ember-rails & ember-source dependency conflicts about ember-rails HOT 4 CLOSED

Could you remove 'handlebars-source' from your Gemfile?
'ember-source' requires 'handlebars-source' 1.x to precompile its template.

from ember-rails.

Could you remove 'handlebars-source' from your Gemfile?
'ember-source' requires 'handlebars-source' 1.x to precompile its template.

handlebars-source has an security issue I need to make it >= 4.0.0 :(

Name: handlebars-source
Version: 1.3.0
Advisory: 131671
Criticality: Unknown
URL: https://blog.srcclr.com/handlebars_vulnerability_research_findings/
Title: handlebars.js - quoteless attributes in templates can lead to XSS
Solution: upgrade to >= 4.0.0

from ember-rails.

Ah, I see.
I think this security issue doesn't affect Ember application.
The reason is that Ember's bind-attr helper will escape bound attribute.

BTW ember-source 1.10.0 or later doesn't depend on handlebars-source.

If you use handlebars not only Ember's template engine, could you try to update ember-source to at least 1.10.0?

from ember-rails.

If you use handlebars not only Ember's template engine, could you try to update ember-source to at least 1.10.0?

This works!

Thanks for your prompt reply and your time 👍

from ember-rails.