From b56bdc179bc04834b9339345407eff78973409d1 Mon Sep 17 00:00:00 2001 From: Maxi Gimenez Date: Tue, 20 Oct 2026 17:30:52 +0000 Subject: [PATCH] fix(deps): bump handlebars to 4.7.10 in the lockfile MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes two critical advisories and one moderate. handlebars is a transitive devDependency reached only through ts-jest, which requests ^4.7.9 — a range that already admits the patched 4.7.10, so this is a lockfile-only change with no manifest edit. GHSA-8r5x-fm3f-whwj (CVE-2026-106446, 9.8), GHSA-p8wg-vrv2-v86f (CVE-2026-106445, 9.2) and GHSA-xw65-4hp5-5hc7 (CVE-2026-106444, 4.7). Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_018qgaL5CQfmSJPjjMG9RSqh --- package-lock.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index 13a9f33..07ad02f 100644 --- a/package-lock.json +++ b/package-lock.json @@ -3770,13 +3770,13 @@ "dev": true }, "node_modules/handlebars": { - "version": "4.7.9", - "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.9.tgz", - "integrity": "sha512-4E71E0rpOaQuJR2A3xDZ+GM1HyWYv1clR58tC8emQNeQe3RH7MAzSbat+V0wG78LQBo6m6bzSG/L4pBuCsgnUQ==", + "version": "4.7.10", + "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.10.tgz", + "integrity": "sha512-P5VJMVM7qgBn6vjXMw8WG9uVI+ncf2pi72j4de4yz5ZULLj2RGqLYaKOYGsgyrViQ0tePOVlN1tDCCXXtFqXKg==", "dev": true, "license": "MIT", "dependencies": { - "minimist": "^1.2.5", + "minimist": "^1.2.8", "neo-async": "^2.6.2", "source-map": "^0.6.1", "wordwrap": "^1.0.0"