Fix vulns in dev deps with npm audit fix

node_modules/handlebars/release-notes.md

@@ -2,7 +2,164 @@
 
 ## Development
 
-[Commits](https://github.com/wycats/handlebars.js/compare/v4.2.0...master)
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.5.1...master)
+
+## v4.5.1 - October 29th, 2019
+Bugfixs
+
+- fix: move "eslint-plugin-compat" to devDependencies - 5e9d17f (#1589)
+
+Compatibility notes:
+- No compatibility issues are to be expected
+
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.5.0...v4.5.1)
+
+## v4.5.0 - October 28th, 2019
+Features / Improvements
+- Add method Handlebars.parseWithoutProcessing (#1584) - 62ed3c2
+- add guard to if & unless helpers (#1549)
+- show source location for the strict lookup exceptions - feb60f8
+
+Bugfixes:
+- Use objects for hash value tracking - 7fcf9d2
+
+Chore:
+- Resolve deprecation warning message from eslint while running eslint (#1586) - 7052e88
+- chore: add eslint-plugin-compat and eslint-plugin-es5 - 088e618
+
+Compatibility notes:
+- No compatibility issues are to be expected
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.4.5...v4.5.0)
+
+## v4.4.5 - October 20th, 2019
+Bugfixes: 
+
+- Contents of raw-blocks must be matched with non-eager regex-matching - 8d5530e, #1579
+
+
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.4.4...v4.4.5)
+
+## v4.4.4 - October 20th, 2019
+Bugfixes:
+- fix: prevent zero length tokens in raw-blocks (#1577, #1578) - f1752fe
+
+Chore: 
+- chore: link to s3 bucket with https, add "npm ci" to build instructions - 0b593bf
+
+Compatibility notes:
+- no compatibility issues are expected
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.4.3...v4.4.4)
+
+## v4.4.3 - October 8th, 2019
+Bugfixes
+
+Typings:
+- add missing type fields to AST typings and add tests for them - 0440af2
+
+
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.4.2...v4.4.3)
+
+## v4.4.2 - October 2nd, 2019
+- chore: fix grunt-saucelabs dependency - b7eada0
+
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.4.1...v4.4.2)
+
+## v4.4.1 - October 2nd, 2019
+- [#1562](https://github.com/wycats/handlebars.js/issues/1562) - Error message for syntax error missing location in 4.2.1+
+
+
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.4.0...v4.4.1)
+
+## v4.4.0 - September 29th, 2019
+- Added support for iterable objects in {{#each}} helper (#1557) - cf7545e
+
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.3.4...v4.4.0)
+
+## v4.3.4 - September 28th, 2019
+- fix: harden "propertyIsEnumerable"-check - ff4d827
+
+Compatibility notes:
+- No incompatibilities are known.
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.3.3...v4.3.4)
+
+## v4.3.3 - September 27th, 2019
+ - fix test case for browsers that do not support __defineGetter__ - 8742bde
+
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.3.2...v4.3.3)
+
+## v4.3.2 - September 26th, 2019
+- Use Object.prototype.propertyIsEnumerable to check for constructors - 213c0bb, #1563
+
+Compatibility notes:
+- There are no breaking changes
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.3.1...v4.3.2)
+
+## v4.3.1 - September 25th, 2019
+Fixes:
+
+- do not break on precompiled templates from Handlebars >=4.0.0 <4.3.0 - 1266838, #1561
+- Ensure allowCallsToHelperMissing runtime option is optional in typings - 93444c5, 64ecb9e, #1560
+
+
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.3.0...v4.3.1)
+
+## v4.3.0 - September 24th, 2019
+Fixes:
+
+- Security: Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72
+- Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72
+
+Features:
+
+- Add new runtime option `allowCallsToHelperMissing` to allow calling `blockHelperMissing` and `helperMissing`.
+
+Breaking changes:
+
+Compatibility notes:
+- Compiler revision increased - 06b7224
+  - This means that template compiled with versions prior to 4.3.0 will not work with runtimes >= 4.3.0
+    The increase was done because the "helperMissing" and "blockHelperMissing" are now moved from the helpers
+    to the internal "container.hooks" object, so old templates will not be able to call them anymore. We suggest
+    that you always recompile your templates with the latest compiler in your build pipelines.
+
+- Disallow calling "helperMissing" and "blockHelperMissing" directly - 2078c72
+  - Calling "helperMissing" and "blockHelperMissing" directly from a template (like in `{{blockHelperMissing}}` was 
+    never intended and was part of the exploits that have been revealed early in 2019 
+    (see https://github.com/wycats/handlebars.js/issues/1495). *It is also part of a new exploit that 
+    is not captured by the earlier fix.* In order to harden Handlebars against such exploits, calling thos helpers 
+    is now not possible anymore. *Overriding* those helpers is still possible.
+  - If you really need this behavior, you can set the runtime option `allowCallsToHelperMissing` to `true` and the
+    calls will again be possible
+
+Both bullet points imly that Handlebars is not 100% percent compatible to 4.2.0, despite the minor version bump.
+
+We consider it more important to resolve a major security issue than to maintain 100% compatibility.
+
+    
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.2.1...v4.3.0)
+
+## v4.2.1 - September 20th, 2019
+Bugfixes: 
+
+- The "browser" property in the package.json has been updated to use the common-js builds instead of the minified UMD - c55a7be, #1553
+
+Compatibility notes:
+- No compatibility issues should arise
+
+[Commits](https://github.com/wycats/handlebars.js/compare/v4.2.0...v4.2.1)
 
 ## v4.2.0 - September 3rd, 2019
 Chore/Test:
@@ -406,7 +563,7 @@ Compatibility notes:
 - Lines containing only block statements and whitespace are now removed. This matches the Mustache spec but may cause issues with code that expects whitespace to exist but would not otherwise.
 - Partials that are standalone will now indent their rendered content
 - `AST.ProgramNode`'s signature has changed. 
-- Numerious methods/features removed from psuedo-API classes
+- Numerious methods/features removed from pseudo-API classes
   - `JavaScriptCompiler.register`
   - `JavaScriptCompiler.replaceStack` no longer supports non-inline replace
   - `Compiler.disassemble`
@@ -597,7 +754,7 @@ Compatibility notes:
 ## v1.0.11 / 1.0.0-rc4 - May 13 2013
 
 - [#458](https://github.com/wycats/handlebars.js/issues/458) - Fix `./foo` syntax ([@jpfiset](https://github.com/jpfiset))
-- [#460](https://github.com/wycats/handlebars.js/issues/460) - Allow `:` in unescaped identifers ([@jpfiset](https://github.com/jpfiset))
+- [#460](https://github.com/wycats/handlebars.js/issues/460) - Allow `:` in unescaped identifiers ([@jpfiset](https://github.com/jpfiset))
 - [#471](https://github.com/wycats/handlebars.js/issues/471) - Create release notes (These!)
 - [#456](https://github.com/wycats/handlebars.js/issues/456) - Allow escaping of `\\`
 - [#211](https://github.com/wycats/handlebars.js/issues/211) - Fix exception in `escapeExpression`