Version 9.0.0
TL;DR
The main news in this commit is that the settings field in the data object is no longer merged with your configuration. This resolves several security issues.
This may cause changes in the way you use Express.js with Squirrelly, since you'll have to configure caching and the views directory for both Express and Squirrelly separately.
Example:
app.engine("sqrl", Sqrl.renderFile)
eta.configure({ views: "./views", cache: true })
app.set("views", "./views")
app.set("view cache", true)
app.set("view engine", "sqrl")Commits
- chore: rebuild & format e1a554b
- Merge pull request #254 from legobeat/fix-data-config af6018f
- Don't merge data.settings into the config option c12418a
- don't pass view options dca7a1e
- Merge pull request #249 from squirrellyjs/dependabot/npm_and_yarn/qs-6.5.3 d460cc1
- Merge pull request #234 from squirrellyjs/dependabot/npm_and_yarn/tmpl-1.0.5 ba66a3f
- Merge pull request #235 from squirrellyjs/dependabot/npm_and_yarn/i-0.3.7 5d5b2fe
- Bump qs from 6.5.2 to 6.5.3 f51c304
- Bump i from 0.3.6 to 0.3.7 6400940
- Merge pull request #248 from squirrellyjs/dependabot/npm_and_yarn/decode-uri-component-0.2.2 cbdd42f
- Merge pull request #247 from squirrellyjs/dependabot/npm_and_yarn/loader-utils-1.4.2 31833df
- Merge pull request #245 from squirrellyjs/dependabot/npm_and_yarn/terser-4.8.1 9b8afbe
- Merge pull request #244 from squirrellyjs/dependabot/npm_and_yarn/jsdom-16.7.0 51dd9be
- Merge pull request #243 from squirrellyjs/dependabot/npm_and_yarn/ajv-6.12.6 151bbd6
- Merge pull request #242 from squirrellyjs/dependabot/npm_and_yarn/trim-off-newlines-1.0.3 8321eda
- Merge pull request #239 from squirrellyjs/dependabot/npm_and_yarn/shelljs-0.8.5 75a8687
- Merge pull request #232 from squirrellyjs/dependabot/npm_and_yarn/path-parse-1.0.7 c7fd5fe
- Merge pull request #228 from squirrellyjs/dependabot/npm_and_yarn/normalize-url-4.5.1 5b5259f
- Merge pull request #226 from squirrellyjs/dependabot/npm_and_yarn/browserslist-4.16.6 e148698
- Merge pull request #225 from squirrellyjs/dependabot/npm_and_yarn/hosted-git-info-2.8.9 a9bdfe7
- Merge pull request #224 from squirrellyjs/dependabot/npm_and_yarn/handlebars-4.7.7 021c6a5
- Merge pull request #221 from squirrellyjs/dependabot/npm_and_yarn/ssri-6.0.2 6235b55
- Merge pull request #219 from squirrellyjs/dependabot/npm_and_yarn/elliptic-6.5.4 d60d325
- Merge pull request #216 from squirrellyjs/dependabot/npm_and_yarn/node-notifier-8.0.1 23008f0
- Merge pull request #215 from squirrellyjs/dependabot/npm_and_yarn/ini-1.3.7 8a6f4fa
- Merge pull request #213 from squirrellyjs/dependabot/npm_and_yarn/highlight.js-10.4.1 96eb062
- Bump decode-uri-component from 0.2.0 to 0.2.2 76c15ca
- Bump loader-utils from 1.4.0 to 1.4.2 9967601
- Bump terser from 4.6.7 to 4.8.1 ec3ebd6
- Bump jsdom from 16.4.0 to 16.7.0 20664b9
- Bump ajv from 6.12.0 to 6.12.6 b037db1
- Bump trim-off-newlines from 1.0.1 to 1.0.3 19e05ae
- Bump shelljs from 0.8.4 to 0.8.5 50652e6
- Bump tmpl from 1.0.4 to 1.0.5 3710f94
- Bump path-parse from 1.0.6 to 1.0.7 bd9106b
- Bump normalize-url from 4.5.0 to 4.5.1 44424c7
- Bump browserslist from 4.9.1 to 4.16.6 09b0dfe
- Bump hosted-git-info from 2.8.8 to 2.8.9 34476cc
- Bump handlebars from 4.7.6 to 4.7.7 f862efe
- Bump ssri from 6.0.1 to 6.0.2 1ee720c
- Bump elliptic from 6.5.3 to 6.5.4 fdae927
- Bump node-notifier from 8.0.0 to 8.0.1 8038a7d
- Bump ini from 1.3.5 to 1.3.7 e30a761
- Bump highlight.js from 10.1.2 to 10.4.1 df63f2e
- Re-add CodeShelter badge to README 72d6125
- Remove badge 5744f06
- Various work 817f325
- Create codeql-analysis.yml 07c994d
- Removed unnecessary build step 27fadf2
- Add np as a dev dependency 59b4a7f
- Merge pull request #206 from jmclean-cnexus/master 3d333dd
- remove dist, add release script, and append dist to .gitignore 8318455