Highlights

🔒 Security

• Bumped handlebars to 4.7.10, which addresses CVE-2026-106445 (GHSA-p8wg-vrv2-v86f), GHSA-8r5x-fm3f-whwj and GHSA-xw65-4hp5-5hc7. Please upgrade. (#283)

⚙️ Handlebars options per instance

• compileOptions forwards options such as strict, noEscape or preventIndent to handlebars.compile() for every view and layout. (#268)
• runtimeOptions forwards runtime options to the compiled template. Use it to restore handlebars' safer prototype-access defaults by setting allowProtoMethodsByDefault and allowProtoPropertiesByDefault to false. (#284)

var hbs = require('hbs').create(null, {
  compileOptions: { strict: true },
  runtimeOptions: {
    allowProtoMethodsByDefault: false,
    allowProtoPropertiesByDefault: false
  }
});

app.engine('hbs', hbs.__express);

🧩 Clearer errors

• A settings property in the data passed to res.render shadows the reserved settings Express provides to view engines. hbs now fails with a descriptive error pointing at the conflicting key instead of a cryptic Path must be a string. (#291)

📚 Documentation

• New Layouts section covering the automatic layout, {{{body}}}, the layout option per render and app-wide via view options. (#294)
• New Template inheritance section showing nested, reusable layouts with handlebars partial blocks and inline partials, no extra hbs feature needed. (#294)
• New Reserved render data keys section and a Security section summarising the prototype-access and escaping defaults. (#291, #268, #284)

What's Changed

• build(deps): bump handlebars from 4.7.9 to 4.7.10 by @mhassan1 in #283
• build(deps): bump github/codeql-action/init from 4.37.4 to 4.38.2 by @dependabot[bot] in #280
• build(deps): bump github/codeql-action/upload-sarif from 4.37.8 to 4.38.2 by @dependabot[bot] in #281
• build(deps): bump github/codeql-action/autobuild from 4.37.4 to 4.38.2 by @dependabot[bot] in #279
• build(deps): bump github/codeql-action/analyze from 4.37.4 to 4.38.2 by @dependabot[bot] in #278
• feat: add compileOptions to pass options to handlebars.compile() by @UlisesGascon in #268
• feat: add runtimeOptions to set handlebars runtime options by @UlisesGascon in #284
• ci: add Node.js 26 to the test matrix by @UlisesGascon in #293
• docs: document template inheritance via handlebars partial blocks by @UlisesGascon in #294
• fix: clear error when a "settings" render local shadows Express settings by @UlisesGascon in #291
• Release: 4.4.0 by @UlisesGascon in #285

New Contributors

• @mhassan1 made their first contribution in #283

Full Changelog: v4.3.1...v4.4.0

Important

• Fix CVE-2026-87123 (GHSA-3c55-w9jx-p5jr)

What's Changed

• fix: treat async substitution throws as render errors by @official-burak in #276
• 4.3.1 by @UlisesGascon in #277

New Contributors

• @official-burak made their first contribution in #276

Full Changelog: v4.3.0...v4.3.1

Important

• Fix CVE-2026-16231 (GHSA-rg36-rxv9-2m9q)

What's Changed

• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #258
• build(deps): bump github/codeql-action from 4.32.4 to 4.36.1 by @dependabot[bot] in #257
• build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in #255
• build(deps): bump GitHub Actions to latest SHA-pinned versions and supertest to 6.3.4 by @sheplu in #264
• build(deps): bump github/codeql-action/upload-sarif to 4.37.8 by @dependabot[bot] in #261
• ci: add multiple missing Node.JS versions to test matrix by @imangas in #238
• docs: remove dates from HISTORY.md by @UlisesGascon in #267
• chore(ci): npm-publish via stage publish by @sheplu in #265
• 4.3.0 by @UlisesGascon in #269

New Contributors

• @sheplu made their first contribution in #264
• @imangas made their first contribution in #238

Full Changelog: v4.2.1...v4.3.0

What's Changed

• chore: add support for OSSF scorecard reporting by @inigomarquinez in #212
• ci: apply OSSF Scorecard security best practices by @UlisesGascon in #213
• Update README.md by @stefanneuhaus in #207
• fix(ci): pins nyc to version 13.3.0 for node v8 step by @mfdebian in #223
• build(deps): bump actions/checkout from 2 to 4 by @dependabot[bot] in #214
• build(deps): bump ossf/scorecard-action from 2.3.1 to 2.4.2 by @dependabot[bot] in #215
• build(deps): bump actions/upload-artifact from 4.3.1 to 4.6.2 by @dependabot[bot] in #216
• build(deps): bump github/codeql-action from 2.23.2 to 3.28.19 by @dependabot[bot] in #217
• build(deps-dev): bump mocha from 9.1.3 to 9.2.2 by @dependabot[bot] in #220
• build(deps): bump handlebars from 4.7.7 to 4.7.8 by @dependabot[bot] in #219
• chore(docs) : Fix spelling error by @fahimi85 in #205
• build(deps): bump actions/checkout from 2.7.0 to 5.0.0 by @dependabot[bot] in #229
• build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in #232
• build(deps): bump github/codeql-action from 3.28.19 to 3.30.5 by @dependabot[bot] in #233
• build(deps): bump actions/checkout from 5.0.0 to 6.0.0 by @dependabot[bot] in #237
• build(deps): bump github/codeql-action from 3.30.5 to 4.31.6 by @dependabot[bot] in #236
• build(deps): bump github/codeql-action from 4.31.6 to 4.32.4 by @dependabot[bot] in #248
• build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.0 by @dependabot[bot] in #249
• build(deps): bump actions/checkout from 6.0.0 to 6.0.2 by @dependabot[bot] in #245
• build(deps): bump handlebars from 4.7.8 to 4.7.9 by @dependabot[bot] in #251
• Release: 4.2.1 by @UlisesGascon in #253

New Contributors

• @inigomarquinez made their first contribution in #212
• @UlisesGascon made their first contribution in #213
• @stefanneuhaus made their first contribution in #207
• @dependabot[bot] made their first contribution in #214
• @fahimi85 made their first contribution in #205

Full Changelog: v4.2.0...v4.2.1