From df358ae24efca59f9eb2636cae6af51d055c54b7 Mon Sep 17 00:00:00 2001 From: Dread Date: Sat, 10 Oct 2026 19:39:32 -0700 Subject: [PATCH] chore(deps): pin handlebars 4.7.10 via resolutions (Audit critical) `make audit` (yarn audit --level critical) fails on main since the two Handlebars advisories published with 4.7.10 (JS injection via AST type confusion; via own-property-check bypass). handlebars is a transitive dep of grpc_tools_node_protoc_ts and spectaql only; the existing `**/handlebars` resolution pinned 4.7.9. Bump it to 4.7.10. No runtime code path uses handlebars. Verified: `yarn audit --level critical` exit 14 (no critical) after the bump, 30 before. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01G4SaLJF5SWq6sjBEaWJFow --- package.json | 2 +- yarn.lock | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/package.json b/package.json index 4aed9fd81..c3cbbfbc1 100644 --- a/package.json +++ b/package.json @@ -229,7 +229,7 @@ "**/axios": "1.16.0", "**/body-parser": "1.20.3", "**/ws": "8.20.0", - "**/handlebars": "4.7.9", + "**/handlebars": "4.7.10", "**/immutable": "5.1.5", "**/fast-uri": "3.1.2", "**/glob": "10.5.0", diff --git a/yarn.lock b/yarn.lock index e8897caaf..7507349ce 100644 --- a/yarn.lock +++ b/yarn.lock @@ -8606,12 +8606,12 @@ gzip-size@^5.1.1: duplexer "^0.1.1" pify "^4.0.1" -handlebars@4.7.7, handlebars@4.7.9, handlebars@^4.7.7: - version "4.7.9" - resolved "https://registry.yarnpkg.com/handlebars/-/handlebars-4.7.9.tgz#6f139082ab58dc4e5a0e51efe7db5ae890d56a0f" - integrity sha512-4E71E0rpOaQuJR2A3xDZ+GM1HyWYv1clR58tC8emQNeQe3RH7MAzSbat+V0wG78LQBo6m6bzSG/L4pBuCsgnUQ== +handlebars@4.7.10, handlebars@4.7.7, handlebars@^4.7.7: + version "4.7.10" + resolved "https://registry.yarnpkg.com/handlebars/-/handlebars-4.7.10.tgz#12419ea1b41391b3ffcf003f2164dcbce090c417" + integrity sha512-P5VJMVM7qgBn6vjXMw8WG9uVI+ncf2pi72j4de4yz5ZULLj2RGqLYaKOYGsgyrViQ0tePOVlN1tDCCXXtFqXKg== dependencies: - minimist "^1.2.5" + minimist "^1.2.8" neo-async "^2.6.2" source-map "^0.6.1" wordwrap "^1.0.0" @@ -10766,7 +10766,7 @@ minimatch@^5.1.0: dependencies: brace-expansion "^2.0.1" -minimist@^1.2.0, minimist@^1.2.5, minimist@^1.2.6: +minimist@^1.2.0, minimist@^1.2.5, minimist@^1.2.6, minimist@^1.2.8: version "1.2.8" resolved "https://registry.yarnpkg.com/minimist/-/minimist-1.2.8.tgz#c1a464e7693302e082a075cee0c057741ac4772c" integrity sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==