build(deps): bump @types/handlebars from 4.0.40 to 4.1.0

[dependabot]

Bumps @types/handlebars from 4.0.40 to 4.1.0.

Changelog

Sourced from @​types/handlebars's changelog.

v4.1.0 - February 7th, 2019

New Features

• import TypeScript typings - 27ac1ee

Security fixes:

• disallow access to the constructor in templates to prevent RCE - 42841c4, #1495

Housekeeping

• chore: fix components/handlebars package.json and auto-update on release - bacd473
• chore: Use node 10 to build handlebars - 78dd89c
• chore/doc: Add more release docs - 6b87c21

Compatibility notes:

Access to class constructors (i.e. ({}).constructor) is now prohibited to prevent Remote Code Execution. This means that following construct will no work anymore:

class SomeClass {
}
SomeClass.staticProperty = 'static'
var template = Handlebars.compile('{{constructor.staticProperty}}');

document.getElementById('output').innerHTML = template(new SomeClass());

// expected: 'static', but now this is empty.

This kind of access is not the intended use of Handlebars and leads to the vulnerability described in #1495. We will not increase the major version, because such use is not intended or documented, and because of the potential impact of the issue (we fear that most people won't use a new major version and the issue may not be resolved on many systems).

Commits

v4.0.12 - September 4th, 2018

New features:

• none

Various dependency updates

• #1464 - Bump versions of grunt-plugins to 1.x
• #1398 - Chore: updated various dev dependencies
• upgrade uglify-js - d3d3942
• Update grunt-eslint to 20.1.0 - 7729aa9
• Update dependencies "async" to 2.5.0 and "source-map" to 0.6.1 (73d5637)

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)