fix(deps): vuln minor: sprintf-js · patch: handlebars [package.json]

[gh-worker-campaigns-3e9aa4]

Summary: Critical-severity security update — 2 packages upgraded (MINOR changes included)

Manifests changed:

• package.json (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
handlebars	4.7.9	4.7.10	patch	Transitive	4 CRITICAL, 2 MEDIUM
sprintf-js	1.0.3	1.1.3	minor	Transitive	2 MEDIUM

---

Security Details

🚨 Critical & High Severity (4 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
handlebars	GHSA-p8wg-vrv2-v86f	CRITICAL	Handlebars: JavaScript Injection via Own Property Check Bypass	4.7.9	4.7.10	-
handlebars	CVE-2026-106445	CRITICAL	Handlebars: JavaScript Injection via Own Property Check Bypass	4.7.9	-	-
handlebars	GHSA-8r5x-fm3f-whwj	CRITICAL	Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)	4.7.9	4.7.10	-
handlebars	CVE-2026-106446	CRITICAL	Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)	4.7.9	-	-

ℹ️ Other Vulnerabilities (4)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
handlebars	GHSA-xw65-4hp5-5hc7	MODERATE	Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates	4.7.9	4.7.10	-
handlebars	CVE-2026-106444	MODERATE	Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates	4.7.9	-	-
sprintf-js	GHSA-hp3w-g68c-fv3c	MODERATE	sprintf-js vulnerable to denial of service through unbounded precision specifiers	1.0.3	-	-
sprintf-js	CVE-2026-97058	MODERATE	sprintf-js through 1.1.3 Denial of Service via Unbounded Precision	1.0.3	-	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T13:51:34.448736Z	8e04fce	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[dd-prapprover-prod-77c48c]

PRApprover will approve and merge this PR, FAQ, #dx-source-code-management

🛠️ PRApproval Status

• ✅ PR is eligible for auto-approval by rule dependency-management-version-updater - 2026-10-12T13:45:07Z
• ✅ CI tests passed - 2026-10-12T13:45:11Z
• ✅ Approved (commit: 8e04fce) - 2026-10-12T13:45:13Z
• ✅ Merge Started
• ✅ Merged - 2026-10-12T13:45:24Z

➡️ Current phase: PR merged successfully! ✅

[dd-prapprover-prod-77c48c]

This PR has been automatically approved by the DD PR Approver bot.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8e04fceab7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Resolve sprintf-js beyond the vulnerable 1.1.3 release

For the advisory this change is intended to remediate, CVE-2026-97058 explicitly affects sprintf-js through 1.1.3, but this resolution makes the generated lockfile select exactly 1.1.3 for the previously separate ~1.0.2 dependency (yarn.lock lines 4906-4909). Consequently, attacker-controlled unbounded precision specifiers can still trigger the reported denial of service; use the first version outside the affected range or replace the dependency rather than treating 1.1.3 as the fix.

Useful? React with 👍 / 👎.