Handlebars 4.7

Apply the JavaScript ES2026 prompt first. Apply these additional rules to Handlebars 4.7 templates, helpers, partials, compilation, and browser or server rendering; they were checked against 4.7.9.

Template trust and compilation

• Treat template source, partial bodies, and precompiled template specifications as application code. Load application templates from reviewed artifacts; never concatenate user data into template source or load user-supplied specifications with Handlebars.template.
• Require primitive strings at external Handlebars.compile and Handlebars.precompile boundaries. Accept AST objects only when produced internally from trusted template source; never compile an AST supplied through JSON, a request, or a database field.
• Precompile reviewed templates and all partials during the build and prefer handlebars/runtime in production. Register partials as compiled functions in the runtime-only build; the full build can compile string partials on demand. Use precompilation to avoid requiring CSP 'unsafe-eval' in browsers.
• Use knownHelpersOnly: true with an explicit knownHelpers map for closed template sets. Account for implicitly known built-ins; this compiler optimization does not validate helper implementations, disable callable context values, or sandbox templates.
• Keep precompiler filenames, template names, and --namespace, --commonjs, and --handlebarPath options under build configuration control. Map external identifiers to approved files and names instead of forwarding them into generated JavaScript.

HTML output and escaping