcessing(input: string, options?: ParseOptions): hbs.AST.Program;
+  /**
+   * @param input A template source string, or an AST built by your application.
+   *   An AST is compiled to JavaScript, so never pass one from untrusted input.
+   */
   export function compile<T = any>(input: any, options?: CompileOptions): HandlebarsTemplateDelegate<T>;
+  /**
+   * @param input A template source string, or an AST built by your application.
+   *   An AST is compiled to JavaScript, so never pass one from untrusted input.
+   */
   export function precompile(input: any, options?: PrecompileOptions): TemplateSpecification;
   export function template<T = any>(precompilation: TemplateSpecification): HandlebarsTemplateDelegate<T>;
 

package/package.json

@@ -50,16 +50,16 @@
     "eslint": "^9",
     "eslint-import-resolver-typescript": "^3.10.1",
     "eslint-plugin-import": "^2.32.0",
-    "fs-extra": "^11.3.5",
+    "fs-extra": "^11.4.1",
     "jest": "^29.7.0",
     "jest-junit": "^17",
     "jsii": "~5.9",
-    "jsii-diff": "^1.129.0",
+    "jsii-diff": "^1.141.0",
     "jsii-docgen": "^10.5.0",
-    "jsii-pacmak": "^1.129.0",
+    "jsii-pacmak": "^1.141.0",
     "jsii-rosetta": "~5.9",
     "projen": "0.104.5",
-    "ts-jest": "^29.4.9",
+    "ts-jest": "^29.4.15",
     "ts-node": "^10.9.2",
     "typescript": "^5.9.3"
   },
@@ -90,7 +90,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.3.26",
+  "version": "0.3.27",
   "jest": {
     "coverageProvider": "v8",
     "testMatch": [