[cristim]

Summary

• Bumps the transitive dev dependency handlebars 4.7.9 -> 4.7.10 (lockfile only; pulled in by jest/istanbul-reports).
• Clears three advisories (one critical: GHSA-8r5x-fm3f-whwj, plus GHSA-xw65-4hp5-5hc7 and GHSA-p8wg-vrv2-v86f) that fail the CI "Security Scanning" job (npm audit --audit-level=high) on main since a23772d, which blocks every platform PR.
• The sprintf-js moderate advisory is not touched: it is below the high gate and its only fix is a breaking ts-jest change.

Verification

• npm audit --package-lock-only --audit-level=high exits 0 on this branch (critical present before).
• Local tsc --noEmit, eslint (0 errors) and full Jest (99 suites, 3141 passed, 1 skipped) pass. Note: local node_modules is a shared symlink and was not reinstalled, so the real install check is CI's npm ci.
• Diff: 4 lines in frontend/package-lock.json, no package.json change.

Refs #632 (unblocks #684)

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated supporting package metadata. This maintenance change does not alter any user-facing features or behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-platform/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: f8c255c8-032c-4b1f-88ee-52d4ef9f6b1a

---

📥 Commits

Reviewing files that changed from the base of the PR and between a23772d and 1a4616e.

---

📒 Files selected for processing (1)

• frontend/package-lock.json

---

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

---

---

📝 Walkthrough

Walkthrough

The frontend lockfile updates the resolved handlebars package from 4.7.9 to 4.7.10. It also updates the package artifact, integrity hash, and minimist dependency range.

Changes

Frontend dependency update

Layer / File(s)	Summary
Update Handlebars lock entry frontend/package-lock.json	The lock entry updates handlebars to 4.7.10, with a new resolved artifact and integrity hash. Its minimist range changes from ^1.2.5 to ^1.2.8.

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

---

Merge Risk: ⚪ Minimal · up to 1a461

The lockfile selects the patched Handlebars version with a compatible dependency; no actionable merge blocker was identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely identifies the dependency update and its security-audit purpose. It matches the main change in the pull request.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

---

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Independent review (cc-cli-w2; I did not write this PR) at 1a4616ed704dadf303cc8726442d64b78bd51a1e

Verdict: CLEAN, no actionable findings.

What I checked, with the evidence reproduced rather than taken from the PR body:

• Scope. I fetched frontend/package.json and frontend/package-lock.json at the head and at the merge base a23772d1. package.json is byte-identical. A full diff of the lockfile shows only the node_modules/handlebars entry: the version, resolved URL and integrity, plus its declared minimist range moving from ^1.2.5 to ^1.2.8. No other package moved.
• Integrity. npm view handlebars@4.7.10 dist.integrity returns sha512-P5VJMVM7...FqXKg==, which matches the lockfile.
• minimist. The lock already installs node_modules/minimist at 1.2.8, so the new ^1.2.8 range is satisfied without a new resolution. The only dependent of handlebars is ts-jest (^4.7.8), and 4.7.10 satisfies that range.
• Advisories (GitHub advisory API). All three affect handlebars >= 4.0.0, <= 4.7.9, with first patched version 4.7.10:
  • GHSA-8r5x-fm3f-whwj: critical.
  • GHSA-p8wg-vrv2-v86f: critical.
  • GHSA-xw65-4hp5-5hc7: medium.
• npm audit. npm audit --package-lock-only --audit-level=high:
  • On the base it exits 1 (1 critical, 20 moderate).
  • On the head it exits 0 (20 moderate).
  • CI's Security Scanning step runs npm audit --audit-level=high (.github/workflows/ci.yml:645), so it should pass on this head.
• CI at the head when I checked. Build frontend has passed; it does npm ci against the new integrity. Security Scanning, the tests and CodeRabbit were still pending, so the merge gate still needs them green at this SHA.

Non-blocking note: the 20 moderates are still there, including GHSA-hp3w-g68c-fv3c (sprintf-js <= 1.1.3, which has no patched release and comes in through the jest/istanbul chain). They stay under the high threshold, so they don't block CI. They're worth a tracking issue.

Read-only review, because of the disk hold: no npm install and no test runs. The only commands I ran were lockfile-only npm audit, npm view and GitHub API reads.

[cristim]

Superseded by #693 (merged as 30d6c84), which carries this handlebars 4.7.10 lockfile commit together with the Go 1.26.9 / x/net v0.60.0 bump; the two PRs were each red only on the other's advisory.