Repository navigation
chore(deps): refresh handlebars to 4.7.10 to patch 3 CVEs - #1236
Draft
cursor[bot] wants to merge 1 commit into
Draft
cursor[bot] wants to merge 1 commit into
cursor[bot] wants to merge 1 commit into
Conversation
Contributor
|
@cursor fix the commitlint issue |
Author
|
Done — commitlint was failing because the type
  |
Deleted the handlebars lockfile block and ran `yarn install` so the existing `^4.7.7` / `^4.7.9` ranges re-resolve from 4.7.9 to the newer 4.7.10 patch release published 2026-10-05. 4.7.10 fixes three advisories flagged by `yarn npm audit --all --recursive` on origin/main (all pulled in transitively via ts-jest and conventional-changelog-writer, dev-only): - GHSA-xw65-4hp5-5hc7 (moderate) JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates - GHSA-8r5x-fm3f-whwj (critical) JavaScript Injection via AST Type Confusion in compile - GHSA-p8wg-vrv2-v86f (critical) JavaScript Injection via Own Property Check Bypass No manifest changes; yarn.lock-only diff. `yarn build:test` passes. Co-authored-by: Andreja Kogovsek <andrejak@users.noreply.github.com>
cursor
Bot
force-pushed
the
cursor/dependabot-alerts-investigation-4b6d
branch
from
October 22, 2026 19:05
4424e3a to
eaa40a0
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Refresh the pinned transitive
handlebarsversion from 4.7.9 to 4.7.10 by deleting itsyarn.lockblock and runningyarn install. The existing^4.7.7/^4.7.9consumer ranges re-resolve to the new patch release (published 2026-10-05).Yarn lockfile-only diff; no manifest changes, no new
resolutionsentry.Why
yarn npm audit --all --recursiveonorigin/mainflagged 3 real CVEs onhandlebars@4.7.9(plus unchanged advisories onbracesandsprintf-jsthat have no upstream fix — see below). All three handlebars advisories are<=4.7.9and are fixed in 4.7.10:compile(bypass of CVE-2026-33937)handlebarsis a dev-only transitive dep, pulled in throughts-jest@29.4.12andconventional-changelog-writer@8.4.0.Verification
yarn installsucceeds (no manifest changes required).yarn why handlebarsnow reportshandlebars@4.7.10for all three dependents.yarn npm audit --recursive --allno longer reports the three handlebars CVEs.yarn build:testpasses.Not fixed in this PR
Two advisories remain and have no upstream fix available — they are left alone intentionally:
micromatch@4.0.8. Advisory range is<=3.0.3;3.0.3is the latest release on npm. Dev-only (jest tooling).argparse@1.0.10→js-yaml@3.15.2→@istanbuljs/load-nyc-config@1.1.0. Advisory range is<=1.1.3; latest sprintf-js on npm is1.1.3, which is still within the vulnerable range. Dev-only (jest coverage).No new
resolutionsentries added.