[mtrezza]

Closes #624

Changes

Security update of a transitive, development-only dependency (lock file only). handlebars is only used by the release tooling (conventional-changelog-writer@8.0.0 via @semantic-release/release-notes-generator and @semantic-release/commit-analyzer); it is not part of the published package.

• 4.7.10: Fixes GHSA-p8wg-vrv2-v86f (critical, JavaScript injection via own property check bypass), GHSA-8r5x-fm3f-whwj (critical, JavaScript injection via AST type confusion in compile) and GHSA-xw65-4hp5-5hc7 (medium, JavaScript injection via unsafe inline embedding of precompiled templates). Further hardening: sanitize the source map URL when minifying, iterate lazily in #each and strip whitespace in linear time, only compile partials that are template strings, only dispatch known AST node types. Bumps its own minimist dependency to ^1.2.8 (handlebars-lang/handlebars.js@ea8ed82).
• Compatibility note from the release: {{#each}} now iterates iterables such as Map, Set and generators lazily instead of copying them into an array first.

Lock file side effect: the hoisted minimist moves from 1.2.6 to 1.2.8 to satisfy the new range (Dependabot's branch for #624 contains the same change). The other dependents' ranges are still satisfied: web-push (^1.2.5, production) and rc (^1.2.0, dev). web-push only uses minimist in its CLI (src/cli.js), which this adapter does not load. minimist 1.2.7 contains only tooling changes; 1.2.8 fixes argument-parsing edge cases.

Breaking Changes

None

Code Changes Required

None — the upgrade is a drop-in replacement. conventional-changelog-writer registers the .releaserc/*.hbs partials as strings, compiles with noEscape: true and passes arrays to #each, so the 4.7.10 changes do not apply. Release notes rendered from this repository's .releaserc.js and templates (480 commits of master plus synthetic commits with notes, scopes, references and reverts; 6 scenarios) are byte-identical on 4.7.9 and 4.7.10.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

Warning

Review limit reached

The included review limit has been reached and this organization has disabled usage-based review continuation. Wait for reviews to reset or ask a billing admin to change After included review limits.

• Ask an admin to enable usage-based reviews

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Next included review available in 7 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available. Your 38 included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 7b90f66c-13a6-4228-a233-9f13efec3fd1

📥 Commits

Reviewing files that changed from the base of the PR and between 9fa49e6 and 27f1940.

📒 Files selected for processing: 1

• package-lock.json

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.18%. Comparing base (9fa49e6) to head (27f1940).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #628   +/-   ##
=======================================
  Coverage   99.18%   99.18%           
=======================================
  Files          11       11           
  Lines        1841     1841           
=======================================
  Hits         1826     1826           
  Misses         15       15           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[parseplatformorg]

🎉 This change has been released in version 8.5.7