From 1a4616ed704dadf303cc8726442d64b78bd51a1e Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Fri, 9 Oct 2026 10:29:50 +0200 Subject: [PATCH] fix(deps): bump handlebars to 4.7.10 to clear npm audit critical - Lockfile-only update of the transitive dev dependency (pulled in by jest/istanbul-reports). Clears GHSA-xw65-4hp5-5hc7, GHSA-8r5x-fm3f-whwj and GHSA-p8wg-vrv2-v86f, which fail the CI "Security Scanning" job (npm audit --audit-level=high) on main. - The remaining sprintf-js moderate advisory does not trip the high gate and needs a breaking ts-jest change, so it is left alone. --- frontend/package-lock.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/frontend/package-lock.json b/frontend/package-lock.json index 7260ecfac..49b22149b 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -7022,13 +7022,13 @@ "license": "MIT" }, "node_modules/handlebars": { - "version": "4.7.9", - "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.9.tgz", - "integrity": "sha512-4E71E0rpOaQuJR2A3xDZ+GM1HyWYv1clR58tC8emQNeQe3RH7MAzSbat+V0wG78LQBo6m6bzSG/L4pBuCsgnUQ==", + "version": "4.7.10", + "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.10.tgz", + "integrity": "sha512-P5VJMVM7qgBn6vjXMw8WG9uVI+ncf2pi72j4de4yz5ZULLj2RGqLYaKOYGsgyrViQ0tePOVlN1tDCCXXtFqXKg==", "dev": true, "license": "MIT", "dependencies": { - "minimist": "^1.2.5", + "minimist": "^1.2.8", "neo-async": "^2.6.2", "source-map": "^0.6.1", "wordwrap": "^1.0.0"